01/01: gnu: ghostscript: Add fix for CVE-2015-3228.

[Mark H. Weaver]

mhw pushed a commit to branch ghostscript-update
in repository guix.

commit add49e6eec36f6bd7103e4ca64fe477a6e97f7c7
Author: Mark H Weaver <address@hidden>
Date:   Sat Jul 25 23:48:54 2015 -0400

    gnu: ghostscript: Add fix for CVE-2015-3228.
    
    * gnu/packages/patches/ghostscript-CVE-2015-3228.patch: New file.
    * gnu-system.am (dist_patch_DATA): Add it.
    * gnu/packages/ghostscript.scm (ghostscript)[source]: Add patch.
---
 gnu-system.am                                      |    1 +
 gnu/packages/ghostscript.scm                       |    5 ++-
 .../patches/ghostscript-CVE-2015-3228.patch        |   32 ++++++++++++++++++++
 3 files changed, 36 insertions(+), 2 deletions(-)

diff --git a/gnu-system.am b/gnu-system.am
index d6635fe..8241b4e 100644
--- a/gnu-system.am
+++ b/gnu-system.am
@@ -443,6 +443,7 @@ dist_patch_DATA =                                           
\
   gnu/packages/patches/gcc-libvtv-runpath.patch                        \
   gnu/packages/patches/gcc-5.0-libvtv-runpath.patch            \
   gnu/packages/patches/geoclue-config.patch                    \
+  gnu/packages/patches/ghostscript-CVE-2015-3228.patch         \
   gnu/packages/patches/ghostscript-runpath.patch               \
   gnu/packages/patches/gitolite-openssh-6.8-compat.patch       \
   gnu/packages/patches/glib-tests-desktop.patch                        \
diff --git a/gnu/packages/ghostscript.scm b/gnu/packages/ghostscript.scm
index 09306e9..bd57889 100644
--- a/gnu/packages/ghostscript.scm
+++ b/gnu/packages/ghostscript.scm
@@ -1,6 +1,6 @@
 ;;; GNU Guix --- Functional package management for GNU
 ;;; Copyright © 2013 Andreas Enge <address@hidden>
-;;; Copyright © 2014 Mark H Weaver <address@hidden>
+;;; Copyright © 2014, 2015 Mark H Weaver <address@hidden>
 ;;; Copyright © 2015 Ricardo Wurmus <address@hidden>
 ;;; Copyright © 2015 Ludovic Courtès <address@hidden>
 ;;;
@@ -129,7 +129,8 @@ printing, and psresize, for adjusting page sizes.")
             (sha256
              (base32
               "0q4jj41p0qbr4mgcc9q78f5zs8cm1g57wgryhsm2yq4lfslm3ib1"))
-            (patches (list (search-patch "ghostscript-runpath.patch")))
+            (patches (map search-patch '("ghostscript-CVE-2015-3228.patch"
+                                         "ghostscript-runpath.patch")))
             (modules '((guix build utils)))
             (snippet
              ;; Honor --docdir.
diff --git a/gnu/packages/patches/ghostscript-CVE-2015-3228.patch 
b/gnu/packages/patches/ghostscript-CVE-2015-3228.patch
new file mode 100644
index 0000000..c19fdb1
--- /dev/null
+++ b/gnu/packages/patches/ghostscript-CVE-2015-3228.patch
@@ -0,0 +1,32 @@
+The file names in the upstream patch below were modified to apply to GNU
+ghostscript.
+
+From 0c0b0859ae1aba64861599f0e7f74f143f305932 Mon Sep 17 00:00:00 2001
+From: Chris Liddell <address@hidden>
+Date: Tue, 7 Jul 2015 16:57:41 +0100
+Subject: [PATCH] Bug 696041: sanity check for memory allocation.
+
+In gs_heap_alloc_bytes(), add a sanity check to ensure we don't overflow the
+variable holding the actual number of bytes we allocate.
+
+No cluster differences
+---
+ gs/base/gsmalloc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/base/gsmalloc.c b/base/gsmalloc.c
+index 624552d..cad79c2 100644
+--- a/base/gsmalloc.c
++++ b/base/gsmalloc.c
+@@ -178,7 +178,7 @@ gs_heap_alloc_bytes(gs_memory_t * mem, uint size, 
client_name_t cname)
+     } else {
+         uint added = size + sizeof(gs_malloc_block_t);
+ 
+-        if (mmem->limit - added < mmem->used)
++        if (added <= size || mmem->limit - added < mmem->used)
+             set_msg("exceeded limit");
+         else if ((ptr = (byte *) Memento_label(malloc(added), cname)) == 0)
+             set_msg("failed");
+-- 
+2.4.6
+