diff options
author | Ken Sharp <Ken.Sharp@artifex.com> | 2024-03-21 09:01:15 +0000 |
---|---|---|
committer | Chris Liddell <chris.liddell@artifex.com> | 2024-05-02 10:36:05 +0100 |
commit | 3b1735085ecef20b29e8db3416ab36de93e86d1f (patch) | |
tree | fa819d91e4fee0af929cf0ef9f9a920ed68771af | |
parent | c13ce92911ef59f89e6f29c15d0385b614979502 (diff) |
Uniprint device - prevent string configuration changes when SAFER
Bug #707662
We cannot sanitise the string arguments used by the Uniprint device
because they can potentially include anything.
This commit ensures that these strings are locked and cannot be
changed by PostScript once SAFER is activated. Full configuration from
the command line is still possible (see the *.upp files in lib).
This addresses CVE-2024-29510
-rw-r--r-- | devices/gdevupd.c | 31 |
1 files changed, 31 insertions, 0 deletions
diff --git a/devices/gdevupd.c b/devices/gdevupd.c index c9389e7bc..016a9260a 100644 --- a/devices/gdevupd.c +++ b/devices/gdevupd.c @@ -1891,6 +1891,16 @@ out on this copies. if(!upd_strings[i]) continue; UPD_PARAM_READ(param_read_string,upd_strings[i],value,udev->memory); if(0 == code) { + if (gs_is_path_control_active(udev->memory)) { + if (strings[i].size != value.size) + error = gs_error_invalidaccess; + else { + if (strings[i].data && memcmp(strings[i].data, value.data, strings[i].size) != 0) + error = gs_error_invalidaccess; + } + if (error < 0) + goto exit; + } if(0 <= error) error |= UPD_PUT_STRINGS; UPD_MM_DEL_PARAM(udev->memory, strings[i]); if(!value.size) { @@ -1908,6 +1918,26 @@ out on this copies. if(!upd_string_a[i]) continue; UPD_PARAM_READ(param_read_string_array,upd_string_a[i],value,udev->memory); if(0 == code) { + if (gs_is_path_control_active(udev->memory)) { + if (string_a[i].size != value.size) + error = gs_error_invalidaccess; + else { + int loop; + for (loop = 0;loop < string_a[i].size;loop++) { + gs_param_string *tmp1 = (gs_param_string *)&(string_a[i].data[loop]); + gs_param_string *tmp2 = (gs_param_string *)&value.data[loop]; + + if (tmp1->size != tmp2->size) + error = gs_error_invalidaccess; + else { + if (tmp1->data && memcmp(tmp1->data, tmp2->data, tmp1->size) != 0) + error = gs_error_invalidaccess; + } + } + } + if (error < 0) + goto exit; + } if(0 <= error) error |= UPD_PUT_STRING_A; UPD_MM_DEL_APARAM(udev->memory, string_a[i]); if(!value.size) { @@ -2102,6 +2132,7 @@ transferred into the device-structure. In the case of "uniprint", this may if(0 > code) error = code; } +exit: if(0 < error) { /* Actually something loaded without error */ if(!(upd = udev->upd)) { |