August 2018 - CRUX - lists.crux.nu

Poppler update breaks texlive
by Xavier 08 Jul '19

08 Jul '19

poppler update to 0.59.0 breaks texlive. I guess it's an upstream problem (see log extract in attachment). I had to revert to poppler 0.57.0

4 7

ports/opt (3.4): [notify] pango: updated to 1.42.4. Fix for CVE-2018-15120.
by crux＠crux.nu 30 Aug '18

30 Aug '18

commit d520e37a9e9e2a7a997f57131080e13bc1e138b8 Author: Fredrik Rinnestam <fredrik(a)crux.nu> Date: Thu Aug 30 17:31:21 2018 +0200 [notify] pango: updated to 1.42.4. Fix for CVE-2018-15120. diff --git a/pango/.signature b/pango/.signature index deed19272..cebc697cb 100644 --- a/pango/.signature +++ b/pango/.signature @@ -1,6 +1,6 @@ untrusted comment: verify with /etc/ports/opt.pub -RWSE3ohX2g5d/fkwm4bQIIFLAZnU6CpyVEGzqbTxIm+vKeNdgL74wXTuOBj2xA8gII0izcrg0DAJLja86DOV3SAnv007bsiRaAQ= -SHA256 (Pkgfile) = 22188e7555ad92d71201be624f6990085191aa6a1b52b9d7992932bee68307de +RWSE3ohX2g5d/TFxRR9eg+giQkpZqR6VsCLRd+frozaZ4ChSqLfaYbrCqB7QXAU/NKf5Or17UTIx8u5v/V8o7+4D+X2jrxTaaAw= +SHA256 (Pkgfile) = d20f9efd233d971ddf3117bc3cf0666ae4c2cfb62b238a3cb26a25632bab478d SHA256 (.footprint) = e8936d9538a9e07aeea641734cb3c984e12ec97962522de43fcdf6177827550f -SHA256 (pango-1.42.3.tar.xz) = fb3d875305d5143f02cde5c72fec3903e60dc35844759dc14b2df4955b5dde3a +SHA256 (pango-1.42.4.tar.xz) = 1d2b74cd63e8bd41961f2f8d952355aa0f9be6002b52c8aa7699d9f5da597c9d SHA256 (pango.modules) = 9cd325e4728900161c3066c1d8f329f8f9e35589acc3e34e378aedd86acbe2a4 diff --git a/pango/Pkgfile b/pango/Pkgfile index e80514202..8e1eed9c0 100644 --- a/pango/Pkgfile +++ b/pango/Pkgfile @@ -4,7 +4,7 @@ # Depends on: xorg-libsm, xorg-libxft, gobject-introspection fribidi name=pango -version=1.42.3 +version=1.42.4 release=1 source=(http://download.gnome.org/sources/$name/${version:0:4}/$name-$versi… \ pango.modules)

1 0

ports/opt (3.4): [notify] dropbear: fix for CVE-2018-15599
by crux＠crux.nu 30 Aug '18

30 Aug '18

commit af91638817af6b95420213dbacedd80e9b7c9659 Author: Juergen Daubert <jue(a)jue.li> Date: Thu Aug 30 11:13:01 2018 +0200 [notify] dropbear: fix for CVE-2018-15599 diff --git a/dropbear/.signature b/dropbear/.signature index 256a4e715..704c6c267 100644 --- a/dropbear/.signature +++ b/dropbear/.signature @@ -1,6 +1,7 @@ untrusted comment: verify with /etc/ports/opt.pub -RWSE3ohX2g5d/aM/VCJQcchPZByyjLXWkIpUr9BU9OPBVGaP40mqd6c7pefQUHp4QSyQeoiFKqIwvmqQwPK21r30Ans7MktfLAE= -SHA256 (Pkgfile) = e59a8afd742c5470beefb72d51d9251fd520f77a0a3f4bd9711294d9c3337410 +RWSE3ohX2g5d/fYoSjOlXrVgdVZjSJWCm9ISaxGKVH365kFEj0OWUVRz5fTnuy3CfkroLhr8DzWaVMFqavELeCW0PE2EXJhHpwc= +SHA256 (Pkgfile) = 6e5947b4c0a75449ab2677121757588e436f4420278b90f2427ddf43f2a338f2 SHA256 (.footprint) = 62bfe7191a20fcd5f6ec3511c951dee47aefdae734f7d616302e6bfc3a0c1923 SHA256 (dropbear-2018.76.tar.bz2) = f2fb9167eca8cf93456a5fc1d4faf709902a3ab70dd44e352f3acbc3ffdaea65 SHA256 (dropbear) = def8d4ebda5759a3bc55055957235fa47f7e40216badf07830f487f05e7fbd42 +SHA256 (CVE-2018-15599.diff) = 42b5720cf6c888638cfb84fdd862fc0d323b2e023cbe5f9ccdaa2e0c35b6873e diff --git a/dropbear/Pkgfile b/dropbear/Pkgfile index 664dd2975..2315df8f0 100644 --- a/dropbear/Pkgfile +++ b/dropbear/Pkgfile @@ -5,13 +5,15 @@ name=dropbear version=2018.76 -release=1 +release=2 source=(http://matt.ucc.asn.au/$name/releases/$name-$version.tar.bz2 \ - $name) + $name CVE-2018-15599.diff) build () { cd $name-$version + patch -p1 -i $SRC/CVE-2018-15599.diff + echo '#define SFTPSERVER_PATH "/usr/lib/ssh/sftp-server"' > localoptions.h ./configure --prefix=/usr

1 0

ports/opt (3.4): [notify] ghostscript: security fix, several -dSAFER sandbox bypass vulnerabilities
by crux＠crux.nu 25 Aug '18

25 Aug '18

commit 11f86218d26b42b30824d7678ec4a7b54cbd50e9 Author: Juergen Daubert <jue(a)jue.li> Date: Sat Aug 25 20:05:46 2018 +0200 [notify] ghostscript: security fix, several -dSAFER sandbox bypass vulnerabilities See - https://www.kb.cert.org/vuls/id/332928 - http://seclists.org/oss-sec/2018/q3/142 diff --git a/ghostscript/.signature b/ghostscript/.signature index 8c0b3ca66..30d34089a 100644 --- a/ghostscript/.signature +++ b/ghostscript/.signature @@ -1,6 +1,19 @@ untrusted comment: verify with /etc/ports/opt.pub -RWSE3ohX2g5d/fAfjoz0I76mLUiRieNsO8V6jhq5EVQ6xW14I/nmfV+aCRN4GXNPzuibAVddAgeDFQHT67ET7EstLrX9oiWLqgg= -SHA256 (Pkgfile) = bf1af24031803ccccd487cd7dfed24ead00597c00daef0f3c1698ee0b5d46f71 +RWSE3ohX2g5d/froAVb0xfR6peImTLVw25laSQoDWaxYCxl8iIc3+eGFpv01RYYqliddT0nIm31YTdVwZS/RF2l9f/HkZo2LKg4= +SHA256 (Pkgfile) = e4a88a0f36aec4197fc95a307812e31bd329eb53d64dbf81825cfa65fa09b778 SHA256 (.footprint) = 3514d4810f8fe93de5e8d03bc500e39d81dc6ab4118d0728c50d1e50e3bbc606 SHA256 (ghostscript-9.23.tar.xz) = 1fcedc27d4d6081105cdf35606cb3f809523423a6cf9e3c23cead3525d6ae8d9 SHA256 (ghostscript-fonts-std-8.11.tar.gz) = 0eb6f356119f2e49b2563210852e17f57f9dcc5755f350a69a46a0d641a0c401 +SHA256 (ghostpdl.git-0b6cd191.patch) = 562502dd1eccce30010aa2f00805132dfef86aa3675fb1df6fd00cbca8a4d786 +SHA256 (ghostpdl.git-b575e1ec.patch) = 09bf11a0dd2ca575df16e8d08ef64f7d195f8be9fe050026b5ce5d27cfcd8af9 +SHA256 (ghostpdl.git-8e9ce501.patch) = dc73b4592a862bbab7d8a4d326503d802ba4266940574ad2d73a444c977953f9 +SHA256 (ghostpdl.git-241d9111.patch) = 7f6fc634cf228c12b12c93514c419d7d6f7daad49fcd86baa23a7ff3b7fb55a4 +SHA256 (ghostpdl.git-c432131c.patch) = 12122123e1df839d39f844223a24e76a18ea0aab05cfa0012f7b2590792ca8ea +SHA256 (ghostpdl.git-e01e77a3.patch) = 4061b542ad640298caa595c02bcc3b095e6f5682996c4b7330c6a36c04f19a94 +SHA256 (ghostpdl.git-0edd3d6c.patch) = 90be1bd4374d2af5b4675275030b7c528a3a03dfb0c4980337c5eec920326d4b +SHA256 (ghostpdl.git-a054156d.patch) = 0f9b55466f45b404a4ccb9fcb18e203762eb06aa5c1b95bc7a2c8480601952c3 +SHA256 (ghostpdl.git-0d390118.patch) = 7ea332e7b2059c1f094f94714bc6b4eaf0de2515ae70b469ecfe96e7ccaf7317 +SHA256 (ghostpdl.git-c3476dde.patch) = 4ed94469231187ce2a512b4784f6fc7238543cf39b2625e2c09357fefed8aa18 +SHA256 (ghostpdl.git-b326a716.patch) = 6529a57c842e9a1573826bc6553956303297b7723c14f2bfcaeb1d899ec65c26 +SHA256 (ghostpdl.git-78911a01.patch) = 128065c4120cebcc9f177ce9ca2a525e240fd97a07727767210880080e87f507 +SHA256 (ghostpdl.git-5516c614.patch) = 125d5ffd5e891aa42aecb44025126130d014c8e8e98feca0fb6aab17cfe7908c diff --git a/ghostscript/Pkgfile b/ghostscript/Pkgfile index 7188478be..518daca8f 100644 --- a/ghostscript/Pkgfile +++ b/ghostscript/Pkgfile @@ -5,12 +5,39 @@ name=ghostscript version=9.23 -release=1 +release=2 source=(https://github.com/ArtifexSoftware/ghostpdl-downloads/releases/down… - http://downloads.sourceforge.net/sourceforge/gs-fonts/$name-fonts-std-8.11.…) + http://downloads.sourceforge.net/sourceforge/gs-fonts/$name-fonts-std-8.11.… + ghostpdl.git-0b6cd191.patch + ghostpdl.git-b575e1ec.patch + ghostpdl.git-8e9ce501.patch + ghostpdl.git-241d9111.patch + ghostpdl.git-c432131c.patch + ghostpdl.git-e01e77a3.patch + ghostpdl.git-0edd3d6c.patch + ghostpdl.git-a054156d.patch + ghostpdl.git-0d390118.patch + ghostpdl.git-c3476dde.patch + ghostpdl.git-b326a716.patch + ghostpdl.git-78911a01.patch + ghostpdl.git-5516c614.patch) build () { cd $name-$version + + patch -p1 -i $SRC/ghostpdl.git-0b6cd191.patch + patch -p1 -i $SRC/ghostpdl.git-b575e1ec.patch + patch -p1 -i $SRC/ghostpdl.git-8e9ce501.patch + patch -p1 -i $SRC/ghostpdl.git-241d9111.patch + patch -p1 -i $SRC/ghostpdl.git-c432131c.patch + patch -p1 -i $SRC/ghostpdl.git-e01e77a3.patch + patch -p1 -i $SRC/ghostpdl.git-0edd3d6c.patch + patch -p1 -i $SRC/ghostpdl.git-a054156d.patch + patch -p1 -i $SRC/ghostpdl.git-0d390118.patch + patch -p1 -i $SRC/ghostpdl.git-c3476dde.patch + patch -p1 -i $SRC/ghostpdl.git-b326a716.patch + patch -p1 -i $SRC/ghostpdl.git-78911a01.patch + patch -p1 -i $SRC/ghostpdl.git-5516c614.patch ./configure --prefix=/usr \ --enable-cups \ diff --git a/ghostscript/ghostpdl.git-0b6cd191.patch b/ghostscript/ghostpdl.git-0b6cd191.patch new file mode 100644 index 000000000..5c7323528 --- /dev/null +++ b/ghostscript/ghostpdl.git-0b6cd191.patch @@ -0,0 +1,86 @@ +From 0b6cd1918e1ec4ffd087400a754a845180a4522b Mon Sep 17 00:00:00 2001 +From: Ken Sharp <ken.sharp(a)artifex.com> +Date: Thu, 23 Aug 2018 14:12:48 +0100 +Subject: [PATCH] Fix Bug 699660 "shading_param incomplete type checking" + +Its possible to pass a t_struct parameter to .shfill which is not a +shading function built by .buildshading. This could then lead to memory +corruption or a segmentation fault by treating the object passed in +as if it were a shading. + +Its non-trivial to check the t_struct, because this function can take +7 different kinds of structures as a parameter. Checking these is +possible, of course, but would add a performance penalty. + +However, we can note that we never call .shfill without first calling +.buildshading, and we never call .buildshading without immediately +calling .shfill. So we can treat these as an atomic operation. The +.buildshading function takes all its parameters as PostScript objects +and validates them, so that should be safe. + +This allows us to 'hide' the .shfill operator preventing the possibility +of passing an invalid parameter. +--- + Resource/Init/gs_init.ps | 4 ++-- + Resource/Init/gs_ll3.ps | 7 ++++++- + Resource/Init/pdf_draw.ps | 3 +-- + 3 files changed, 9 insertions(+), 5 deletions(-) + +diff --git a/Resource/Init/gs_init.ps b/Resource/Init/gs_init.ps +index 5a5a428..bc17d42 100644 +--- a/Resource/Init/gs_init.ps ++++ b/Resource/Init/gs_init.ps +@@ -2196,8 +2196,8 @@ SAFER { .setsafeglobal } if + /.getiodevice /.getdevparms /.putdevparams /.bbox_transform /.matchmedia /.matchpagesize /.defaultpapersize + /.oserrno /.setoserrno /.oserrorstring /.getCPSImode + /.getscanconverter /.setscanconverter /.type1encrypt /.type1decrypt/.languagelevel /.setlanguagelevel /.eqproc /.fillpage /.buildpattern1 /.saslprep +-/.buildshading1 /.buildshadin2 /.buildshading3 /.buildshading4 /.buildshading5 /.buildshading6 /.buildshading7 /.buildshadingpattern +-/.argindex /.bytestring /.namestring /.stringbreak /.stringmatch /.globalvmarray /.globalvmdict /.globalvmpackedarray /.globalvmstring ++/.buildshading1 /.buildshading2 /.buildshading3 /.buildshading4 /.buildshading5 /.buildshading6 /.buildshading7 /.buildshadingpattern ++%/.shfill /.argindex /.bytestring /.namestring /.stringbreak /.stringmatch /.globalvmarray /.globalvmdict /.globalvmpackedarray /.globalvmstring + /.localvmarray /.localvmdict /.localvmpackedarray /.localvmstring /.systemvmarray /.systemvmdict /.systemvmpackedarray /.systemvmstring /.systemvmfile /.systemvmlibfile + /.systemvmSFD /.settrapparams /.currentsystemparams /.currentuserparams /.getsystemparam /.getuserparam /.setsystemparams /.setuserparams + /.checkpassword /.locale_to_utf8 /.currentglobal /.gcheck /.imagepath +diff --git a/Resource/Init/gs_ll3.ps b/Resource/Init/gs_ll3.ps +index 5aa56a3..1d37e53 100644 +--- a/Resource/Init/gs_ll3.ps ++++ b/Resource/Init/gs_ll3.ps +@@ -440,6 +440,11 @@ systemdict /.reuseparamdict mark + /shfill .systemvar /undefined signalerror + } ifelse + } bind def ++ ++/.buildshading_and_shfill { ++ .buildshading .shfill ++} bind def ++ + systemdict /.reuseparamdict undef + + /.buildpattern2 { % <template> <matrix> .buildpattern2 +@@ -464,7 +469,7 @@ systemdict /.reuseparamdict undef + % Currently, .shfill requires that the color space + % in the pattern be the current color space. + % Disable overprintmode for shfill +- { dup gsave 0 .setoverprintmode .buildshading .shfill } stopped ++ { dup gsave 0 .setoverprintmode .buildshading_and_shfill } stopped + grestore { + /$error .systemvar /errorinfo 2 copy known { + pop pop +diff --git a/Resource/Init/pdf_draw.ps b/Resource/Init/pdf_draw.ps +index b3d94ac..aef249d 100644 +--- a/Resource/Init/pdf_draw.ps ++++ b/Resource/Init/pdf_draw.ps +@@ -1365,9 +1365,8 @@ drawopdict begin + { dup /.shading .knownget { + exch pop + } { +- .buildshading ++ .buildshading_and_shfill + } ifelse +- .shfill + } stopped { + pop + ( **** Error: Ignoring invalid smooth shading object, output may be incorrect.\n) +-- +2.9.1 + diff --git a/ghostscript/ghostpdl.git-0d390118.patch b/ghostscript/ghostpdl.git-0d390118.patch new file mode 100644 index 000000000..bcaac484a --- /dev/null +++ b/ghostscript/ghostpdl.git-0d390118.patch @@ -0,0 +1,46 @@ +From: Chris Liddell <chris.liddell(a)artifex.com> +Date: Tue, 21 Aug 2018 19:17:05 +0000 (+0100) +Subject: Bug 699657: properly apply file permissions to .tempfile +X-Git-Url: http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff_plain;h=0d390118 + +Bug 699657: properly apply file permissions to .tempfile +--- + +diff --git a/psi/zfile.c b/psi/zfile.c +index a0acd5a..19996b0 100644 +--- a/psi/zfile.c ++++ b/psi/zfile.c +@@ -134,7 +134,7 @@ check_file_permissions_reduced(i_ctx_t *i_ctx_p, const char *fname, int len, + /* we're protecting arbitrary file system accesses, not Postscript device accesses. + * Although, note that %pipe% is explicitly checked for and disallowed elsewhere + */ +- if (iodev != iodev_default(imemory)) { ++ if (iodev && iodev != iodev_default(imemory)) { + return 0; + } + +@@ -734,7 +734,23 @@ ztempfile(i_ctx_t *i_ctx_p) + } + + if (gp_file_name_is_absolute(pstr, strlen(pstr))) { +- if (check_file_permissions(i_ctx_p, pstr, strlen(pstr), ++ int plen = strlen(pstr); ++ const char *sep = gp_file_name_separator(); ++#ifdef DEBUG ++ int seplen = strlen(sep); ++ if (seplen != 1) ++ return_error(gs_error_Fatal); ++#endif ++ /* strip off the file name prefix, leave just the directory name ++ * so we can check if we are allowed to write to it ++ */ ++ for ( ; plen >=0; plen--) { ++ if (pstr[plen] == sep[0]) ++ break; ++ } ++ memcpy(fname, pstr, plen); ++ fname[plen] = '\0'; ++ if (check_file_permissions(i_ctx_p, fname, strlen(fname), + NULL, "PermitFileWriting") < 0) { + code = gs_note_error(gs_error_invalidfileaccess); + goto done; diff --git a/ghostscript/ghostpdl.git-0edd3d6c.patch b/ghostscript/ghostpdl.git-0edd3d6c.patch new file mode 100644 index 000000000..a03193b34 --- /dev/null +++ b/ghostscript/ghostpdl.git-0edd3d6c.patch @@ -0,0 +1,21 @@ +From: Chris Liddell <chris.liddell(a)artifex.com> +Date: Tue, 21 Aug 2018 19:36:52 +0000 (+0100) +Subject: Bug 699659: Don't just assume an object is a t_(a)struct +X-Git-Url: http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff_plain;h=0edd3d6c + +Bug 699659: Don't just assume an object is a t_(a)struct +--- + +diff --git a/psi/ztype.c b/psi/ztype.c +index ad248d9..8307956 100644 +--- a/psi/ztype.c ++++ b/psi/ztype.c +@@ -76,7 +76,7 @@ ztype(i_ctx_t *i_ctx_p) + /* Must be either a stack underflow or a t_[a]struct. */ + check_op(2); + { /* Get the type name from the structure. */ +- if (op[-1].value.pstruct != 0x00) { ++ if ((r_has_type(&op[-1], t_struct) || r_has_type(&op[-1], t_astruct)) && op[-1].value.pstruct != 0x00) { + const char *sname = + gs_struct_type_name_string(gs_object_type(imemory, + op[-1].value.pstruct)); diff --git a/ghostscript/ghostpdl.git-241d9111.patch b/ghostscript/ghostpdl.git-241d9111.patch new file mode 100644 index 000000000..7b6f4a4b2 --- /dev/null +++ b/ghostscript/ghostpdl.git-241d9111.patch @@ -0,0 +1,43 @@ +From: Chris Liddell <chris.liddell(a)artifex.com> +Date: Thu, 23 Aug 2018 14:41:18 +0000 (+0100) +Subject: Bug 699664: Ensure the correct is in place before cleanup +X-Git-Url: http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff_plain;h=241d9111 + +Bug 699664: Ensure the correct is in place before cleanup + +If the PS job replaces the device and leaves that graphics state in place, we +wouldn't cleanup the default device in the normal way, but rely on the garbage +collector. + +This works (but isn't ideal), *except* when the job replaces the device with +the null device (using the nulldevice operator) - this means that +.uninstallpagedevice doesn't replace the existing device with the nulldevice +(since it is already installed), the device from the graphics ends up being +freed - and as it is the nulldevice, which we rely on, memory corruption +and a segfault can happen. + +We avoid this by checking if the current device is the nulldevice, and if so, +restoring it away, before continuing with the device cleanup. +--- + +diff --git a/psi/imain.c b/psi/imain.c +index 2fe1546..138bfc8 100644 +--- a/psi/imain.c ++++ b/psi/imain.c +@@ -936,6 +936,16 @@ gs_main_finit(gs_main_instance * minst, int exit_status, int code) + i_ctx_p = minst->i_ctx_p; /* interp_reclaim could change it. */ + } + ++ if (i_ctx_p->pgs != NULL && i_ctx_p->pgs->device != NULL && ++ gx_device_is_null(i_ctx_p->pgs->device)) { ++ /* if the job replaced the device with the nulldevice, we we need to grestore ++ away that device, so the block below can properly dispense ++ with the default device. ++ */ ++ int code = gs_grestoreall(i_ctx_p->pgs); ++ if (code < 0) return_error(gs_error_Fatal); ++ } ++ + if (i_ctx_p->pgs != NULL && i_ctx_p->pgs->device != NULL) { + gx_device *pdev = i_ctx_p->pgs->device; + const char * dname = pdev->dname; diff --git a/ghostscript/ghostpdl.git-5516c614.patch b/ghostscript/ghostpdl.git-5516c614.patch new file mode 100644 index 000000000..5eea5948c --- /dev/null +++ b/ghostscript/ghostpdl.git-5516c614.patch @@ -0,0 +1,230 @@ +From: Chris Liddell <chris.liddell(a)artifex.com> +Date: Fri, 24 Aug 2018 08:26:04 +0000 (+0100) +Subject: Improve restore robustness +X-Git-Url: http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff_plain;h=5516c614 + +Improve restore robustness + +Prompted by looking at Bug 699654: + +There are two variants of the restore operator in Ghostscript: one is Level 1 +(restoring VM), the other is Level 2+ (adding page device restoring to the +Level operator). + +This was implemented by the Level 2+ version restoring the device in the +graphics state, then calling the Level 1 implementation to handle actually +restoring the VM state. + +The problem was that the operand checking, and sanity of the save object was +only done by the Level 1 variant, thus meaning an invalid save object could +leave a (Level 2+) restore partially complete - with the page device part +restored, but not VM, and the page device not configured. + +To solve that, this commit splits the operand and sanity checking, and the +core of the restore operation into separate functions, so the relevant +operators can validate the operand *before* taking any further action. That +reduces the chances of an invalid restore leaving the interpreter in an +unknown state. + +If an error occurs during the actual VM restore it is essentially fatal, and the +interpreter cannot continue, but as an extra surety for security, in the event +of such an error, we'll explicitly preserve the LockSafetyParams of the device, +rather than rely on the post-restore device configuration (which won't happen +in the event of an error). +--- + +diff --git a/psi/int.mak b/psi/int.mak +index 1968820..16db0cf 100644 +--- a/psi/int.mak ++++ b/psi/int.mak +@@ -1086,8 +1086,8 @@ $(PSD)pagedev.dev : $(ECHOGS_XE) $(pagedev_)\ + + $(PSOBJ)zdevice2.$(OBJ) : $(PSSRC)zdevice2.c $(OP) $(math__h) $(memory__h)\ + $(dstack_h) $(estack_h)\ +- $(idict_h) $(idparam_h) $(igstate_h) $(iname_h) $(iutil_h) $(store_h)\ +- $(gxdevice_h) $(gsstate_h) $(INT_MAK) $(MAKEDIRS) ++ $(idict_h) $(idparam_h) $(igstate_h) $(iname_h) $(isave) $(iutil_h) \ ++ $(store_h) $(gxdevice_h) $(gsstate_h) $(INT_MAK) $(MAKEDIRS) + $(PSCC) $(PSO_)zdevice2.$(OBJ) $(C_) $(PSSRC)zdevice2.c + + $(PSOBJ)zmedia2.$(OBJ) : $(PSSRC)zmedia2.c $(OP) $(math__h) $(memory__h)\ +diff --git a/psi/isave.h b/psi/isave.h +index 3021639..7eaaced 100644 +--- a/psi/isave.h ++++ b/psi/isave.h +@@ -128,4 +128,10 @@ int font_restore(const alloc_save_t * save); + express purpose of getting the library context. */ + gs_memory_t *gs_save_any_memory(const alloc_save_t *save); + ++int ++restore_check_save(i_ctx_t *i_ctx_p, alloc_save_t **asave); ++ ++int ++dorestore(i_ctx_t *i_ctx_p, alloc_save_t *asave); ++ + #endif /* isave_INCLUDED */ +diff --git a/psi/zdevice2.c b/psi/zdevice2.c +index 9fbb4e3..0c7080d 100644 +--- a/psi/zdevice2.c ++++ b/psi/zdevice2.c +@@ -26,6 +26,7 @@ + #include "igstate.h" + #include "iname.h" + #include "iutil.h" ++#include "isave.h" + #include "store.h" + #include "gxdevice.h" + #include "gsstate.h" +@@ -307,13 +308,24 @@ z2grestoreall(i_ctx_t *i_ctx_p) + } + return 0; + } +- ++/* This is the Level 2+ variant of restore - which adds restoring ++ of the page device to the Level 1 variant in zvmem.c. ++ Previous this restored the device state before calling zrestore.c ++ which validated operands etc, meaning a restore could error out ++ partially complete. ++ The operand checking, and actual VM restore are now in two functions ++ so they can called separately thus, here, we can do as much ++ checking as possible, before embarking on actual changes ++ */ + /* <save> restore - */ + static int + z2restore(i_ctx_t *i_ctx_p) + { +- os_ptr op = osp; +- check_type(*op, t_save); ++ alloc_save_t *asave; ++ bool saveLockSafety = gs_currentdevice_inline(igs)->LockSafetyParams; ++ int code = restore_check_save(i_ctx_p, &asave); ++ ++ if (code < 0) return code; + + while (gs_gstate_saved(gs_gstate_saved(igs))) { + if (restore_page_device(igs, gs_gstate_saved(igs))) +@@ -322,7 +334,20 @@ z2restore(i_ctx_t *i_ctx_p) + } + if (restore_page_device(igs, gs_gstate_saved(igs))) + return push_callout(i_ctx_p, "%restorepagedevice"); +- return zrestore(i_ctx_p); ++ ++ code = dorestore(i_ctx_p, asave); ++ ++ if (code < 0) { ++ /* An error here is basically fatal, but.... ++ restore_page_device() has to set LockSafetyParams false so it can ++ configure the restored device correctly - in normal operation, that ++ gets reset by that configuration. If we hit an error, though, that ++ may not happen - at least ensure we keep the setting through the ++ error. ++ */ ++ gs_currentdevice_inline(igs)->LockSafetyParams = saveLockSafety; ++ } ++ return code; + } + + /* <gstate> setgstate - */ +diff --git a/psi/zvmem.c b/psi/zvmem.c +index 44cd7a8..87a0a4f 100644 +--- a/psi/zvmem.c ++++ b/psi/zvmem.c +@@ -99,19 +99,18 @@ zsave(i_ctx_t *i_ctx_p) + static int restore_check_operand(os_ptr, alloc_save_t **, gs_dual_memory_t *); + static int restore_check_stack(const i_ctx_t *i_ctx_p, const ref_stack_t *, const alloc_save_t *, bool); + static void restore_fix_stack(i_ctx_t *i_ctx_p, ref_stack_t *, const alloc_save_t *, bool); ++ ++/* Do as many up front checks of the save object as we reasonably can */ + int +-zrestore(i_ctx_t *i_ctx_p) ++restore_check_save(i_ctx_t *i_ctx_p, alloc_save_t **asave) + { + os_ptr op = osp; +- alloc_save_t *asave; +- bool last; +- vm_save_t *vmsave; +- int code = restore_check_operand(op, &asave, idmemory); ++ int code = restore_check_operand(op, asave, idmemory); + + if (code < 0) + return code; + if_debug2m('u', imemory, "[u]vmrestore 0x%lx, id = %lu\n", +- (ulong) alloc_save_client_data(asave), ++ (ulong) alloc_save_client_data(*asave), + (ulong) op->value.saveid); + if (I_VALIDATE_BEFORE_RESTORE) + ivalidate_clean_spaces(i_ctx_p); +@@ -120,14 +119,37 @@ zrestore(i_ctx_t *i_ctx_p) + { + int code; + +- if ((code = restore_check_stack(i_ctx_p, &o_stack, asave, false)) < 0 || +- (code = restore_check_stack(i_ctx_p, &e_stack, asave, true)) < 0 || +- (code = restore_check_stack(i_ctx_p, &d_stack, asave, false)) < 0 ++ if ((code = restore_check_stack(i_ctx_p, &o_stack, *asave, false)) < 0 || ++ (code = restore_check_stack(i_ctx_p, &e_stack, *asave, true)) < 0 || ++ (code = restore_check_stack(i_ctx_p, &d_stack, *asave, false)) < 0 + ) { + osp++; + return code; + } + } ++ osp++; ++ return 0; ++} ++ ++/* the semantics of restore differ slightly between Level 1 and ++ Level 2 and later - the latter includes restoring the device ++ state (whilst Level 1 didn't have "page devices" as such). ++ Hence we have two restore operators - one here (Level 1) ++ and one in zdevice2.c (Level 2+). For that reason, the ++ operand checking and guts of the restore operation are ++ separated so both implementations can use them to best ++ effect. ++ */ ++int ++dorestore(i_ctx_t *i_ctx_p, alloc_save_t *asave) ++{ ++ os_ptr op = osp; ++ bool last; ++ vm_save_t *vmsave; ++ int code; ++ ++ osp--; ++ + /* Reset l_new in all stack entries if the new save level is zero. */ + /* Also do some special fixing on the e-stack. */ + restore_fix_stack(i_ctx_p, &o_stack, asave, false); +@@ -170,9 +192,24 @@ zrestore(i_ctx_t *i_ctx_p) + /* cause an 'invalidaccess' in setuserparams. Temporarily set */ + /* LockFilePermissions false until the gs_lev2.ps can do a */ + /* setuserparams from the restored userparam dictionary. */ ++ /* NOTE: This is safe to do here, since the restore has */ ++ /* successfully completed - this should never come before any */ ++ /* operation that can trigger an error */ + i_ctx_p->LockFilePermissions = false; + return 0; + } ++ ++int ++zrestore(i_ctx_t *i_ctx_p) ++{ ++ alloc_save_t *asave; ++ int code = restore_check_save(i_ctx_p, &asave); ++ if (code < 0) ++ return code; ++ ++ return dorestore(i_ctx_p, asave); ++} ++ + /* Check the operand of a restore. */ + static int + restore_check_operand(os_ptr op, alloc_save_t ** pasave, +@@ -193,6 +230,7 @@ restore_check_operand(os_ptr op, alloc_save_t ** pasave, + *pasave = asave; + return 0; + } ++ + /* Check a stack to make sure all its elements are older than a save. */ + static int + restore_check_stack(const i_ctx_t *i_ctx_p, const ref_stack_t * pstack, diff --git a/ghostscript/ghostpdl.git-78911a01.patch b/ghostscript/ghostpdl.git-78911a01.patch new file mode 100644 index 000000000..e1434fbea --- /dev/null +++ b/ghostscript/ghostpdl.git-78911a01.patch @@ -0,0 +1,30 @@ +From: Chris Liddell <chris.liddell(a)artifex.com> +Date: Thu, 23 Aug 2018 08:54:59 +0000 (+0100) +Subject: Bug 699654: Check the restore operand type +X-Git-Url: http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff_plain;h=78911a01 + +Bug 699654: Check the restore operand type + +The primary function that implements restore correctly checked its parameter, +but a function that does some preliminary work for the restore (gstate and +device handling) did not check. + +So, even though the restore correctly errored out, it left things partially done +and, in particular, the device in partially restored state. Meaning the +LockSafetyParams was not correctly set. +--- + +diff --git a/psi/zdevice2.c b/psi/zdevice2.c +index de16dd2..9fbb4e3 100644 +--- a/psi/zdevice2.c ++++ b/psi/zdevice2.c +@@ -312,6 +312,9 @@ z2grestoreall(i_ctx_t *i_ctx_p) + static int + z2restore(i_ctx_t *i_ctx_p) + { ++ os_ptr op = osp; ++ check_type(*op, t_save); ++ + while (gs_gstate_saved(gs_gstate_saved(igs))) { + if (restore_page_device(igs, gs_gstate_saved(igs))) + return push_callout(i_ctx_p, "%restore1pagedevice"); diff --git a/ghostscript/ghostpdl.git-8e9ce501.patch b/ghostscript/ghostpdl.git-8e9ce501.patch new file mode 100644 index 000000000..a4790d8a2 --- /dev/null +++ b/ghostscript/ghostpdl.git-8e9ce501.patch @@ -0,0 +1,48 @@ +From: Ken Sharp <ken.sharp(a)artifex.com> +Date: Thu, 23 Aug 2018 14:42:02 +0000 (+0100) +Subject: Bug 699665 "memory corruption in aesdecode" +X-Git-Url: http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff_plain;h=8e9ce501 + +Bug 699665 "memory corruption in aesdecode" + +The specimen file calls aesdecode without specifying the key to be +used, though it does manage to do enough work with the PDF interpreter +routines to get access to aesdecode (which isn't normally available). + +This causes us to read uninitialised memory, which can (and often does) +lead to a segmentation fault. + +In this commit we set the key to NULL explicitly during intialisation +and then check it before we read it. If its NULL we just return. + +It seems bizarre that we don't return error codes, we should probably +look into that at some point, but this prevents the code trying to +read uninitialised memory. +--- + +diff --git a/base/aes.c b/base/aes.c +index a6bce93..e86f000 100644 +--- a/base/aes.c ++++ b/base/aes.c +@@ -662,6 +662,9 @@ void aes_crypt_ecb( aes_context *ctx, + } + #endif + ++ if (ctx == NULL || ctx->rk == NULL) ++ return; ++ + RK = ctx->rk; + + GET_ULONG_LE( X0, input, 0 ); X0 ^= *RK++; +diff --git a/base/saes.c b/base/saes.c +index 6db0e8b..307ed74 100644 +--- a/base/saes.c ++++ b/base/saes.c +@@ -120,6 +120,7 @@ s_aes_process(stream_state * ss, stream_cursor_read * pr, + gs_throw(gs_error_VMerror, "could not allocate aes context"); + return ERRC; + } ++ memset(state->ctx, 0x00, sizeof(aes_context)); + if (state->keylength < 1 || state->keylength > SAES_MAX_KEYLENGTH) { + gs_throw1(gs_error_rangecheck, "invalid aes key length (%d bytes)", + state->keylength); diff --git a/ghostscript/ghostpdl.git-a054156d.patch b/ghostscript/ghostpdl.git-a054156d.patch new file mode 100644 index 000000000..50faf184e --- /dev/null +++ b/ghostscript/ghostpdl.git-a054156d.patch @@ -0,0 +1,51 @@ +From: Chris Liddell <chris.liddell(a)artifex.com> +Date: Tue, 21 Aug 2018 19:17:51 +0000 (+0100) +Subject: Bug 699658: Fix handling of pre-SAFER opened files. +X-Git-Url: http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff_plain;h=a054156d + +Bug 699658: Fix handling of pre-SAFER opened files. + +Temp files opened for writing before SAFER is engaged are not subject to the +SAFER restrictions - that is handled by recording in a dictionary, and +checking that as part of the permissions checks. + +By adding a custom error handler for invalidaccess, that allowed the filename +to be added to the dictionary (despite the attempted open throwing the error) +thus meaning subsequent accesses were erroneously permitted. +--- + +diff --git a/Resource/Init/gs_init.ps b/Resource/Init/gs_init.ps +index a6e49f0..5a5a428 100644 +--- a/Resource/Init/gs_init.ps ++++ b/Resource/Init/gs_init.ps +@@ -2036,6 +2036,19 @@ readonly def + concatstrings concatstrings .generate_dir_list_templates + } if + ] ++ /PermitFileWriting [ ++ currentuserparams /PermitFileWriting get aload pop ++ (TMPDIR) getenv not ++ { ++ (TEMP) getenv not ++ { ++ (TMP) getenv not ++ { ++ (/temp) (/tmp) ++ } if ++ } if ++ } if ++ ] + /LockFilePermissions //true + >> setuserparams + } +@@ -2122,7 +2135,9 @@ readonly def + % the file can be deleted later, even if SAFER is set. + /.tempfile { + .tempfile % filename file +- //SAFETY /tempfiles get 2 .argindex //true .forceput ++ //SAFETY /safe get not { % only add the filename if we're not yet safe ++ //SAFETY /tempfiles get 2 .argindex //true .forceput ++ } if + } .bind executeonly odef + + % If we are running in SAFER mode, lock things down diff --git a/ghostscript/ghostpdl.git-b326a716.patch b/ghostscript/ghostpdl.git-b326a716.patch new file mode 100644 index 000000000..c5c167cdb --- /dev/null +++ b/ghostscript/ghostpdl.git-b326a716.patch @@ -0,0 +1,26 @@ +From: Chris Liddell <chris.liddell(a)artifex.com> +Date: Tue, 21 Aug 2018 15:24:05 +0000 (+0100) +Subject: Bug 699655: Properly check the return value.... +X-Git-Url: http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff_plain;h=b326a716 + +Bug 699655: Properly check the return value.... + +...when getting a value from a dictionary +--- + +diff --git a/psi/zcolor.c b/psi/zcolor.c +index 4c0f258..e27baf9 100644 +--- a/psi/zcolor.c ++++ b/psi/zcolor.c +@@ -283,8 +283,9 @@ zsetcolor(i_ctx_t * i_ctx_p) + if (r_has_type(op, t_dictionary)) { + ref *pImpl, pPatInst; + +- code = dict_find_string(op, "Implementation", &pImpl); +- if (code != 0) { ++ if ((code = dict_find_string(op, "Implementation", &pImpl)) < 0) ++ return code; ++ if (code > 0) { + code = array_get(imemory, pImpl, 0, &pPatInst); + if (code < 0) + return code; diff --git a/ghostscript/ghostpdl.git-b575e1ec.patch b/ghostscript/ghostpdl.git-b575e1ec.patch new file mode 100644 index 000000000..d5d15a26b --- /dev/null +++ b/ghostscript/ghostpdl.git-b575e1ec.patch @@ -0,0 +1,33 @@ +From: Chris Liddell <chris.liddell(a)artifex.com> +Date: Thu, 23 Aug 2018 11:20:56 +0000 (+0100) +Subject: Bug 699668: handle stack overflow during error handling +X-Git-Url: http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff_plain;h=b575e1ec + +Bug 699668: handle stack overflow during error handling + +When handling a Postscript error, we push the object throwing the error onto +the operand stack for the error handling procedure to access - we were not +checking the available stack before doing so, thus causing a crash. + +Basically, if we get a stack overflow when already handling an error, we're out +of options, return to the caller with a fatal error. +--- + +diff --git a/psi/interp.c b/psi/interp.c +index 8b49556..6150838 100644 +--- a/psi/interp.c ++++ b/psi/interp.c +@@ -676,7 +676,12 @@ again: + /* Push the error object on the operand stack if appropriate. */ + if (!GS_ERROR_IS_INTERRUPT(code)) { + /* Replace the error object if within an oparray or .errorexec. */ +- *++osp = *perror_object; ++ osp++; ++ if (osp >= ostop) { ++ *pexit_code = gs_error_Fatal; ++ return_error(gs_error_Fatal); ++ } ++ *osp = *perror_object; + errorexec_find(i_ctx_p, osp); + } + goto again; diff --git a/ghostscript/ghostpdl.git-c3476dde.patch b/ghostscript/ghostpdl.git-c3476dde.patch new file mode 100644 index 000000000..cf2a2ebbf --- /dev/null +++ b/ghostscript/ghostpdl.git-c3476dde.patch @@ -0,0 +1,43 @@ +From: Chris Liddell <chris.liddell(a)artifex.com> +Date: Tue, 21 Aug 2018 15:42:45 +0000 (+0100) +Subject: Bug 699656: Handle LockDistillerParams not being a boolean +X-Git-Url: http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff_plain;h=c3476dde + +Bug 699656: Handle LockDistillerParams not being a boolean + +This caused a function call commented as "Can't fail" to fail, and resulted +in memory correuption and a segfault. +--- + +diff --git a/devices/vector/gdevpdfp.c b/devices/vector/gdevpdfp.c +index e942682..7c58af7 100644 +--- a/devices/vector/gdevpdfp.c ++++ b/devices/vector/gdevpdfp.c +@@ -364,7 +364,7 @@ gdev_pdf_put_params_impl(gx_device * dev, const gx_device_pdf * save_dev, gs_par + * LockDistillerParams is read again, and reset if necessary, in + * psdf_put_params. + */ +- ecode = param_read_bool(plist, "LockDistillerParams", &locked); ++ ecode = param_read_bool(plist, (param_name = "LockDistillerParams"), &locked); + if (ecode < 0) + param_signal_error(plist, param_name, ecode); + +diff --git a/psi/iparam.c b/psi/iparam.c +index 68c20d4..0279455 100644 +--- a/psi/iparam.c ++++ b/psi/iparam.c +@@ -822,10 +822,11 @@ static int + ref_param_read_signal_error(gs_param_list * plist, gs_param_name pkey, int code) + { + iparam_list *const iplist = (iparam_list *) plist; +- iparam_loc loc; ++ iparam_loc loc = {0}; + +- ref_param_read(iplist, pkey, &loc, -1); /* can't fail */ +- *loc.presult = code; ++ ref_param_read(iplist, pkey, &loc, -1); ++ if (loc.presult) ++ *loc.presult = code; + switch (ref_param_read_get_policy(plist, pkey)) { + case gs_param_policy_ignore: + return 0; diff --git a/ghostscript/ghostpdl.git-c432131c.patch b/ghostscript/ghostpdl.git-c432131c.patch new file mode 100644 index 000000000..849b852e0 --- /dev/null +++ b/ghostscript/ghostpdl.git-c432131c.patch @@ -0,0 +1,109 @@ +From: Chris Liddell <chris.liddell(a)artifex.com> +Date: Thu, 23 Aug 2018 13:13:25 +0000 (+0100) +Subject: Bug 699661: Avoid sharing pointers between pdf14 compositors +X-Git-Url: http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff_plain;h=c432131c + +Bug 699661: Avoid sharing pointers between pdf14 compositors + +If a copdevice is triggered when the pdf14 compositor is the device, we make +a copy of the device, then throw an error because, by default we're only allowed +to copy the device prototype - then freeing it calls the finalize, which frees +several pointers shared with the parent. + +Make a pdf14 specific finish_copydevice() which NULLs the relevant pointers, +before, possibly, throwing the same error as the default method. + +This also highlighted a problem with reopening the X11 devices, where a custom +error handler could be replaced with itself, meaning it also called itself, +and infifite recursion resulted. + +Keep a note of if the handler replacement has been done, and don't do it a +second time. +--- + +diff --git a/base/gdevp14.c b/base/gdevp14.c +index d9f8e79..eb9cc23 100644 +--- a/base/gdevp14.c ++++ b/base/gdevp14.c +@@ -178,6 +178,7 @@ static dev_proc_fill_mask(pdf14_fill_mask); + static dev_proc_stroke_path(pdf14_stroke_path); + static dev_proc_begin_typed_image(pdf14_begin_typed_image); + static dev_proc_text_begin(pdf14_text_begin); ++static dev_proc_finish_copydevice(pdf14_finish_copydevice); + static dev_proc_create_compositor(pdf14_create_compositor); + static dev_proc_create_compositor(pdf14_forward_create_compositor); + static dev_proc_begin_transparency_group(pdf14_begin_transparency_group); +@@ -245,7 +246,7 @@ static const gx_color_map_procs * + pdf14_create_compositor, /* create_compositor */\ + NULL, /* get_hardware_params */\ + pdf14_text_begin, /* text_begin */\ +- NULL, /* finish_copydevice */\ ++ pdf14_finish_copydevice, /* finish_copydevice */\ + pdf14_begin_transparency_group,\ + pdf14_end_transparency_group,\ + pdf14_begin_transparency_mask,\ +@@ -3935,6 +3936,19 @@ pdf14_text_begin(gx_device * dev, gs_gstate * pgs, + return code; + } + ++static int ++pdf14_finish_copydevice(gx_device *new_dev, const gx_device *from_dev) ++{ ++ pdf14_device *pdev = (pdf14_device*)new_dev; ++ ++ pdev->ctx = NULL; ++ pdev->trans_group_parent_cmap_procs = NULL; ++ pdev->smaskcolor = NULL; ++ ++ /* Only allow copying the prototype. */ ++ return (from_dev->memory ? gs_note_error(gs_error_rangecheck) : 0); ++} ++ + /* + * Implement copy_mono by filling lots of small rectangles. + */ +@@ -8093,6 +8107,7 @@ c_pdf14trans_clist_read_update(gs_composite_t * pcte, gx_device * cdev, + before reopening the device */ + if (p14dev->ctx != NULL) { + pdf14_ctx_free(p14dev->ctx); ++ p14dev->ctx = NULL; + } + dev_proc(tdev, open_device) (tdev); + } +diff --git a/devices/gdevxini.c b/devices/gdevxini.c +index 8511eac..23b8c35 100644 +--- a/devices/gdevxini.c ++++ b/devices/gdevxini.c +@@ -59,7 +59,8 @@ static struct xv_ { + Boolean alloc_error; + XErrorHandler orighandler; + XErrorHandler oldhandler; +-} x_error_handler; ++ Boolean set; ++} x_error_handler = {0}; + + static int + x_catch_alloc(Display * dpy, XErrorEvent * err) +@@ -74,7 +75,8 @@ x_catch_alloc(Display * dpy, XErrorEvent * err) + int + x_catch_free_colors(Display * dpy, XErrorEvent * err) + { +- if (err->request_code == X_FreeColors) ++ if (err->request_code == X_FreeColors || ++ x_error_handler.orighandler == x_catch_free_colors) + return 0; + return x_error_handler.orighandler(dpy, err); + } +@@ -274,8 +276,10 @@ gdev_x_open(gx_device_X * xdev) + return_error(gs_error_ioerror); + } + /* Buggy X servers may cause a Bad Access on XFreeColors. */ +- x_error_handler.orighandler = XSetErrorHandler(x_catch_free_colors); +- ++ if (!x_error_handler.set) { ++ x_error_handler.orighandler = XSetErrorHandler(x_catch_free_colors); ++ x_error_handler.set = True; ++ } + /* Get X Resources. Use the toolkit for this. */ + XtToolkitInitialize(); + app_con = XtCreateApplicationContext(); diff --git a/ghostscript/ghostpdl.git-e01e77a3.patch b/ghostscript/ghostpdl.git-e01e77a3.patch new file mode 100644 index 000000000..5859c4960 --- /dev/null +++ b/ghostscript/ghostpdl.git-e01e77a3.patch @@ -0,0 +1,27 @@ +From: Ken Sharp <ken.sharp(a)artifex.com> +Date: Fri, 24 Aug 2018 11:44:26 +0000 (+0100) +Subject: Hide the .shfill operator +X-Git-Url: http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff_plain;h=e01e77a3 + +Hide the .shfill operator + +Commit 0b6cd1918e1ec4ffd087400a754a845180a4522b was supposed to make +the .shfill operator unobtainable, but I accidentally left a comment +in the line doing so. + +Fix it here, without this the operator can still be exploited. +--- + +diff --git a/Resource/Init/gs_init.ps b/Resource/Init/gs_init.ps +index bc17d42..db3f7fe 100644 +--- a/Resource/Init/gs_init.ps ++++ b/Resource/Init/gs_init.ps +@@ -2197,7 +2197,7 @@ SAFER { .setsafeglobal } if + /.oserrno /.setoserrno /.oserrorstring /.getCPSImode + /.getscanconverter /.setscanconverter /.type1encrypt /.type1decrypt/.languagelevel /.setlanguagelevel /.eqproc /.fillpage /.buildpattern1 /.saslprep + /.buildshading1 /.buildshading2 /.buildshading3 /.buildshading4 /.buildshading5 /.buildshading6 /.buildshading7 /.buildshadingpattern +-%/.shfill /.argindex /.bytestring /.namestring /.stringbreak /.stringmatch /.globalvmarray /.globalvmdict /.globalvmpackedarray /.globalvmstring ++/.shfill /.argindex /.bytestring /.namestring /.stringbreak /.stringmatch /.globalvmarray /.globalvmdict /.globalvmpackedarray /.globalvmstring + /.localvmarray /.localvmdict /.localvmpackedarray /.localvmstring /.systemvmarray /.systemvmdict /.systemvmpackedarray /.systemvmstring /.systemvmfile /.systemvmlibfile + /.systemvmSFD /.settrapparams /.currentsystemparams /.currentuserparams /.getsystemparam /.getuserparam /.setsystemparams /.setuserparams + /.checkpassword /.locale_to_utf8 /.currentglobal /.gcheck /.imagepath

1 0

ports/core (3.4): [notify] openssh: updated to 7.8p1.
by crux＠crux.nu 24 Aug '18

24 Aug '18

commit 2328f704c9522c71e5793e4f5940270309c7ecfa Author: Fredrik Rinnestam <fredrik(a)crux.nu> Date: Fri Aug 24 20:19:21 2018 +0200 [notify] openssh: updated to 7.8p1. See https://www.openssh.com/txt/release-7.8 for incompatible changes diff --git a/openssh/.signature b/openssh/.signature index ea2006ee..06e6c26a 100644 --- a/openssh/.signature +++ b/openssh/.signature @@ -1,6 +1,6 @@ untrusted comment: verify with /etc/ports/core.pub -RWRJc1FUaeVeqqcG8atodavCR5jAQOjNRnx72jplZT85+swNMX4ZrNQ7w4SVfeYDfnQvYxsbeP+BQ+qYu0Ie5hqYmHfAbB7McQA= -SHA256 (Pkgfile) = 707c5a093b206a4eb3e4029bc51901a2c3fedd5d97be904e4af7cf42ca09011f +RWRJc1FUaeVeqvsxrwQTG7fNcsA/ly5NfqtIE9EsCXUyhR5d6ZsBZl0+a9RV7NhTIa8DeNCPW+AK5ieF6Inh/BPS0rgvCbUFFQM= +SHA256 (Pkgfile) = 1581ad650bb19f8523210bf13b6df613cbf65f8eabc85a499056004b3e85b5cf SHA256 (.footprint) = 49ebea9770f893cbe403018d12a23303ae4652d2af3f1128b25c23df27282324 -SHA256 (openssh-7.7p1.tar.gz) = d73be7e684e99efcd024be15a30bffcbe41b012b2f7b3c9084aed621775e6b8f +SHA256 (openssh-7.8p1.tar.gz) = 1a484bb15152c183bb2514e112aa30dd34138c3cfb032eee5490a66c507144ca SHA256 (sshd) = 59cb8cff9890e9f5c617c5bd4e5a15e5e4bcc4bf35eb73a80322825db60bbfd4 diff --git a/openssh/Pkgfile b/openssh/Pkgfile index 3ba710e9..d4df458b 100644 --- a/openssh/Pkgfile +++ b/openssh/Pkgfile @@ -4,7 +4,7 @@ # Depends on: openssl zlib name=openssh -version=7.7p1 +version=7.8p1 release=1 source=(http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/$name-$version.… sshd)

1 0

Fwd: gpm does not install
by Milan Buška 22 Aug '18

22 Aug '18

---------- Forwarded message --------- From: Milan Buška <milan.buska(a)gmail.com> Date: st 22. 8. 2018 v 6:10 Subject: Re: gpm does not install To: <giocitta(a)gmail.com> Hi út 21. 8. 2018 v 22:45 odesílatel Giorgio Cittadini <giocitta(a)gmail.com> napsal: > > I do not succeed to install the very important package gpm from contrib. > This is what I obtain: > > ........ > > daemon/open_console.o: In function `open_console': > open_console.c:(.text+0x54): undefined reference to `major' > collect2: error: ld returned 1 exit status > make[1]: *** [Makefile:85: gpm] Error 1 > make[1]: *** Waiting for unfinished jobs.... > rm prog/display-coords.o prog/hltest.o prog/disable-paste.o > prog/display-buttons.o prog/mev.o prog/get-versions.o > make[1]: Leaving directory '/home/pkgmk/work/gpm/src/gpm-1.20.6/src' > make: *** [Makefile:99: do-all] Error 1 > > Some kind expert will help me? Thanks in advance! > > _______________________________________________ > CRUX mailing list > CRUX(a)lists.crux.nu > https://lists.crux.nu/mailman/listinfo/crux Try adjusting Pkgfile from gpm port by http://linuxfromscratch.org/blfs/view/svn/general/gpm.html It works well. Regards -- ---------------------------------------------------------------------------- Remember, no question is too stupid and no problem too small--We've all been beginners -- ---------------------------------------------------------------------------- Remember, no question is too stupid and no problem too small--We've all been beginners

1 0

gpm does not install
by Giorgio Cittadini 21 Aug '18

21 Aug '18

I do not succeed to install the very important package gpm from contrib. This is what I obtain: ........ daemon/open_console.o: In function `open_console': open_console.c:(.text+0x54): undefined reference to `major' collect2: error: ld returned 1 exit status make[1]: *** [Makefile:85: gpm] Error 1 make[1]: *** Waiting for unfinished jobs.... rm prog/display-coords.o prog/hltest.o prog/disable-paste.o prog/display-buttons.o prog/mev.o prog/get-versions.o make[1]: Leaving directory '/home/pkgmk/work/gpm/src/gpm-1.20.6/src' make: *** [Makefile:99: do-all] Error 1 Some kind expert will help me? Thanks in advance!

1 0

ports/xorg (3.4): [notify] xorg-libx11: update to 1.6.6
by crux＠crux.nu 21 Aug '18

21 Aug '18

commit e5c5d64c0b8debc235572cc1757588fb8b8b9869 Author: Juergen Daubert <jue(a)jue.li> Date: Tue Aug 21 19:41:44 2018 +0200 [notify] xorg-libx11: update to 1.6.6 includes security fixes, see https://lists.x.org/archives/xorg-announce/2018-August/002915.html diff --git a/xorg-libx11/.footprint b/xorg-libx11/.footprint index 4fbdded..de68e3c 100644 --- a/xorg-libx11/.footprint +++ b/xorg-libx11/.footprint @@ -948,6 +948,7 @@ drwxr-xr-x root/root usr/share/man/man3/ -rw-r--r-- root/root usr/share/man/man3/XkbGetKeyboardByName.3.gz -rw-r--r-- root/root usr/share/man/man3/XkbGetMap.3.gz -rw-r--r-- root/root usr/share/man/man3/XkbGetNameChanges.3.gz +-rw-r--r-- root/root usr/share/man/man3/XkbGetNamedDeviceIndicator.3.gz -rw-r--r-- root/root usr/share/man/man3/XkbGetNamedGeometry.3.gz -rw-r--r-- root/root usr/share/man/man3/XkbGetNamedIndicator.3.gz -rw-r--r-- root/root usr/share/man/man3/XkbGetNames.3.gz @@ -1028,6 +1029,7 @@ drwxr-xr-x root/root usr/share/man/man3/ -rw-r--r-- root/root usr/share/man/man3/XkbSetIndicatorMap.3.gz -rw-r--r-- root/root usr/share/man/man3/XkbSetMap.3.gz -rw-r--r-- root/root usr/share/man/man3/XkbSetModActionVMods.3.gz +-rw-r--r-- root/root usr/share/man/man3/XkbSetNamedDeviceIndicator.3.gz -rw-r--r-- root/root usr/share/man/man3/XkbSetNamedIndicator.3.gz -rw-r--r-- root/root usr/share/man/man3/XkbSetNames.3.gz -rw-r--r-- root/root usr/share/man/man3/XkbSetPtrActionX.3.gz diff --git a/xorg-libx11/.md5sum b/xorg-libx11/.md5sum index ba35613..9770006 100644 --- a/xorg-libx11/.md5sum +++ b/xorg-libx11/.md5sum @@ -1 +1 @@ -0f618db70c4054ca67cee0cc156a4255 libX11-1.6.5.tar.bz2 +6b0f83e851b3b469dd660f3a95ac3e42 libX11-1.6.6.tar.bz2 diff --git a/xorg-libx11/.signature b/xorg-libx11/.signature index c0dddac..5b43c39 100644 --- a/xorg-libx11/.signature +++ b/xorg-libx11/.signature @@ -1,5 +1,5 @@ untrusted comment: verify with /etc/ports/xorg.pub -RWTSGWF5Q7TndDmYCKXW+oc0yz6i2NAcPM/UMnlym9Tat0wScD+EH6ztrpuFKjAUzZHrew6DlcOX0qCQIcGLNBViM6bSnggYCQs= -SHA256 (Pkgfile) = c826cf80615dfb93ac1fcb340a920c9f7fe11c76232c6cf3a54fc889b066cd7f -SHA256 (.footprint) = 20045222e4b8f9fb0aa37247892a18b338c4256a5bafe545fd073a9591affc6f -SHA256 (libX11-1.6.5.tar.bz2) = 4d3890db2ba225ba8c55ca63c6409c1ebb078a2806de59fb16342768ae63435d +RWTSGWF5Q7TndFR9sTTmd2hSjLe7mO3d9z5o51ZKAE0Y9DMAJZYcY8vyiBC1pEXy7t4OMY3dL964KjNcToSeZ93bL2AZQisKMg8= +SHA256 (Pkgfile) = e073aa0498c3fe0a2a37b60a64580d89aea0f51af50525399a4deafd3a63fc3c +SHA256 (.footprint) = 879bb02d14e9b7c7a49848b431cacd3f60fc34a3ff829eeb4fa5c4f4901add8f +SHA256 (libX11-1.6.6.tar.bz2) = 65fe181d40ec77f45417710c6a67431814ab252d21c2e85c75dd1ed568af414f diff --git a/xorg-libx11/Pkgfile b/xorg-libx11/Pkgfile index 1a38176..0467772 100644 --- a/xorg-libx11/Pkgfile +++ b/xorg-libx11/Pkgfile @@ -4,7 +4,7 @@ # Depends on: xorg-libxcb xorg-xtrans name=xorg-libx11 -version=1.6.5 +version=1.6.6 release=1 source=(http://xorg.freedesktop.org/releases/individual/lib/libX11-$version…

1 0

chromium and providing the api keys at runtime
by M.W. van der Grient 20 Aug '18

20 Aug '18

All, What is the best way to provide the API keys for chromium at runtime? Where do I put the keys?? I have only used the .profile file with export. But is does not always work. For instance when I start chromium from the menus in VTWM, chromium is complaining about missing keys. I can only start chromium from the terminal... So, I am a bit puzzled... Marco

1 0

ports/opt (3.4): [notify] poppler: update to 0.68.0
by crux＠crux.nu 20 Aug '18

20 Aug '18

commit 3458ecd944e2eb9bbdca407439e2f8d828d08934 Author: Juergen Daubert <jue(a)jue.li> Date: Mon Aug 20 18:23:24 2018 +0200 [notify] poppler: update to 0.68.0 ABI has been changed, rebuild of direct dependent ports like cups-filters required. Run revdep after update. diff --git a/poppler/.footprint b/poppler/.footprint index 7157259b9..3808e51b3 100644 --- a/poppler/.footprint +++ b/poppler/.footprint @@ -151,9 +151,9 @@ drwxr-xr-x root/root usr/lib/ lrwxrwxrwx root/root usr/lib/libpoppler-cpp.so -> libpoppler-cpp.so.0 lrwxrwxrwx root/root usr/lib/libpoppler-cpp.so.0 -> libpoppler-cpp.so.0.5.0 -rwxr-xr-x root/root usr/lib/libpoppler-cpp.so.0.5.0 -lrwxrwxrwx root/root usr/lib/libpoppler.so -> libpoppler.so.78 -lrwxrwxrwx root/root usr/lib/libpoppler.so.78 -> libpoppler.so.78.0.0 --rwxr-xr-x root/root usr/lib/libpoppler.so.78.0.0 +lrwxrwxrwx root/root usr/lib/libpoppler.so -> libpoppler.so.79 +lrwxrwxrwx root/root usr/lib/libpoppler.so.79 -> libpoppler.so.79.0.0 +-rwxr-xr-x root/root usr/lib/libpoppler.so.79.0.0 drwxr-xr-x root/root usr/lib/pkgconfig/ -rw-r--r-- root/root usr/lib/pkgconfig/poppler-cairo.pc -rw-r--r-- root/root usr/lib/pkgconfig/poppler-cpp.pc diff --git a/poppler/.md5sum b/poppler/.md5sum index 8e81df205..74ce3dd6d 100644 --- a/poppler/.md5sum +++ b/poppler/.md5sum @@ -1 +1 @@ -bcfbdcaca2a1f72435e4aaa3c06664ca poppler-0.67.0.tar.xz +722ea5837cdfaae4c98607987000de30 poppler-0.68.0.tar.xz diff --git a/poppler/.signature b/poppler/.signature index e447178d1..8c3dc3f88 100644 --- a/poppler/.signature +++ b/poppler/.signature @@ -1,5 +1,5 @@ untrusted comment: verify with /etc/ports/opt.pub -RWSE3ohX2g5d/TkTPw8AC2brpygn1G+kdfiEs5D/J5PTHxb/5JnWENZREQZB+tsOAPI1MK5ipLra7uy24nTOjLz+a25FfzyOBQw= -SHA256 (Pkgfile) = 777fc8229422e9fa46d95508dde54986a5fa750e08c4affbce8644b497364dd5 -SHA256 (.footprint) = bee704ac257926e33b99a81443ca91a9c3b8eed64558418997ccfb144e264963 -SHA256 (poppler-0.67.0.tar.xz) = a34a4f1a0f5b610c584c65824e92e3ba3e08a89d8ab4622aee11b8ceea5366f9 +RWSE3ohX2g5d/Rvl3V6IJxY9y1JcgVihJOO/VerdD4HUO09R4FXewoqIFwQIfckAzWUK9KSid8ogSMVX2yXimmzBlx+cyBLT4gk= +SHA256 (Pkgfile) = 845666fc09684ae7cab556f69f434fb9ec12ecf8c5c33aa0941174b4ea3febf1 +SHA256 (.footprint) = 629a3a0836ff5a62679c509346220794e1145bf45041ae1f154d11f505c35345 +SHA256 (poppler-0.68.0.tar.xz) = f90d04f0fb8df6923ecb0f106ae866cf9f8761bb537ddac64dfb5322763d0e58 diff --git a/poppler/Pkgfile b/poppler/Pkgfile index ac62fc0f8..28241b848 100644 --- a/poppler/Pkgfile +++ b/poppler/Pkgfile @@ -4,7 +4,7 @@ # Depends on: cmake cairo lcms2 name=poppler -version=0.67.0 +version=0.68.0 release=1 source=(https://poppler.freedesktop.org/poppler-$version.tar.xz)

1 0