Pisilinux/main
5
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ghostscript:ver.bump

Browse Source
This commit is contained in:
Rmys
2019-10-08 19:11:24 +03:00
parent 9c6cc36570
commit 750f8ea5a3
3 changed files with 167 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
office/postscript/ghostscript/actions.py
+2 -2
View File
@@ -11,7 +11,7 @@ from pisi.actionsapi import get
def setup(): def setup():
# Remove local copies for system libs # Remove local copies for system libs
for directory in ["cups/libs", "jpeg", "lcms2", "libpng", "openjpeg", "tiff", "zlib"]: for directory in ["cups/libs", "jpeg", "lcms2mt", "libpng", "openjpeg", "tiff", "zlib"]:
shelltools.unlinkDir(directory) shelltools.unlinkDir(directory)
#pisitools.flags.add("-fno-strict-aliasing") #pisitools.flags.add("-fno-strict-aliasing")
@@ -56,4 +56,4 @@ def install():
if not get.buildTYPE() == "emul32": autotools.rawInstall("-C ijs DESTDIR=%s" % get.installDIR()) if not get.buildTYPE() == "emul32": autotools.rawInstall("-C ijs DESTDIR=%s" % get.installDIR())
pisitools.dohtml("doc/*") pisitools.dohtml("doc/*")
pisitools.dodoc("doc/AUTHORS", "doc/COPYING") pisitools.dodoc("LICENSE", "doc/COPYING")
office/postscript/ghostscript/files/fedora/ghostscript-9.27-upstream_fixes-1.patch
+155
View File
@@ -0,0 +1,155 @@
Submitted By: Ken Moffat <ken at linuxfromscratch dot org>
Date: 2019-08-14
Initial Package Version: 9.27
Upstream Status: Applied
Origin: Cherry-picked by debian security.
Description: Fixes CVE-2019-10216
The .buildfont1 procedure in Ghostscript does not properly restrict
privileged calls, which could result in bypass of file system
restrictions of the dSAFER sandbox.
Debian patches 020190410~06c9207.patch and 020190802~5b85ddd.patch.
Description: Fix regression resolving bounding box of font glyphs
Re-introduce over/underflow workaround
.
Commit 355434f4b1bbe8c4f98cafad5a6868aa2f0eaae1 reverted a workaround
that compensated for over/underflow in Freetype's TTF hinting
(related to freedom and projection vector calculations).
That problem no longer exists in recent Freetype releases,
and the workaround actually caused other issues to occur with hinting.
.
What wasn't obvious was
that the workaround also protected over/underflow issues
relating to the unitsPerEm value.
.
So this re-instates the workaround,
but bases the decision on how the final scale is distributing
between the Freetype "size" and the Freetype matrix
on the unitsPerEm value
(this is relevant for all font types
as for non-TTF font types
Freetype derives the unitsPerEm from the FontMatrix for PS type fonts).
Origin: upstream, http://git.ghostscript.com/?p=ghostpdl.git;h=06c9207
Author: Chris Liddell <chris.liddell@artifex.com>
Forwarded: yes
Bug: http://bugs.ghostscript.com/show_bug.cgi?id=700952
Bug: http://bugs.ghostscript.com/show_bug.cgi?id=700875
Bug-Debian: https://bugs.debian.org/927429
Last-Update: 2019-04-20
---
This patch header follows DEP-3: http://dep.debian.net/deps/dep3/
--- a/base/fapi_ft.c
+++ b/base/fapi_ft.c
@@ -974,13 +974,19 @@
*/
static void
transform_decompose(FT_Matrix * a_transform, FT_UInt * xresp, FT_UInt * yresp,
- FT_Fixed * a_x_scale, FT_Fixed * a_y_scale)
+ FT_Fixed * a_x_scale, FT_Fixed * a_y_scale, int units_per_EM)
{
double scalex, scaley, fact = 1.0;
double factx = 1.0, facty = 1.0;
FT_Matrix ftscale_mat;
FT_UInt xres;
FT_UInt yres;
+ /* We have to account for units_per_EM as we fiddle with the scaling
+ * in order to avoid underflow (mostly in the TTF hinting code), but
+ * we also want to clamp to a lower value (512, admittedly arrived at
+ * via experimentation) in order to preserve the fidelity of the outlines.
+ */
+ double upe = units_per_EM > 512 ? (float)units_per_EM : 512.0;
scalex = hypot((double)a_transform->xx, (double)a_transform->xy);
scaley = hypot((double)a_transform->yx, (double)a_transform->yy);
@@ -1067,10 +1073,25 @@
scalex *= fact;
}
- ftscale_mat.xx = (FT_Fixed) (65536.0 / scalex);
- ftscale_mat.xy = (FT_Fixed) 0;
- ftscale_mat.yx = (FT_Fixed) 0;
- ftscale_mat.yy = (FT_Fixed) (65536.0 / scaley);
+ /* see above */
+ fact = 1.0;
+ while (scaley * yres > (double)upe * 72.0 && (xres > 0 && yres > 0)
+ && (scalex > 0.0 && scaley > 0.0)) {
+ if (scaley < yres) {
+ xres >>= 1;
+ yres >>= 1;
+ fact *= 2.0;
+ }
+ else {
+ scalex /= 1.25;
+ scaley /= 1.25;
+ }
+ }
+
+ ftscale_mat.xx = (FT_Fixed) ((65536.0 / scalex) * fact);
+ ftscale_mat.xy = 0;
+ ftscale_mat.yx = 0;
+ ftscale_mat.yy = (FT_Fixed) ((65536.0 / scaley) * fact);
FT_Matrix_Multiply(a_transform, &ftscale_mat);
memcpy(a_transform, &ftscale_mat, sizeof(FT_Matrix));
@@ -1315,7 +1336,7 @@
* transform.
*/
transform_decompose(&face->ft_transform, &face->horz_res,
- &face->vert_res, &face->width, &face->height);
+ &face->vert_res, &face->width, &face->height, face->ft_face->units_per_EM);
ft_error = FT_Set_Char_Size(face->ft_face, face->width, face->height,
face->horz_res, face->vert_res);
From: Chris Liddell <chris.liddell@artifex.com>
Date: Fri, 2 Aug 2019 15:18:26 +0100
Subject: Bug 701394: protect use of .forceput with executeonly
Origin: http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=5b85ddd19a8420a1bd2d5529325be35d78e94234
Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2019-10216
Bug: https://bugs.ghostscript.com/show_bug.cgi?id=701394
---
Resource/Init/gs_type1.ps | 14 +++++++-------
1 file changed, 7 insertions(+), 7 deletions(-)
diff --git a/Resource/Init/gs_type1.ps b/Resource/Init/gs_type1.ps
index 6c7735bc0cc3..a039ccee3590 100644
--- a/Resource/Init/gs_type1.ps
+++ b/Resource/Init/gs_type1.ps
@@ -118,25 +118,25 @@
( to be the same as glyph: ) print 1 index //== exec } if
3 index exch 3 index .forceput
% scratch(string) RAGL(dict) AGL(dict) CharStrings(dict) cstring gname
- }
+ }executeonly
{pop} ifelse
- } forall
+ } executeonly forall
pop pop
- }
+ } executeonly
{
pop pop pop
} ifelse
- }
+ } executeonly
{
% scratch(string) RAGL(dict) AGL(dict) CharStrings(dict) cstring gname
pop pop
} ifelse
- } forall
+ } executeonly forall
3 1 roll pop pop
- } if
+ } executeonly if
pop
dup /.AGLprocessed~GS //true .forceput
- } if
+ } executeonly if
%% We need to excute the C .buildfont1 in a stopped context so that, if there
%% are errors we can put the stack back sanely and exit. Otherwise callers won't
--
2.20.1
office/postscript/ghostscript/pspec.xml
+10 -3
View File
@@ -12,7 +12,7 @@
<IsA>library</IsA> <IsA>library</IsA>
<Summary>A PostScript interpreter and renderer</Summary> <Summary>A PostScript interpreter and renderer</Summary>
<Description>ghostscript is a set of software that provides a PostScript interpreter, a set of C procedures and an interpreter for PDF files. ghostscript is normally used to display PostScript files and to print PostScript files to non-PostScript printers.</Description> <Description>ghostscript is a set of software that provides a PostScript interpreter, a set of C procedures and an interpreter for PDF files. ghostscript is normally used to display PostScript files and to print PostScript files to non-PostScript printers.</Description>
<Archive sha1sum="9dcd527e9bcc636a6a947251a6195f58dd00006b" type="tarxz">https://github.com/ArtifexSoftware/ghostpdl-downloads/releases/download/gs922/ghostscript-9.22.tar.xz</Archive> <Archive sha1sum="f926d2cfb418a7c5d92dce0a9843fa01ee62fe2c" type="tarxz">https://github.com/ArtifexSoftware/ghostpdl-downloads/releases/download/gs927/ghostscript-9.27.tar.xz</Archive>
<BuildDependencies> <BuildDependencies>
<Dependency>cups-devel</Dependency> <Dependency>cups-devel</Dependency>
<Dependency>tiff-devel</Dependency> <Dependency>tiff-devel</Dependency>
@@ -46,8 +46,7 @@
<!-- <Patch level="1">fedora/ghostscript-9.20-handle-glyphdirectory-correctly.patch</Patch> --> <!-- <Patch level="1">fedora/ghostscript-9.20-handle-glyphdirectory-correctly.patch</Patch> -->
<!-- <Patch level="1">fedora/ghostscript-9.20-remove-and-reimplement-ConvertUTF.patch</Patch> --> <!-- <Patch level="1">fedora/ghostscript-9.20-remove-and-reimplement-ConvertUTF.patch</Patch> -->
<Patch level="1">fedora/ghostscript-9.20-run-dvipdf-securely.patch</Patch> <Patch level="1">fedora/ghostscript-9.20-run-dvipdf-securely.patch</Patch>
<Patch level="1">fedora/ghostscript-9.20-runlibfileifexists.patch</Patch> <Patch level="1">fedora/ghostscript-9.27-upstream_fixes-1.patch</Patch>
<!-- <Patch level="1">fedora/ghostscript-9.20-urw-fonts-naming.patch</Patch> -->
</Patches> </Patches>
</Source> </Source>
@@ -91,6 +90,7 @@
<Name>ghostscript-docs</Name> <Name>ghostscript-docs</Name>
<Summary>Documentation for ghostscript</Summary> <Summary>Documentation for ghostscript</Summary>
<Files> <Files>
<Path fileType="doc">/usr/share/doc/ghostscript/9.27</Path>
<Path fileType="doc">/usr/share/doc/ghostscript/html</Path> <Path fileType="doc">/usr/share/doc/ghostscript/html</Path>
<Path fileType="doc">/usr/share/doc/ghostscript/examples</Path> <Path fileType="doc">/usr/share/doc/ghostscript/examples</Path>
</Files> </Files>
@@ -149,6 +149,13 @@
</Package> </Package>
<History> <History>
<Update release="8">
<Date>2019-10-07</Date>
<Version>9.27</Version>
<Comment>Version bump.</Comment>
<Name>Mustafa Cinasal</Name>
<Email>muscnsl@gmail.com</Email>
</Update>
<Update release="7"> <Update release="7">
<Date>2019-01-09</Date> <Date>2019-01-09</Date>
<Version>9.22</Version> <Version>9.22</Version>