Stack and heap buffer overflows (gdevcups, gstype2, gsfunc0, gdevpx)

Created attachment 28006 The analyses and proof-of-concepts for the described findings

Hi,

We're writing from Trail of Bits, a security research firm. We found 6 security issues in Ghostscript and have prepared patches for each one. All findings are rated High. Details are below.

These issues were batched as the set of instructions, format of the proof-of-concept bins, analyses, and other resources are all uniform from our test runs and triage process.

FINDINGS

# Bug Class Location Severity

1 Heap buffer overflow cups/gdevcups.c:3141 High 2 Heap buffer overflow (OOB base/gstype2.c:661 High write) 3 Stack buffer overflow (OOB base/gstype2.c:708 High write) 4 Stack buffer overflow (OOB base/gsfunc0.c:1466 High write) 5 Heap buffer overflow (OOB cups/gdevcups.c:4741 High write) 6 Heap buffer overflow (OOB devices/vector/gdevpx.c:2777 High write)

REPRODUCTION

Each finding includes a proof-of-concept input (poc.bin) and a candidate patch (patch.diff). To reproduce any finding:

Build fuzzers: python3 infra/helper.py build_fuzzers --sanitizer address ghostscript

Run the PoC (substitute the appropriate fuzzer entrypoint and PoC file):

Finding 1: python3 infra/helper.py reproduce ghostscript gstoraster_fuzzer poc.bin

Finding 2: python3 infra/helper.py reproduce ghostscript gs_device_bmpmono_fuzzer poc.bin

Finding 3: python3 infra/helper.py reproduce ghostscript gs_device_ps2write_fuzzer poc.bin

Finding 4: python3 infra/helper.py reproduce ghostscript gstoraster_pdf_fuzzer poc.bin

Finding 5: python3 infra/helper.py reproduce ghostscript gstoraster_fuzzer_all_colors poc.bin

Finding 6: python3 infra/helper.py reproduce ghostscript gs_device_pxlcolor_fuzzer poc.bin

To verify a patch, apply the corresponding patch.diff to the Ghostscript source tree (commit 5f1a5c6ba3d61f4f95cb793715728927af1900ba), rebuild fuzzers, and re-run the PoC. Each patched build should exit cleanly with no ASAN report.

ATTACHMENTS

We have attached a zip containing:

• Full technical details of each finding
• Reproduction steps and proof-of-concept where applicable
• Candidate patch(es) with regression tests

BACKGROUND

Anthropic is conducting research into the use of large language models for automated vulnerability discovery in open source software. As part of that work, Anthropic used Claude to scan a set of widely used open source projects for security issues. Anthropic then engaged Trail of Bits to independently triage, manually validate, and develop patches for the findings. Each issue in this report has been reviewed and confirmed by human security researchers at Trail of Bits.

NEXT STEPS

We are disclosing under Anthropic's coordinated vulnerability disclosure policy: https://www.anthropic.com/coordinated-vulnerability-disclosure

Our disclosure timeline is 90 days from the date of this submission, with a 14-day extension available if needed.

We'd like to work with your maintainers to get these issues fixed. We are happy to submit PRs or coordinate with your preferred process. Let us know if there's a specific security contact you'd like us to work with.

Thanks for your work on Ghostscript.

— Trail of Bits, in collaboration with Anthropic