Patches for CVE-2016-10217, CVE-2016-10219, CVE-2016-10220 & CVE-2017-5951

6 files changed, 92 insertions, 3 deletions

diff --git a/print/ghostscript-gpl/Makefile b/print/ghostscript-gpl/Makefile
index fca57039b35..7daba7a256a 100644
--- a/print/ghostscript-gpl/Makefile
+++ b/print/ghostscript-gpl/Makefile
@@ -1,8 +1,8 @@
-# $NetBSD: Makefile,v 1.24 2017/04/05 20:11:01 tez Exp $
+# $NetBSD: Makefile,v 1.25 2017/04/18 22:07:06 tez Exp $
 
 DISTNAME=	ghostscript-${GS_VERSION}
 PKGNAME=	${DISTNAME:S/ghostscript/ghostscript-gpl/}
-PKGREVISION=	11
+PKGREVISION=	12
 CATEGORIES=	print
 MASTER_SITES=	${MASTER_SITE_SOURCEFORGE:=ghostscript/}
 MASTER_SITES+=	http://ghostscript.com/releases/
diff --git a/print/ghostscript-gpl/distinfo b/print/ghostscript-gpl/distinfo
index 96025c9b55c..a22ecc11318 100644
--- a/print/ghostscript-gpl/distinfo
+++ b/print/ghostscript-gpl/distinfo
@@ -1,4 +1,4 @@
-$NetBSD: distinfo,v 1.16 2017/04/11 10:31:14 jperkin Exp $
+$NetBSD: distinfo,v 1.17 2017/04/18 22:07:06 tez Exp $
 
 SHA1 (ghostscript-9.06.tar.bz2) = 4c1c2b4cddd16d86b21f36ad4fc15f6100162238
 RMD160 (ghostscript-9.06.tar.bz2) = 11ef74cf783ec5f7cde0ceaaf2823a1f62fb4d1d
@@ -10,6 +10,10 @@ SHA1 (patch-CVE-2014-8138) = be161051680e3c6c9246f31237019470a447ee49
 SHA1 (patch-CVE-2014-8157) = 18822069b9791fc3553e812878cfca483d881cd4
 SHA1 (patch-CVE-2014-8158) = 71387f152a205caaef0fcc518dbb0fbb7b78e531
 SHA1 (patch-CVE-2014-9029) = 9636c7d6909fc0dec7ad2102b59fb14d599bac6a
+SHA1 (patch-CVE-2016-10217) = 85f2cb708bb38a88215573e63821be8a54bc019e
+SHA1 (patch-CVE-2016-10219) = 24ef41da0579840360110cc5c1f79622210f8e6b
+SHA1 (patch-CVE-2016-10220) = 6edfa87948ff0f9412a5509efb98bf2d063a5951
+SHA1 (patch-CVE-2017-5951) = a4af8e561b9f5a6a330fbc2f915257bf5ba3cb2a
 SHA1 (patch-CVE-2017-6196) = 311d9236dd5abcd48ae0f412bf481e105b6207dc
 SHA1 (patch-CVE-2017-7207) = 31f4a73b49b52942385eaa3c8cf2a94b5bbde6df
 SHA1 (patch-af) = a556b774993c72481284e0d0cce222c61be4ea94
diff --git a/print/ghostscript-gpl/patches/patch-CVE-2016-10217 b/print/ghostscript-gpl/patches/patch-CVE-2016-10217
new file mode 100644
index 00000000000..1ed2a46003a
--- /dev/null
+++ b/print/ghostscript-gpl/patches/patch-CVE-2016-10217
@@ -0,0 +1,19 @@
+$NetBSD: patch-CVE-2016-10217,v 1.1 2017/04/18 22:07:07 tez Exp $
+
+Patch for CVE-2016-10217 from
+http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=90fd0c7ca3efc1ddff64a86f4104b13b3ac969eb;hp=d621292fb2c8157d9899dcd83fd04dd250e30fe4
+Patch for CVE-2016-10218 from
+http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=d621292fb2c8157d9899dcd83fd04dd250e30fe4;hp=4bef1a1d32e29b68855616020dbff574b9cda08f
+(actually no patch, the null check was already in place!)
+
+
+--- base/gdevp14.c.orig	2017-04-05 20:36:47.701597100 +0000
++++ base/gdevp14.c
+@@ -1369,6 +1369,7 @@ pdf14_open(gx_device *dev)
+     rect.p.y = 0;
+     rect.q.x = dev->width;
+     rect.q.y = dev->height;
++    if (pdev->ctx == NULL)
+     pdev->ctx = pdf14_ctx_new(&rect, dev->color_info.num_components,
+         pdev->color_info.polarity != GX_CINFO_POLARITY_SUBTRACTIVE, dev);
+     if (pdev->ctx == NULL)
diff --git a/print/ghostscript-gpl/patches/patch-CVE-2016-10219 b/print/ghostscript-gpl/patches/patch-CVE-2016-10219
new file mode 100644
index 00000000000..8a48247a4f1
--- /dev/null
+++ b/print/ghostscript-gpl/patches/patch-CVE-2016-10219
@@ -0,0 +1,26 @@
+$NetBSD: patch-CVE-2016-10219,v 1.1 2017/04/18 22:07:07 tez Exp $
+
+Patch for CVE-2016-10219 from
+http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=4bef1a1d32e29b68855616020dbff574b9cda08f;hp=0aeb0bbd41cc16e70ab6e4b1d56e0c510bf2a758
+
+
+--- base/gxfill.c.orig	2017-04-05 20:56:07.869067200 +0000
++++ base/gxfill.c
+@@ -1743,7 +1743,7 @@ intersect(active_line *endp, active_line
+     fixed dx_old = alp->x_current - endp->x_current;
+     fixed dx_den = dx_old + endp->x_next - alp->x_next;
+ 
+-    if (dx_den <= dx_old)
++    if (dx_den <= dx_old || dx_den == 0)
+         return false; /* Intersection isn't possible. */
+     dy = y1 - y;
+     if_debug3('F', "[F]cross: dy=%g, dx_old=%g, dx_new=%g\n",
+@@ -1752,7 +1752,7 @@ intersect(active_line *endp, active_line
+     /* Do the computation in single precision */
+     /* if the values are small enough. */
+     y_new =
+-        ((dy | dx_old) < 1L << (size_of(fixed) * 4 - 1) ?
++        (((ufixed)(dy | dx_old)) < (1L << (size_of(fixed) * 4 - 1)) ?
+          dy * dx_old / dx_den :
+          (INCR_EXPR(mq_cross), fixed_mult_quo(dy, dx_old, dx_den)))
+         + y;
diff --git a/print/ghostscript-gpl/patches/patch-CVE-2016-10220 b/print/ghostscript-gpl/patches/patch-CVE-2016-10220
new file mode 100644
index 00000000000..a9edf9df5a3
--- /dev/null
+++ b/print/ghostscript-gpl/patches/patch-CVE-2016-10220
@@ -0,0 +1,16 @@
+$NetBSD: patch-CVE-2016-10220,v 1.1 2017/04/18 22:07:07 tez Exp $
+
+Fix for CVE-2016-10220 from
+http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=daf85701dab05f17e924a48a81edc9195b4a04e8;hp=2299c9a25fc9ae7b59752f1795f8b53920901c80
+
+
+--- base/gsdevmem.c.orig	2017-04-05 21:01:59.873181700 +0000
++++ base/gsdevmem.c
+@@ -223,6 +223,7 @@ gs_makewordimagedevice(gx_device ** pnew
+ 
+     if (pnew == 0)
+         return_error(gs_error_VMerror);
++    memset(pnew, 0x00, st_device_memory.ssize);
+     code = gs_initialize_wordimagedevice(pnew, pmat, width, height,
+                                          colors, num_colors, word_oriented,
+                                          page_device, mem);
diff --git a/print/ghostscript-gpl/patches/patch-CVE-2017-5951 b/print/ghostscript-gpl/patches/patch-CVE-2017-5951
new file mode 100644
index 00000000000..6a2a2a18850
--- /dev/null
+++ b/print/ghostscript-gpl/patches/patch-CVE-2017-5951
@@ -0,0 +1,24 @@
+$NetBSD: patch-CVE-2017-5951,v 1.1 2017/04/18 22:07:07 tez Exp $
+
+Patch for CVE-2017-5951 from
+ http://git.ghostscript.com/?p=user/chrisl/ghostpdl.git;a=commitdiff;h=bfa6b2ec
+
+--- psi/iparam.c.orig	2017-04-06 19:05:43.573183800 +0000
++++ psi/iparam.c
+@@ -770,12 +770,13 @@ ref_param_read_typed(gs_param_list * pli
+                 gs_param_enumerator_t enumr;
+                 gs_param_key_t key;
+                 ref_type keytype;
++		dict_param_list *dlist = (dict_param_list *) pvalue->value.d.list;
+ 
+                 param_init_enumerator(&enumr);
+-                if (!(*((iparam_list *) plist)->enumerate)
+-                    ((iparam_list *) pvalue->value.d.list, &enumr, &key, &keytype)
++		if (!(*(dlist->enumerate))
++		    ((iparam_list *) dlist, &enumr, &key, &keytype)
+                     && keytype == t_integer) {
+-                    ((dict_param_list *) pvalue->value.d.list)->int_keys = 1;
++                    dlist->int_keys = 1;
+                     pvalue->type = gs_param_type_dict_int_keys;
+                 }
+             }