1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
|
Additional security fix that missed 9.24.
Taken from upstream:
http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=fb713b3818b52d8a6cf62c951eba2e1795ff9624
From fb713b3818b52d8a6cf62c951eba2e1795ff9624 Mon Sep 17 00:00:00 2001
From: Chris Liddell <chris.liddell@artifex.com>
Date: Thu, 6 Sep 2018 09:16:22 +0100
Subject: [PATCH] Bug 699708 (part 1): 'Hide' non-replaceable error handlers
for SAFER
We already had a 'private' dictionary for non-standard errors: gserrordict.
This now includes all the default error handlers, the dictionary is made
noaccess and all the prodedures are bound and executeonly.
When running with -dSAFER, in the event of a Postscript error, instead of
pulling the handler from errordict, we'll pull it from gserrordict - thus
malicious input cannot trigger problems by the use of custom error handlers.
errordict remains open and writeable, so files such as the Quality Logic tests
that install their own handlers will still 'work', with the exception that the
custom error handlers will not be called.
This is a 'first pass', 'sledgehammer' approach: a nice addition would to allow
an integrator to specify a list of errors that are not to be replaced (for
example, embedded applications would probably want to ensure that VMerror is
always handled as they intend).
---
Resource/Init/gs_init.ps | 29 ++++++++++++++++++-----------
psi/interp.c | 30 +++++++++++++++++++++---------
2 files changed, 39 insertions(+), 20 deletions(-)
diff --git a/Resource/Init/gs_init.ps b/Resource/Init/gs_init.ps
index 071c39205..bc8b7951c 100644
--- a/Resource/Init/gs_init.ps
+++ b/Resource/Init/gs_init.ps
@@ -881,7 +881,7 @@ userdict /.currentresourcefile //null put
{ not exch pop exit } { pop } ifelse
}
for exch pop .quit
- } bind def
+ } bind executeonly def
/.errorhandler % <command> <errorname> .errorhandler -
{ % Detect an internal 'stopped'.
1 .instopped { //null eq { pop pop stop } if } if
@@ -926,7 +926,7 @@ userdict /.currentresourcefile //null put
$error /globalmode get $error /.nosetlocal get and .setglobal
$error /.inerror //false put
stop
- } bind def
+ } bind executeonly def
% Define the standard handleerror. We break out the printing procedure
% (.printerror) so that it can be extended for binary output
% if the Level 2 facilities are present.
@@ -976,7 +976,7 @@ userdict /.currentresourcefile //null put
ifelse % newerror
end
flush
- } bind def
+ } bind executeonly def
/.printerror_long % long error printout,
% $error is on the dict stack
{ % Push the (anonymous) stack printing procedure.
@@ -1053,14 +1053,14 @@ userdict /.currentresourcefile //null put
{ (Current file position is ) print position = }
if
- } bind def
+ } bind executeonly def
% Define a procedure for clearing the error indication.
/.clearerror
{ $error /newerror //false put
$error /errorname //null put
$error /errorinfo //null put
0 .setoserrno
- } bind def
+ } bind executeonly def
% Define $error. This must be in local VM.
.currentglobal //false .setglobal
@@ -1086,11 +1086,15 @@ end
/errordict ErrorNames length 3 add dict
.forcedef % errordict is local, systemdict is global
.setglobal % back to global VM
-% For greater Adobe compatibility, we put all non-standard errors in a
-% separate dictionary, gserrordict. It does not need to be in local VM,
-% because PostScript programs do not access it.
+% gserrordict contains all the default error handling methods, but unlike
+% errordict it is noaccess after creation (also it is in global VM).
+% When running 'SAFER', we'll ignore the contents of errordict, which
+% may have been tampered with by the running job, and always use gserrordict
+% gserrordict also contains any non-standard errors, for better compatibility
+% with Adobe.
+%
% NOTE: the name gserrordict is known to the interpreter.
-/gserrordict 5 dict def
+/gserrordict ErrorNames length 3 add dict def
% Register an error in errordict. We make this a procedure because we only
% register the Level 1 errors here: the rest are registered by "feature"
% files. However, ErrorNames contains all of the error names regardless of
@@ -1119,8 +1123,11 @@ errordict begin
} bind def
end % errordict
-% Put non-standard errors in gserrordict.
-gserrordict /unknownerror errordict /unknownerror get put
+% Put all the default handlers in gserrordict
+gserrordict
+errordict {2 index 3 1 roll put} forall
+noaccess pop
+% remove the non-standard errors from errordict
errordict /unknownerror .undef
% Define a stable private copy of handleerror that we will always use under
% JOBSERVER mode.
diff --git a/psi/interp.c b/psi/interp.c
index c27b70dca..d41a9d3f5 100644
--- a/psi/interp.c
+++ b/psi/interp.c
@@ -661,16 +661,28 @@ again:
return code;
if (gs_errorname(i_ctx_p, code, &error_name) < 0)
return code; /* out-of-range error code! */
- /*
- * For greater Adobe compatibility, only the standard PostScript errors
- * are defined in errordict; the rest are in gserrordict.
+
+ /* If LockFilePermissions is true, we only refer to gserrordict, which
+ * is not accessible to Postcript jobs
*/
- if (dict_find_string(systemdict, "errordict", &perrordict) <= 0 ||
- (dict_find(perrordict, &error_name, &epref) <= 0 &&
- (dict_find_string(systemdict, "gserrordict", &perrordict) <= 0 ||
- dict_find(perrordict, &error_name, &epref) <= 0))
- )
- return code; /* error name not in errordict??? */
+ if (i_ctx_p->LockFilePermissions) {
+ if (((dict_find_string(systemdict, "gserrordict", &perrordict) <= 0 ||
+ dict_find(perrordict, &error_name, &epref) <= 0))
+ )
+ return code; /* error name not in errordict??? */
+ }
+ else {
+ /*
+ * For greater Adobe compatibility, only the standard PostScript errors
+ * are defined in errordict; the rest are in gserrordict.
+ */
+ if (dict_find_string(systemdict, "errordict", &perrordict) <= 0 ||
+ (dict_find(perrordict, &error_name, &epref) <= 0 &&
+ (dict_find_string(systemdict, "gserrordict", &perrordict) <= 0 ||
+ dict_find(perrordict, &error_name, &epref) <= 0))
+ )
+ return code; /* error name not in errordict??? */
+ }
doref = *epref;
epref = &doref;
/* Push the error object on the operand stack if appropriate. */
--
2.18.0
|
