After doing more testing, the modification I made to gs_init.ps doesn't
work properly with .pdf files. Both ps2pdf and pdf2ps fail with this
message:
Unrecoverable error: invalidfileaccess in w
Operand stack:
%stdout
The modification is good for passing the ifhp security test, but doesn't
work in production.
Sorry! Perhaps there's a PostScript programmer on the list who could fix
this?
Carl G. Riches
Software Engineer
Department of Mathematics
Box 354350 voice: 206-543-5082 or 206-616-3636
University of Washington fax: 206-543-0397
Seattle, WA 98195-4350 internet: [EMAIL PROTECTED]
On Thu, 27 Dec 2001, Carl Riches wrote:
> On Fri, 28 Dec 2001, C. L. McAvaney wrote:
>
> >
> > Date: Wed, 26 Dec 2001 14:24:30 -0800 (PST)
> > From: Patrick Powell <[EMAIL PROTECTED]>
> >
> > > Did you run the test that was in the README? I think that this
> > > problem was solved in AFPL Ghostscript and it works correctly
> > > now WITHOUT the patch.
> > Yep, I ran those tests (without and with the modifications you suggested),
> > the output was similar to the output below.
> > I thought that this was correct, perhaps it is not??
> > If I just leave AFPL GS as it is, I can display the passwd file with your
> > test script.
> >
>
> I have just installed AFPL Ghostscript 7.03, and found that I had to
> replace part of the file:
>
> gs_init.ps
>
> with this code:
>
> % If we want a "safer" system, disable some obvious ways to cause havoc.
> SAFER not { (%END SAFER) .skipeof } if
>
> .currentglobal true .setglobal
> /SAFETY 2 dict
> dup /safe DELAYSAFER not put
> dup /tempfiles 10 dict put
> readonly def
> .setglobal
>
> /.setsafe
> { //SAFETY /safe //true .forceput % overrides readonly
> } .bind executeonly odef
>
> /file
> { //SAFETY /safe get {
> dup (r) eq
> 2 index (%pipe*) .stringmatch not and
> 3 index (%std*) .stringmatch not and
> or or
> { file }
> { /invalidfileaccess //signalerror exec }
> ifelse
> } {
> file
> } ifelse
> } .bind executeonly odef
>
>
> Here are the actual SCCS diffs of the file:
>
> ------- gs_init.ps -------
> 1567,1568c1567,1570
> < dup (r) eq 2 index (%pipe*) .stringmatch not and
> < 2 index (%std*) .stringmatch or
> ---
> > dup (r) eq
> > 2 index (%pipe*) .stringmatch not and
> > 3 index (%std*) .stringmatch not and
> > or or
>
> The changes noted in the IFHP file:
>
> README.GhostScriptSecurityProblem
>
> don't work for this version of Ghostscript. There was also some some
> traffic on this list about AFPL Ghostscript 7.0, but the changes to
> gs_init.ps noted in that exchange also did not work.
>
> I don't know what side effects my code (above) will cause--I'm not a
> PostScript programmer. But it does pass Patrick's diabolical "get the
> root password" test and also prints my basic PostScript files.
>
> Carl
>
> Carl G. Riches
> Software Engineer
> Department of Mathematics
> Box 354350 voice: 206-543-5082 or 206-616-3636
> University of Washington fax: 206-543-0397
> Seattle, WA 98195-4350 internet: [EMAIL PROTECTED]
>
> >
> > >
> > > Patrick
> > >
> > > > From [EMAIL PROTECTED] Sun Dec 23 19:03:32 2001
> > > > To: [EMAIL PROTECTED]
> > > > Subject: LPRng: AFPL Ghostscript 7.03 with suggested -dSAFER modification
> > > > Date: Mon, 24 Dec 2001 13:31:19 +1100
> > > > From: "C. L. McAvaney" <[EMAIL PROTECTED]>
> > > >
> > > > G'day,
> > > > I have put in the suggested modifications to gs_init.ps from the ifhp
> > > > README.GhostScriptSecurityProblem file and now when I want to view a prop
> > >er
> > > > Postscript file I get the following:
> > > >
> > > > gs -dSAFER UTILS/one.ps
> > > > AFPL Ghostscript 7.03 (2001-10-20)
> > > > Copyright (C) 2001 artofcode LLC, Benicia, CA. All rights reserved.
> > > > This software comes with NO WARRANTY: see the file PUBLIC for details.
> > > > Error: /invalidfileaccess in -file-
> > > > Operand stack:
> > > >
> > > > Execution stack:
> > > > %interp_exit .runexec2 --nostringval-- --nostringval-- --nostr
> > >ingval-- 2 %stopped_push --nostringval-- --nostringval-- --nostrin
> > >gval-- false 1 %stopped_push 1 3 %oparray_pop --nostringval--
> > > --nostringval--
> > > > Dictionary stack:
> > > > --dict:999/1123(ro)(G)-- --dict:0/20(G)-- --dict:67/200(L)--
> > > > Current allocation mode is local
> > > > Current file position is 0
> > > > AFPL Ghostscript 7.03: Unrecoverable error, exit code 1
> > > > 1
> > > > Unrecoverable error: invalidfileaccess in w
> > > > Operand stack:
> > > > %stdout
> > > >
> > > > Does anybody else have a similar problem?
> > > >
> > > > Christopher
> > > > ,,,
> > > > (. .)
> > > > /-----.oOO--(_)--OOo.-------------------------------------------------\
> > > > | Christopher McAvaney [EMAIL PROTECTED] |
> > > > | PhD Candidate [EMAIL PROTECTED] |
> > > > | [EMAIL PROTECTED] |
> > > > | phone: +61+3+52272960 [EMAIL PROTECTED] |
> > > > | fax: +61+3+52272028 http://www.cm.deakin.edu.au/~chrismc |
> > > > \---------------------------------------------------------------------/
> > > >
> > > >
> > > > -------------------------------------------------------------------------
> > >----
> > > > YOU MUST BE A LIST MEMBER IN ORDER TO POST TO THE LPRNG MAILING LIST
> > > > The address you post from MUST be your subscription address
> > > >
> > > > If you need help, send email to [EMAIL PROTECTED] (or lprng-requests
> > > > or lprng-digest-requests) with the word 'help' in the body. For the impa
> > >tient,
> > > > to subscribe to a list with name LIST, send mail to [EMAIL PROTECTED]
> > > > with: | example:
> > > > subscribe LIST <mailaddr> | subscribe lprng-digest [EMAIL PROTECTED]
> > > > unsubscribe LIST <mailaddr> | unsubscribe lprng [EMAIL PROTECTED]
> > > >
> > > > If you have major problems, send email to [EMAIL PROTECTED] with the w
> > >ord
> > > > LPRNGLIST in the SUBJECT line.
> > > > -------------------------------------------------------------------------
> > >----
> > > >
> > >
> > > ---------------------------------------------------------------------------
> > >--
> > > YOU MUST BE A LIST MEMBER IN ORDER TO POST TO THE LPRNG MAILING LIST
> > > The address you post from MUST be your subscription address
> > >
> > > If you need help, send email to [EMAIL PROTECTED] (or lprng-requests
> > > or lprng-digest-requests) with the word 'help' in the body. For the impati
> > >ent,
> > > to subscribe to a list with name LIST, send mail to [EMAIL PROTECTED]
> > > with: | example:
> > > subscribe LIST <mailaddr> | subscribe lprng-digest [EMAIL PROTECTED]
> > > unsubscribe LIST <mailaddr> | unsubscribe lprng [EMAIL PROTECTED]
> > >
> > > If you have major problems, send email to [EMAIL PROTECTED] with the wor
> > >d
> > > LPRNGLIST in the SUBJECT line.
> > > ---------------------------------------------------------------------------
> > >--
> > >
> >
> > Christopher
> > ,,,
> > (. .)
> > /-----.oOO--(_)--OOo.-------------------------------------------------\
> > | Christopher McAvaney [EMAIL PROTECTED] |
> > | PhD Candidate [EMAIL PROTECTED] |
> > | [EMAIL PROTECTED] |
> > | phone: +61+3+52272960 [EMAIL PROTECTED] |
> > | fax: +61+3+52272028 http://www.cm.deakin.edu.au/~chrismc |
> > \---------------------------------------------------------------------/
> >
> > -----------------------------------------------------------------------------
> > YOU MUST BE A LIST MEMBER IN ORDER TO POST TO THE LPRNG MAILING LIST
> > The address you post from MUST be your subscription address
> >
> > If you need help, send email to [EMAIL PROTECTED] (or lprng-requests
> > or lprng-digest-requests) with the word 'help' in the body. For the impatient,
> > to subscribe to a list with name LIST, send mail to [EMAIL PROTECTED]
> > with: | example:
> > subscribe LIST <mailaddr> | subscribe lprng-digest [EMAIL PROTECTED]
> > unsubscribe LIST <mailaddr> | unsubscribe lprng [EMAIL PROTECTED]
> >
> > If you have major problems, send email to [EMAIL PROTECTED] with the word
> > LPRNGLIST in the SUBJECT line.
> > -----------------------------------------------------------------------------
>
>
> -----------------------------------------------------------------------------
> YOU MUST BE A LIST MEMBER IN ORDER TO POST TO THE LPRNG MAILING LIST
> The address you post from MUST be your subscription address
>
> If you need help, send email to [EMAIL PROTECTED] (or lprng-requests
> or lprng-digest-requests) with the word 'help' in the body. For the impatient,
> to subscribe to a list with name LIST, send mail to [EMAIL PROTECTED]
> with: | example:
> subscribe LIST <mailaddr> | subscribe lprng-digest [EMAIL PROTECTED]
> unsubscribe LIST <mailaddr> | unsubscribe lprng [EMAIL PROTECTED]
>
> If you have major problems, send email to [EMAIL PROTECTED] with the word
> LPRNGLIST in the SUBJECT line.
> -----------------------------------------------------------------------------
>
-----------------------------------------------------------------------------
YOU MUST BE A LIST MEMBER IN ORDER TO POST TO THE LPRNG MAILING LIST
The address you post from MUST be your subscription address
If you need help, send email to [EMAIL PROTECTED] (or lprng-requests
or lprng-digest-requests) with the word 'help' in the body. For the impatient,
to subscribe to a list with name LIST, send mail to [EMAIL PROTECTED]
with: | example:
subscribe LIST <mailaddr> | subscribe lprng-digest [EMAIL PROTECTED]
unsubscribe LIST <mailaddr> | unsubscribe lprng [EMAIL PROTECTED]
If you have major problems, send email to [EMAIL PROTECTED] with the word
LPRNGLIST in the SUBJECT line.
-----------------------------------------------------------------------------
