From 6643ff0cb837db3eade489ffff21e3e92eee2ae0 Mon Sep 17 00:00:00 2001 From: Chris Liddell Date: Fri, 28 Jan 2022 08:21:19 +0000 Subject: [PATCH] [PATCH] Bug 703902: Fix op stack management in sampled_data_continue() Replace pop() (which does no checking, and doesn't handle stack extension blocks) with ref_stack_pop() which does do all that. We still use pop() in one case (it's faster), but we have to later use ref_stack_pop() before calling sampled_data_sample() which also accesses the op stack. Fixes: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34675 Upstream-Status: Backported [https://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=2a3129365d3bc0d4a41f107ef175920d1505d1f7] CVE: CVE-2021-45949 Signed-off-by: Minjae Kim --- psi/zfsample.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/psi/zfsample.c b/psi/zfsample.c index 0023fa4..f84671f 100644 --- a/psi/zfsample.c +++ b/psi/zfsample.c @@ -534,14 +534,17 @@ sampled_data_continue(i_ctx_t *i_ctx_p) data_ptr[bps * i + j] = (byte)(cv >> ((bps - 1 - j) * 8)); /* MSB first */ } pop(num_out); /* Move op to base of result values */ - + /* From here on, we have to use ref_stack_pop() rather than pop() + so that it handles stack extension blocks properly, before calling + sampled_data_sample() which also uses the op stack. + */ /* Check if we are done collecting data. */ if (increment_cube_indexes(params, penum->indexes)) { if (stack_depth_adjust == 0) - pop(O_STACK_PAD); /* Remove spare stack space */ + ref_stack_pop(&o_stack, O_STACK_PAD); /* Remove spare stack space */ else - pop(stack_depth_adjust - num_out); + ref_stack_pop(&o_stack, stack_depth_adjust - num_out); /* Execute the closing procedure, if given */ code = 0; if (esp_finish_proc != 0) @@ -554,11 +557,11 @@ sampled_data_continue(i_ctx_t *i_ctx_p) if ((O_STACK_PAD - stack_depth_adjust) < 0) { stack_depth_adjust = -(O_STACK_PAD - stack_depth_adjust); check_op(stack_depth_adjust); - pop(stack_depth_adjust); + ref_stack_pop(&o_stack, stack_depth_adjust); } else { check_ostack(O_STACK_PAD - stack_depth_adjust); - push(O_STACK_PAD - stack_depth_adjust); + ref_stack_push(&o_stack, O_STACK_PAD - stack_depth_adjust); for (i=0;i