Re: ghostscript: 1Policy operator gives access to .forceput CVE-2018-18284

[Bob Friesenhahn <bfriesen () simple dallas tx us>]

On Wed, 17 Oct 2018, Rich Felker wrote:
> > Even with the easy to exploit stuff compiled out (which upstream do not
> > support), I haven't been bothering to get CVE's for all the memory
> > corruption or UaF I've been reporting, because nobody can keep up with
> > these operator leaks anyway.
>
> An obvious fix for UaF's would be just removing the frees. Use of gs
> as an interactive program where leaks would matter is a historical
> curiosity; the only meaningful modern use is as a converter.

Memory allocations would build to extremely large values across 
hundreds of rendered pages.  Use of Ghostscript in interactive 
programs is still surely common.  Programs using libgs will inherit 
any leaks.  These leaks and other issues should be fixed.

Keep in mind that Ghostscript is also used to render/view PDF files. 
When interactively viewing it is common to do just-in-time rendering. 
Even for bulk conversions, conversion on a page-by-page basis will 
save resources when dealing with many pages.

Alternatives do exist now for PDF due to Xpdf and the derived Poppler 
project and Poppler has become heavily used.

Ghostscript is still more competent at rendering PDF than Poppler is. 
Ghostscript is able to deal with CMYK color spaces, per-object 
colorspaces, and transparency, and it is able to render to various 
quality levels (bilevel, grayscale, RGB, RGBA, CMYK) depending on the 
output driver selected.

Bob
--
Bob Friesenhahn
bfriesen () simple dallas tx us, http://www.simplesystems.org/users/bfriesen/
GraphicsMagick Maintainer,    http://www.GraphicsMagick.org/