CVE-2009-4270: Buffer Overflow

Created attachment 373324 [details] ghostscript backtrace

Description of problem: When cups prints a PDF, it passes it at some point through pstoraster which calls gs. I noticed a PDF I was working on caused printing to fail, and it appears that some of the debugging output (which pstoraster turns on) from the gs cups driver can trigger a buffer overflow in the gs debug handling (which uses vsprintf - bad bad bad).

I think there are two issues here. One is that somehow gs ended up with MediaType argument without null termination (at least that's how it appears). The other is that ghostscript's print handling code uses (v)sprintf when it should be using (v)snprintf. In fact, ghostscript uses (v)sprintf with an "%s" format modifier over 50 times in the source code, several instances of which are probably unsafe (such as here).

Consider the following code from base/gsmisc.c: int errprintf(const gsmemoryt mem, const char fmt, ...) { ... char buf[PRINTFBUFLENGTH]; ... count = vsprintf(buf, fmt, args); errwrite(mem, buf, count); if (count >= PRINTFBUFLENGTH) { count = sprintf(buf, "PANIC: printf exceeded %d bytes. Stack has been corrupted.\n", PRINTFBUFLENGTH); errwrite(mem, buf, count); } ...

Just marvellous -- ghostscript expects vsprintf to return sanely if it overflows (which it doesn't), and then expects to print a nice panic message. It would be a 5 line patch to fix this so that it uses vsnprintf, and if count+1 exceeds the buffer length then it can print a warning that the message was truncated instead. Same goes for outprintf.

I will attach the stack trace from gdb, the cups error log and the PDF which caused the problem.

I wasn't sure if this was security-sensitive or not, but I ticked the box just to be on the safe side. With all the sanity checking that gcc adds to (v)sprintf these days, it's probably very hard to exploit.

Version-Release number of selected component (if applicable): ghostscript-8.70-1.fc12.i686

How reproducible: No idea - works every time on this PDF though.

Steps to Reproduce: 1. Open PDF in evince 2. Print PDF to any printer 3. Wait for message saying "printing failed" or somesuch.

Additional info: To attach gdb, I put a 'sleep 20' command in the pstoraster shell script (/usr/lib/cups/filter/pstoraster) just before it executed gs, then I "printed" the PDF, found the sleeping bash process and attached gdb to it.