Hello community, here is the log from the commit of package ghostscript for openSUSE:Factory checked in at 2019-01-26 22:19:30 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/ghostscript (Old) and /work/SRC/openSUSE:Factory/.ghostscript.new.28833 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "ghostscript" Sat Jan 26 22:19:30 2019 rev:35 rq:668141 version:9.26a Changes: -------- --- /work/SRC/openSUSE:Factory/ghostscript/ghostscript-mini.changes 2018-12-05 09:37:45.245075427 +0100 +++ /work/SRC/openSUSE:Factory/.ghostscript.new.28833/ghostscript-mini.changes 2019-01-26 22:19:33.990994121 +0100 @@ -1,0 +2,18 @@ +Wed Jan 23 16:52:00 CET 2019 - [email protected] + +- Version upgrade to 9.26a + The version 9.26a is a special security bugfix version to fix + * CVE-2019-6116: subroutines within pseudo-operators + must themselves be pseudo-operators + https://bugs.ghostscript.com/show_bug.cgi?id=700317 + https://bugzilla.suse.com/show_bug.cgi?id=1122319 bsc#1122319 + +------------------------------------------------------------------- +Thu Jan 10 17:09:16 UTC 2019 - [email protected] + +- ghostscript-2.26-subclassing-devices-fix-put_image-method.patch + fixes Ghostscript issue #700315 and bsc#1121490 + https://bugs.ghostscript.com/show_bug.cgi?id=700315 + Segfault in GS 9.26 with certain PDFs with -dLastPage=1 + +------------------------------------------------------------------- ghostscript.changes: same change Old: ---- ghostscript-9.26.tar.gz New: ---- ghostscript-2.26-subclassing-devices-fix-put_image-method.patch ghostscript-9.26a.tar.gz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ ghostscript-mini.spec ++++++ --- /var/tmp/diff_new_pack.JFIWBP/_old 2019-01-26 22:19:35.002993301 +0100 +++ /var/tmp/diff_new_pack.JFIWBP/_new 2019-01-26 22:19:35.006993297 +0100 @@ -1,7 +1,7 @@ # # spec file for package ghostscript-mini # -# Copyright (c) 2018 SUSE LINUX Products GmbH, Nuernberg, Germany. +# Copyright (c) 2019 SUSE LINUX Products GmbH, Nuernberg, Germany. # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed @@ -38,9 +38,13 @@ # because rpmvercmp would treat 9.pre15rc1 as 9.pre.15.rc1 and letters are older than numbers # so that we keep additionally the previous version number to upgrade from the previous version: #Version: 9.25pre26rc1 -# Normal version for Ghostscript releases is the upstream version: -Version: 9.26 +# The upstream version 9.26a is a special Ghostscript upstream security bugfix tar ball +# where upstream provides a complete and consistent state of the whole Ghostscript code +# that includes in particular the complete patchset that is really non-trivial +# to fix the Ghostscript upstream bug 700317 CVE-2019-6116: +Version: 9.26a Release: 0 +# Normal version for Ghostscript releases is the upstream version: # tarball_version is used below to specify the directory via "setup -n": # Special tarball_version needed for Ghostscript release candidates e.g. "define tarball_version 9.15rc1". # For Ghostscript releases tarball_version and version are the same (i.e. the upstream version): @@ -49,8 +53,8 @@ # built_version is used below in the install and files sections: # Separated built_version needed in case of Ghostscript release candidates e.g. "define built_version 9.15". # For Ghostscript releases built_version and version are the same (i.e. the upstream version): -%define built_version %{version} -#define built_version 9.26 +#define built_version %{version} +%define built_version 9.26 # Source0...Source9 is for sources from upstream: # Special URLs for Ghostscript release candidates: # see https://github.com/ArtifexSoftware/ghostpdl-downloads/releases @@ -68,6 +72,7 @@ # MD5 checksum for Source0: 806bc2dedbc7f69b003f536658e08d4a ghostscript-9.26.tar.gz Source0: ghostscript-%{version}.tar.gz # Patch0...Patch9 is for patches from upstream: +Patch0: ghostscript-2.26-subclassing-devices-fix-put_image-method.patch # Source10...Source99 is for sources from SUSE which are intended for upstream: # Patch10...Patch99 is for patches from SUSE which are intended for upstream: # Source100...Source999 is for sources from SUSE which are not intended for upstream: @@ -133,6 +138,7 @@ # Be quiet when unpacking and # use a directory name matching Source0 to make it work also for ghostscript-mini: %setup -q -n ghostscript-%{tarball_version} +%patch0 -p1 # Patch100 remove-zlib-h-dependency.patch removes dependency on zlib/zlib.h # in makefiles as we do not use the zlib sources from the Ghostscript upstream tarball. # Again use the zlib sources from Ghostscript upstream ++++++ ghostscript.spec ++++++ --- /var/tmp/diff_new_pack.JFIWBP/_old 2019-01-26 22:19:35.014993291 +0100 +++ /var/tmp/diff_new_pack.JFIWBP/_new 2019-01-26 22:19:35.018993288 +0100 @@ -1,7 +1,7 @@ # # spec file for package ghostscript # -# Copyright (c) 2018 SUSE LINUX Products GmbH, Nuernberg, Germany. +# Copyright (c) 2019 SUSE LINUX Products GmbH, Nuernberg, Germany. # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed @@ -58,9 +58,13 @@ # because rpmvercmp would treat 9.pre15rc1 as 9.pre.15.rc1 and letters are older than numbers # so that we keep additionally the previous version number to upgrade from the previous version: #Version: 9.25pre26rc1 -# Normal version for Ghostscript releases is the upstream version: -Version: 9.26 +# The upstream version 9.26a is a special Ghostscript upstream security bugfix tar ball +# where upstream provides a complete and consistent state of the whole Ghostscript code +# that includes in particular the complete patchset that is really non-trivial +# to fix the Ghostscript upstream bug 700317 CVE-2019-6116: +Version: 9.26a Release: 0 +# Normal version for Ghostscript releases is the upstream version: # tarball_version is used below to specify the directory via "setup -n": # Special tarball_version needed for Ghostscript release candidates e.g. "define tarball_version 9.15rc1". # For Ghostscript releases tarball_version and version are the same (i.e. the upstream version): @@ -69,8 +73,8 @@ # built_version is used below in the install and files sections: # Separated built_version needed in case of Ghostscript release candidates e.g. "define built_version 9.15". # For Ghostscript releases built_version and version are the same (i.e. the upstream version): -%define built_version %{version} -#define built_version 9.26 +#define built_version %{version} +%define built_version 9.26 # Source0...Source9 is for sources from upstream: # Special URLs for Ghostscript release candidates: # see https://github.com/ArtifexSoftware/ghostpdl-downloads/releases @@ -88,6 +92,7 @@ # MD5 checksum for Source0: 806bc2dedbc7f69b003f536658e08d4a ghostscript-9.26.tar.gz Source0: ghostscript-%{version}.tar.gz # Patch0...Patch9 is for patches from upstream: +Patch0: ghostscript-2.26-subclassing-devices-fix-put_image-method.patch # Source10...Source99 is for sources from SUSE which are intended for upstream: # Patch10...Patch99 is for patches from SUSE which are intended for upstream: # Source100...Source999 is for sources from SUSE which are not intended for upstream: @@ -269,6 +274,7 @@ # Be quiet when unpacking and # use a directory name matching Source0 to make it work also for ghostscript-mini: %setup -q -n ghostscript-%{tarball_version} +%patch0 -p1 # Patch100 remove-zlib-h-dependency.patch removes dependency on zlib/zlib.h # in makefiles as we do not use the zlib sources from the Ghostscript upstream tarball. # Again use the zlib sources from Ghostscript upstream ++++++ ghostscript-2.26-subclassing-devices-fix-put_image-method.patch ++++++ >From fae21f1668d2b44b18b84cf0923a1d5f3008a696 Mon Sep 17 00:00:00 2001 From: Ken Sharp <[email protected]> Date: Tue, 4 Dec 2018 21:31:31 +0000 Subject: [PATCH] subclassing devices - fix put_image method The subclassing devices need to change the 'memory device' parameter to be the child device, when its the same as the subclassing device. Otherwise we end up trying to access the child device's memory pointers in the subclassing device, which may not contain valid copies of those pointers. --- base/gdevsclass.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/base/gdevsclass.c b/base/gdevsclass.c index d9c85d2..5109258 100644 --- a/base/gdevsclass.c +++ b/base/gdevsclass.c @@ -797,7 +797,10 @@ int default_subclass_put_image(gx_device *dev, gx_device *mdev, const byte **buf int alpha_plane_index, int tag_plane_index) { if (dev->child) - return dev_proc(dev->child, put_image)(dev->child, mdev, buffers, num_chan, x, y, width, height, row_stride, alpha_plane_index, tag_plane_index); + if (dev == mdev) + return dev_proc(dev->child, put_image)(dev->child, dev->child, buffers, num_chan, x, y, width, height, row_stride, alpha_plane_index, tag_plane_index); + else + return dev_proc(dev->child, put_image)(dev->child, mdev, buffers, num_chan, x, y, width, height, row_stride, alpha_plane_index, tag_plane_index); return 0; } -- 2.9.1 ++++++ ghostscript-9.26.tar.gz -> ghostscript-9.26a.tar.gz ++++++ /work/SRC/openSUSE:Factory/ghostscript/ghostscript-9.26.tar.gz /work/SRC/openSUSE:Factory/.ghostscript.new.28833/ghostscript-9.26a.tar.gz differ: char 5, line 1
