Re: Attempting to patch ghostscript-9.25

[Ken Moffat <zarniwhoop () ntlworld com>]

On Sat, Oct 20, 2018 at 11:42:20AM +0000, Jordan Glover wrote:
> ‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐
> On Saturday, October 20, 2018 3:47 AM, Ken Moffat <zarniwhoop () ntlworld com> wrote:
>
> > The patch is a bit big, so I've uploaded it to
> > http://www.linuxfromscratch.org/~ken/provisional/ as
> > ghostscript-9.25-security_fixes-2.patch
> >
> > 'provisional' until I find out if it protects adequately. If there
> > turn out ot be problems, I suppose I'll need to renumber later
> > versions.
I've now been given an exploit, in a PDF (I was not subscribed here
until Friday, missed some of the earleir stuff).  That -2 patch fixes
it.

Tested with evince (which now loops trying to rended an empty page,
same as with the .ps exploit), so I've committed it in BLFS.  Will
take down the 'provisional' copy in a few days.

> I think the easiest way is to build on upstream git snapshot.
> All of its contents will be included in future release anyway.
>
> Jordan

If upstream are like anywhere else, some changes get backed out or
modified so they might not be there when 9.26 is released.  OTOH,
one of the changes I ignored might stop evince looping on a
'damaged' PDF.  Swings and roundabouts.

ĸen
-- 
                        Is it about a bicycle ?