Debian Patches

Status for ghostscript/10.05.1~dfsg-1+deb13u2

Patch Description Author Forwarded Bugs Origin Last update
0001_CVE-2025-7462.patch Bug 708606: Catch a null file pointer closing pdfwrite.
In the event of an error opening a new output file.		 Chris Liddell <chris.liddell@artifex.com> no 2025-06-25
0002_pdfwrite-bounds-check-some-strings.patch pdfwrite - bounds check some strings
Bug #708517

This differs very slightly from the proposed patch in the bug report, I
had a quick scout through the C file and found another similar case.

Both fixed here.		 Piotr Kajda <petermasterperfect@gmail.com> yes debian upstream https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=6dab38fb211f15226c242ab7a83fa53e4b0ff781 2025-05-08
0003_pdfwrite-avoid-buffer-overrun.patch pdfwrite - avoid buffer overrun
Bug #708539 "Buffer overflow in pdf_write_cmap"

The proposed fix in the report solves the buffer overrun, but does not
tackle a number of other problems.

This commit checks the result of stream_puts() in
pdf_write_cid_system_info_to_stream() and correctly signals an error to
the caller if that fails.

In pdf_write_cid_system_info we replace a (rather small!) fixed size
buffer with a dynamically allocated one using the lengths of the strings
which pdf_write_cid_system_info_to_stream() will write, and a small
fixed overhead to deal with the keys and initial byte '/'.

Because 'buf' is used in the stream 's', if it is too small to hold all
the CIDSystemInfo then we would get an error which was simply discarded
previously.

We now should avoid the potential error by ensuring the buffer is large
enough for all the information, and if we do get an error we no longer
silently ignore it, which would write an invalid PDF file.		 Ken Sharp <Ken.Sharp@artifex.com> yes debian upstream https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=0cae41b23a9669e801211dd4cf97b6dadd6dbdd7 2025-05-22
0004_OpenJPEG-Fix-overreading-bytes-in-some-conditions.patch OpenJPEG - Fix overreading bytes in some conditions.
Bug #709666 "Heap buffer overflow in the JPEG 2000 (JPXDecode) output adapter via component subsampling mismatch (base/sjpx_openjpeg.c)"

If we have more than one component, and the components are not the
same scale factor, and the number of bits is less than 8, then we would
run round a loop reading 'state->width' samples of data to the output.

The problem, of course, is that if the BPS is less than 8, we don't
want to read that many bytes, just that many samples.

Fixed here by incrementing the sample count in the inner loop, so that
we correctly count the number of samples.

For completeness, also check the number of samples in side the inner
loop so that we don't overread. We do need to run round the loop as
many times as there are samples in a byte, because that pushes the
data read so far to the left so that any unread data is at the right of
the byte.

This exposed an interesting bug in a regression file. It hits the
same scale loop, but has bps equal to 10. This resulted in us reading
no data in the old code, but in the new code reading way too much.

Added a guard in decode_image to error out on images which have BPS
which we don't support.

The original issue was reported by Alex Thomas <alext@wordfence.com>
of Wordfence Argus (AI).		 Ken Sharp <Ken.Sharp@artifex.com> yes upstream https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=0a8bf88e39db07b0751a58d6ec1cf992073e4dc1 2026-08-24
0005_PS-interpreter-validate-operands-to-.putgstringcopy.patch PS interpreter - validate operands to .putgstringcopy
Bug #709684 "Type 1 font-loader `.forceput` save/restore UAF yields native read/write and controlled dispatch/RCE under `-dSAFER`"

Effectively another case of recovering .forceput, in this case by
causing an error and then having the error handler use it.

We are in the process of eliminating, or at least absolutely minimising,
the use of .forceput. Ideally we want to remove it completely precisely
to avoid this sort of thing. Unfortunately that's still a work in
progress; it isn't easy to undo 30 years worth of assumptions in the
code.

For now this prevents the problem by ensuring that the operands are the
correct types, which prevents the error executing 'copy' and so avoids
the custom error handler managing to execute .forceput.

This issue was reported by Paulos Yibelo <habte.yibelo@gmail.com>		 Ken Sharp <Ken.Sharp@artifex.com> yes upstream https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=1484854e0c8ddfda1baa4ad4cd965b8a9790aa81 2026-09-02
1004_enable_spot_devices.patch enable DeviceN-related device xcfcmyk Jonas Smedegaard <dr@jones.dk> no 2021-07-18
1005_simplify_ps2ascii.patch Simplify ps2ascii наб <nabijaczleweli@nabijaczleweli.xyz> no 2024-03-03
2001_docdir_fix_for_debian.patch Set docdir appropriately for Debian Masayuki Hatta <mhatta@debian.org> not-needed 2023-09-13
2002_gs_man_fix_debian.patch Fixes for gs.1 (Debian specific path adjustments) Masayuki Hatta <mhatta@debian.org> not-needed 2023-09-13
2003_support_multiarch.patch Check multiarch paths Jonas Smedegaard <dr@jones.dk> not-needed 2023-09-13
2004_remove_non-Debian_paths_from_docs.patch Remove non-Debian paths from documentation Bastien ROUCARIÈS <roucaries.bastien@gmail.com> not-needed 2023-09-13
2005_fix_Debian_paths_in_docs.patch Fix Debian paths in documentation Bastien ROUCARIÈS <roucaries.bastien@gmail.com> not-needed 2023-09-13
2006_suggest_install_ghostscript-doc_in_docs.patch Suggest install of ghostscript-doc in documentation Bastien ROUCARIÈS <roucaries.bastien@gmail.com> not-needed 2023-09-13
2007_suggest_install_ghostscript-doc_in_code.patch Suggest install of ghostscript-doc in code Bastien ROUCARIÈS <roucaries.bastien@gmail.com> not-needed 2023-09-13
2008_mention_ghostscript-x_in_docs.patch Mention ghostscipt-x affect on default device in docs Bastien ROUCARIÈS <roucaries.bastien@gmail.com> not-needed 2023-09-13
2010_add_build_timestamp_setting.patch Allow the build timestamp to be externally set In order to make Ghostscript output reproducible, we need a way to
set the build timestamp to other values than the current time.
We now consistently use gp_get_realtime() instead of directly calling
time() or gp_get_usertime() and make gp_get_realtime() use the value
found in the SOURCE_DATE_EPOCH environment variable if set. Also,
environment timezone is fixed to UTC if SOURCE_DATE_EPOCH is used to
avoid variations.		 Peter De Wachter <pdewacht@gmail.com> not-needed debian 2023-09-13
2011_disable_google_analytics.patch Disable google analytics in HTML docs

diff --git a/doc/src/conf.py b/doc/src/conf.py
index d1709126..98c61aea 100644		 Steve Robbins <srm@debian.org> not-needed 2025-03-16

All known versions for source package 'ghostscript'

Links