Fix for security issues found during internal security audit

While most of the invocations of .forceput and related operators were
"protected" by being within "executeonly" procedures, several had crept
in that did not make sure that the operator was hidden in a procedure
that could not be read.

7 files changed, 134 insertions, 134 deletions

diff --git a/Resource/Init/gs_dps.ps b/Resource/Init/gs_dps.ps
index 3ebd0a331..cad705623 100644
--- a/Resource/Init/gs_dps.ps
+++ b/Resource/Init/gs_dps.ps
@@ -70,7 +70,7 @@
                 % Save a copy of the initial gstate.
   //systemdict /savedinitialgstate gstate readonly .forceput
   .setglobal
-} .bind def
+} .bind executeonly def % must be bound and hidden for .forceput
 
 % Initialize local dictionaries and gstate when creating a new context.
 % Note that until this completes, we are in the anomalous situation of
diff --git a/Resource/Init/gs_fntem.ps b/Resource/Init/gs_fntem.ps
index 0f7c3153a..3ceee18d3 100644
--- a/Resource/Init/gs_fntem.ps
+++ b/Resource/Init/gs_fntem.ps
@@ -408,7 +408,7 @@ currentdict end def
     exit
   } loop
   exch setglobal
-} bind def
+} .bind executeonly def % must be bound and hidden for .forceput
 
 currentdict end /ProcSet defineresource pop
 
diff --git a/Resource/Init/gs_init.ps b/Resource/Init/gs_init.ps
index 4a66af035..0fb46790e 100644
--- a/Resource/Init/gs_init.ps
+++ b/Resource/Init/gs_init.ps
@@ -2136,141 +2136,141 @@ readonly def
 SAFER { .setsafeglobal } if
 
 /SAFERUndefinePostScriptOperators {
-[
-% Used by our own test suite files
-/.pushpdf14devicefilter    % transparency-example.ps
-/.poppdf14devicefilter     % transparency-example.ps
-/.setopacityalpha          % transparency-example.ps
-/.setshapealpha            % transparency-example.ps
-/.endtransparencygroup     % transparency-example.ps
-/.setdotlength             % Bug687720.ps
-/.sort /.setdebug /.mementolistnewblocks /getenv
+  [
+  % Used by our own test suite files
+  /.pushpdf14devicefilter    % transparency-example.ps
+  /.poppdf14devicefilter     % transparency-example.ps
+  /.setopacityalpha          % transparency-example.ps
+  /.setshapealpha            % transparency-example.ps
+  /.endtransparencygroup     % transparency-example.ps
+  /.setdotlength             % Bug687720.ps
+  /.sort /.setdebug /.mementolistnewblocks /getenv
 
-/.makeoperator /.setCPSImode              % gs_cet.ps, this won't work on cluster with -dSAFER
+  /.makeoperator /.setCPSImode              % gs_cet.ps, this won't work on cluster with -dSAFER
 
-/unread
-]
-{systemdict exch .forceundef} forall
+  /unread
+  ]
+  {systemdict exch .forceundef} forall
 
-//systemdict /SAFERUndefinePostScriptOperators .forceundef
-}bind def
+  //systemdict /SAFERUndefinePostScriptOperators .forceundef
+} .bind executeonly def % must be bound and hidden for .forceundef
 
 /UndefinePostScriptOperators {
 
-%% This list is of Display PostScript operators. We believe that Display PostScript
-%% was never fully implemented and the only known user, GNUStep, is no longer
-%% using it. So lets remove it.
-[
-/condition /currentcontext /detach /.fork /join /.localfork /lock /monitor /notify
-/wait /yield /.currentscreenphase /.setscreenphase /.image2 /eoviewclip /initviewclip
-/viewclip /viewclippath /defineusername
-%% NeXT DPS extensions
-/currentalpha /setalpha /.alphaimage /composite /compositerect /dissolve /sizeimagebox /.sizeimageparams
-]
-{systemdict exch .forceundef} forall
-
-%% This list is of operators which no longer appear to be used, and which we do not believe
-%% to have any real use. For now we will undefine the operstors so they cannot easily be used
-%% but can be easily restored (just delete the name from the list in the array). In future
-%% we may remove the operator and the code implementation entirely.
-[
-/.bitadd /.charboxpath /.cond /.countexecstack /.execstack /.runandhide /.popdevicefilter
-/.execfile /.filenamesplit /.file_name_parent
-/.setdefaultmatrix /.isprocfilter /.unread /.psstringencode
-/.buildsampledfunction /.isencapfunction /.currentaccuratecurves /.currentcurvejoin /.currentdashadapt /.currentdotlength
-/.currentlimitclamp /.dotorientation /.setaccuratecurves /.setcurvejoin /.setdashadapt /.setdotorientation
-/.setlimitclamp /.currentscreenlevels /.dashpath /.pathbbox /.identeq /.identne /.tokenexec /.forgetsave /.pantonecallback
-
-%% Used by our own test suite files
-%%/.setdotlength % Bug687720.ps
-]
-{systemdict exch .forceundef} forall
-
-%% This list of operators are used internally by various parts of the Ghostscript startup code.
-%% Since each operator is a potential security vulnerability, and any operator listed here
-%% is not required once the initislisation is complete and functions are bound, we undefine
-%% the ones that aren't needed at runtime.
-[
-/.callinstall /.callbeginpage /.callendpage
-/.currentstackprotect /.setstackprotect /.errorexec /.finderrorobject /.installsystemnames /.bosobject /.fontbbox
-/.type1execchar /.type2execchar /.type42execchar /.setweightvector /.getuseciecolor /processcolors /.includecolorspace
-/.execn /.instopped /.stop /.stopped /.setcolorrendering /.setdevicecolorrendering /.buildcolorrendering1 /.builddevicecolorrendering1
-/.TransformPQR_scale_WB0 /.TransformPQR_scale_WB1 /.TransformPQR_scale_WB2 /.currentoverprintmode /.copydevice2
-/.devicename /.doneshowpage /.getbitsrect /.getdevice /.getdefaultdevice /.getdeviceparams /.gethardwareparams
-/makewordimagedevice /.outputpage /.putdeviceparams /.setdevice /.currentshowpagecount
-/.setpagedevice /.currentpagedevice /.knownundef /.setmaxlength /.rectappend /.initialize_dsc_parser /.parse_dsc_comments
-/.fillCIDMap /.fillIdentityCIDMap /.buildcmap /.filenamelistseparator /.libfile /.getfilename
-/.file_name_combine /.file_name_is_absolute /.file_name_separator /.file_name_directory_separator /.file_name_current /.filename
-/.peekstring /.writecvp /.subfiledecode /.setupUnicodeDecoder /.jbig2makeglobalctx /.registerfont /.parsecff
-/.getshowoperator /.getnativefonts /.beginform /.endform /.get_form_id /.repeatform /.reusablestream /.rsdparams
-/.buildfunction /.currentfilladjust2 /.setfilladjust2 /.sethpglpathmode /.currenthpglpathmode
-/.currenthalftone /.sethalftone5 /.image1 /.imagemask1 /.image3 /.image4
-/.getiodevice /.getdevparms /.putdevparams /.bbox_transform /.matchmedia /.matchpagesize /.defaultpapersize
-/.oserrno /.setoserrno /.oserrorstring /.getCPSImode
-/.getscanconverter /.setscanconverter /.type1encrypt /.type1decrypt/.languagelevel /.setlanguagelevel /.eqproc /.fillpage /.buildpattern1 /.saslprep
-/.buildshading1 /.buildshading2 /.buildshading3 /.buildshading4 /.buildshading5 /.buildshading6 /.buildshading7 /.buildshadingpattern
-/.shfill /.argindex /.bytestring /.namestring /.stringbreak /.stringmatch /.globalvmarray /.globalvmdict /.globalvmpackedarray /.globalvmstring
-/.localvmarray /.localvmdict /.localvmpackedarray /.localvmstring /.systemvmarray /.systemvmdict /.systemvmpackedarray /.systemvmstring /.systemvmfile /.systemvmlibfile
-/.systemvmSFD /.settrapparams /.currentsystemparams /.currentuserparams /.getsystemparam /.getuserparam /.setsystemparams /.setuserparams
-/.checkpassword /.locale_to_utf8 /.currentglobal /.gcheck /.imagepath
-
-% Used by a free user in the Library of Congress. Apparently this is used to
-% draw a partial page, which is then filled in by the results of a barcode
-% scanner and SQL database lookup. Its not clear to us exactly why this needs to be
-% done as a partial page, but its easiest to restore the operator, and it seems like
-% its a reasonably safe operator to restore, for the *very* few devices on which
-% it will have any effect. Currently this uses the 'sync_outptu' device method
-% to transfer the partial page, in future we may use a spec_op instead.
-%/flushpage
-
-% Used by our own test suite files
-%/.fileposition %image-qa.ps
-%/.makeoperator /.setCPSImode % gs_cet.ps
-
-% Either our code uses these in ways which mean they can't be undefined, or they are used directly by
-% test files/utilities, or engineers expressed a desire to keep them visible.
-%
-%/currentdevice /.sort /.buildfont0 /.buildfont1 /.buildfont2 /.buildfont3 /.buildfont4 /.buildfont9 /.buildfont10 /.buildfont11
-%/.buildfotn32 /.buildfont42 /.type9mapcid /.type11mapcid /.swapcolors
-%/currentdevice  /.quit /.setuseciecolor /.needinput /.setoverprintmode /.special_op /.dicttomark /.knownget
-%/.FAPIavailable /.FAPIpassfont /.FAPIrebuildfont /.FAPIBuildGlyph /.FAPIBuildChar /.FAPIBuildGlyph9
-%/.tempfile /.numicc_components /.set_outputintent  /.max /.min /.vmreclaim /.getpath /.setglobal
-%/.setdebug /.mementolistnewblocks /getenv
-]
-{systemdict exch .forceundef} forall
-
-//systemdict /UndefinePostScriptOperators .forceundef
-} bind def
+  %% This list is of Display PostScript operators. We believe that Display PostScript
+  %% was never fully implemented and the only known user, GNUStep, is no longer
+  %% using it. So lets remove it.
+  [
+  /condition /currentcontext /detach /.fork /join /.localfork /lock /monitor /notify
+  /wait /yield /.currentscreenphase /.setscreenphase /.image2 /eoviewclip /initviewclip
+  /viewclip /viewclippath /defineusername
+  %% NeXT DPS extensions
+  /currentalpha /setalpha /.alphaimage /composite /compositerect /dissolve /sizeimagebox /.sizeimageparams
+  ]
+  {systemdict exch .forceundef} forall
+
+  %% This list is of operators which no longer appear to be used, and which we do not believe
+  %% to have any real use. For now we will undefine the operstors so they cannot easily be used
+  %% but can be easily restored (just delete the name from the list in the array). In future
+  %% we may remove the operator and the code implementation entirely.
+  [
+  /.bitadd /.charboxpath /.cond /.countexecstack /.execstack /.runandhide /.popdevicefilter
+  /.execfile /.filenamesplit /.file_name_parent
+  /.setdefaultmatrix /.isprocfilter /.unread /.psstringencode
+  /.buildsampledfunction /.isencapfunction /.currentaccuratecurves /.currentcurvejoin /.currentdashadapt /.currentdotlength
+  /.currentlimitclamp /.dotorientation /.setaccuratecurves /.setcurvejoin /.setdashadapt /.setdotorientation
+  /.setlimitclamp /.currentscreenlevels /.dashpath /.pathbbox /.identeq /.identne /.tokenexec /.forgetsave /.pantonecallback
+
+  %% Used by our own test suite files
+  %%/.setdotlength % Bug687720.ps
+  ]
+  {systemdict exch .forceundef} forall
+
+  %% This list of operators are used internally by various parts of the Ghostscript startup code.
+  %% Since each operator is a potential security vulnerability, and any operator listed here
+  %% is not required once the initislisation is complete and functions are bound, we undefine
+  %% the ones that aren't needed at runtime.
+  [
+  /.callinstall /.callbeginpage /.callendpage
+  /.currentstackprotect /.setstackprotect /.errorexec /.finderrorobject /.installsystemnames /.bosobject /.fontbbox
+  /.type1execchar /.type2execchar /.type42execchar /.setweightvector /.getuseciecolor /processcolors /.includecolorspace
+  /.execn /.instopped /.stop /.stopped /.setcolorrendering /.setdevicecolorrendering /.buildcolorrendering1 /.builddevicecolorrendering1
+  /.TransformPQR_scale_WB0 /.TransformPQR_scale_WB1 /.TransformPQR_scale_WB2 /.currentoverprintmode /.copydevice2
+  /.devicename /.doneshowpage /.getbitsrect /.getdevice /.getdefaultdevice /.getdeviceparams /.gethardwareparams
+  /makewordimagedevice /.outputpage /.putdeviceparams /.setdevice /.currentshowpagecount
+  /.setpagedevice /.currentpagedevice /.knownundef /.setmaxlength /.rectappend /.initialize_dsc_parser /.parse_dsc_comments
+  /.fillCIDMap /.fillIdentityCIDMap /.buildcmap /.filenamelistseparator /.libfile /.getfilename
+  /.file_name_combine /.file_name_is_absolute /.file_name_separator /.file_name_directory_separator /.file_name_current /.filename
+  /.peekstring /.writecvp /.subfiledecode /.setupUnicodeDecoder /.jbig2makeglobalctx /.registerfont /.parsecff
+  /.getshowoperator /.getnativefonts /.beginform /.endform /.get_form_id /.repeatform /.reusablestream /.rsdparams
+  /.buildfunction /.currentfilladjust2 /.setfilladjust2 /.sethpglpathmode /.currenthpglpathmode
+  /.currenthalftone /.sethalftone5 /.image1 /.imagemask1 /.image3 /.image4
+  /.getiodevice /.getdevparms /.putdevparams /.bbox_transform /.matchmedia /.matchpagesize /.defaultpapersize
+  /.oserrno /.setoserrno /.oserrorstring /.getCPSImode
+  /.getscanconverter /.setscanconverter /.type1encrypt /.type1decrypt/.languagelevel /.setlanguagelevel /.eqproc /.fillpage /.buildpattern1 /.saslprep
+  /.buildshading1 /.buildshading2 /.buildshading3 /.buildshading4 /.buildshading5 /.buildshading6 /.buildshading7 /.buildshadingpattern
+  /.shfill /.argindex /.bytestring /.namestring /.stringbreak /.stringmatch /.globalvmarray /.globalvmdict /.globalvmpackedarray /.globalvmstring
+  /.localvmarray /.localvmdict /.localvmpackedarray /.localvmstring /.systemvmarray /.systemvmdict /.systemvmpackedarray /.systemvmstring /.systemvmfile /.systemvmlibfile
+  /.systemvmSFD /.settrapparams /.currentsystemparams /.currentuserparams /.getsystemparam /.getuserparam /.setsystemparams /.setuserparams
+  /.checkpassword /.locale_to_utf8 /.currentglobal /.gcheck /.imagepath
+
+  % Used by a free user in the Library of Congress. Apparently this is used to
+  % draw a partial page, which is then filled in by the results of a barcode
+  % scanner and SQL database lookup. Its not clear to us exactly why this needs to be
+  % done as a partial page, but its easiest to restore the operator, and it seems like
+  % its a reasonably safe operator to restore, for the *very* few devices on which
+  % it will have any effect. Currently this uses the 'sync_outptu' device method
+  % to transfer the partial page, in future we may use a spec_op instead.
+  %/flushpage
+
+  % Used by our own test suite files
+  %/.fileposition %image-qa.ps
+  %/.makeoperator /.setCPSImode % gs_cet.ps
+
+  % Either our code uses these in ways which mean they can't be undefined, or they are used directly by
+  % test files/utilities, or engineers expressed a desire to keep them visible.
+  %
+  %/currentdevice /.sort /.buildfont0 /.buildfont1 /.buildfont2 /.buildfont3 /.buildfont4 /.buildfont9 /.buildfont10 /.buildfont11
+  %/.buildfotn32 /.buildfont42 /.type9mapcid /.type11mapcid /.swapcolors
+  %/currentdevice  /.quit /.setuseciecolor /.needinput /.setoverprintmode /.special_op /.dicttomark /.knownget
+  %/.FAPIavailable /.FAPIpassfont /.FAPIrebuildfont /.FAPIBuildGlyph /.FAPIBuildChar /.FAPIBuildGlyph9
+  %/.tempfile /.numicc_components /.set_outputintent  /.max /.min /.vmreclaim /.getpath /.setglobal
+  %/.setdebug /.mementolistnewblocks /getenv
+  ]
+  {systemdict exch .forceundef} forall
+
+  //systemdict /UndefinePostScriptOperators .forceundef
+} .bind executeonly def % must be bound and hidden for .forceundef
 
 /UndefinePDFOperators {
-%% This list of operators are used internally by various parts of the Ghostscript PDF interpreter.
-%% Since each operator is a potential security vulnerability, and any operator listed here
-%% is not required once the initislisation is complete and functions are bound, we undefine
-%% the ones that aren't needed at runtime.
-%% This function is only called if DELAYBIND is true. It is a copy of the code at the end of pdf_main.ps
-%% and must be maintained in parallel with it.
-[
-/.pdfawidthshow /.pdfwidthshow /.currentblackptcomp /.setblackptcomp
-/.setfillcolor /.setfillcolorspace /.setstrokecolor /.setstrokecolorspace /.currentrenderingintent /.setrenderingintent
-/.currenttextrenderingmode /.settextspacing /.currenttextspacing /.settextleading /.currenttextleading
-/.settextrise /.currenttextrise /.setwordspacing /.currentwordspacing /.settexthscaling /.currenttexthscaling
-/.settextlinematrix /.currenttextlinematrix /.currenttextmatrix /.settextmatrix /.currentblendmode
-/.currentopacityalpha /.currentshapealpha /.currenttextknockout
-/.pushextendedgstate /.popextendedgstate /.begintransparencytextgroup
-/.endtransparencytextgroup /.begintransparencymaskgroup /.begintransparencymaskimage /.endtransparencymask /.image3x
-/.abortpdf14devicefilter /.pdfinkpath /.pdfFormName /.setstrokeconstantalpha
-/.setfillconstantalpha /.setalphaisshape /.currentalphaisshape
-/.settextspacing /.currenttextspacing /.settextleading /.currenttextleading /.settextrise /.currenttextrise
-/.setwordspacing /.currentwordspacing /.settexthscaling /.currenttexthscaling /.setPDFfontsize /.currentPDFfontsize
-/.setdistillerparams
-
-% undefining these causes errors/incorrect output
-%/.settextrenderingmode /.setblendmode /.begintransparencygroup /.settextknockout /check_r6_password /.setstrokeoverprint /.setfilloverprint
-%/.currentstrokeoverprint /.currentfilloverprint /.currentfillconstantalpha /.currentstrokeconstantalpha
-]
-{systemdict exch .forceundef} forall
-//systemdict /UndefinePDFOperators .forceundef
-} bind def
+  %% This list of operators are used internally by various parts of the Ghostscript PDF interpreter.
+  %% Since each operator is a potential security vulnerability, and any operator listed here
+  %% is not required once the initislisation is complete and functions are bound, we undefine
+  %% the ones that aren't needed at runtime.
+  %% This function is only called if DELAYBIND is true. It is a copy of the code at the end of pdf_main.ps
+  %% and must be maintained in parallel with it.
+  [
+  /.pdfawidthshow /.pdfwidthshow /.currentblackptcomp /.setblackptcomp
+  /.setfillcolor /.setfillcolorspace /.setstrokecolor /.setstrokecolorspace /.currentrenderingintent /.setrenderingintent
+  /.currenttextrenderingmode /.settextspacing /.currenttextspacing /.settextleading /.currenttextleading
+  /.settextrise /.currenttextrise /.setwordspacing /.currentwordspacing /.settexthscaling /.currenttexthscaling
+  /.settextlinematrix /.currenttextlinematrix /.currenttextmatrix /.settextmatrix /.currentblendmode
+  /.currentopacityalpha /.currentshapealpha /.currenttextknockout
+  /.pushextendedgstate /.popextendedgstate /.begintransparencytextgroup
+  /.endtransparencytextgroup /.begintransparencymaskgroup /.begintransparencymaskimage /.endtransparencymask /.image3x
+  /.abortpdf14devicefilter /.pdfinkpath /.pdfFormName /.setstrokeconstantalpha
+  /.setfillconstantalpha /.setalphaisshape /.currentalphaisshape
+  /.settextspacing /.currenttextspacing /.settextleading /.currenttextleading /.settextrise /.currenttextrise
+  /.setwordspacing /.currentwordspacing /.settexthscaling /.currenttexthscaling /.setPDFfontsize /.currentPDFfontsize
+  /.setdistillerparams
+
+  % undefining these causes errors/incorrect output
+  %/.settextrenderingmode /.setblendmode /.begintransparencygroup /.settextknockout /check_r6_password /.setstrokeoverprint /.setfilloverprint
+  %/.currentstrokeoverprint /.currentfilloverprint /.currentfillconstantalpha /.currentstrokeconstantalpha
+  ]
+  {systemdict exch .forceundef} forall
+  //systemdict /UndefinePDFOperators .forceundef
+} .bind executeonly def % must be bound and hidden for .forceundef
 
 % If we delayed binding, make it possible to do it later.
 /.bindnow {
diff --git a/Resource/Init/gs_lev2.ps b/Resource/Init/gs_lev2.ps
index 72c11edb4..61e3548ac 100644
--- a/Resource/Init/gs_lev2.ps
+++ b/Resource/Init/gs_lev2.ps
@@ -163,7 +163,8 @@ end
         % Set them again to the new values.  From here on, we are safe,
         % since a context switch will consult userparams.
   .setuserparams
-} .bind def
+} .bind executeonly def % must be bound and hidden for .forceput
+
 /setuserparams {                % <dict> setuserparams -
     .setuserparams2
 } .bind odef
diff --git a/Resource/Init/gs_pdfwr.ps b/Resource/Init/gs_pdfwr.ps
index 230fb21ad..fb1c4191c 100644
--- a/Resource/Init/gs_pdfwr.ps
+++ b/Resource/Init/gs_pdfwr.ps
@@ -660,8 +660,7 @@ currentdict /.pdfmarkparams .undef
   {
     pop
   } ifelse
-}
-bind def
+} .bind executeonly def % must be bound and hidden for .forceput
 
 % Use the DSC processing hook to pass DSC comments to the driver.
 % We use a pseudo-parameter named DSC whose value is an array:
diff --git a/Resource/Init/gs_setpd.ps b/Resource/Init/gs_setpd.ps
index 4cdfdc0e1..bba3c8c0e 100644
--- a/Resource/Init/gs_setpd.ps
+++ b/Resource/Init/gs_setpd.ps
@@ -624,7 +624,7 @@ SETPDDEBUG { (Rolling back.) = pstack flush } if
          { 4 index 3 1 roll .forceput }
          { 3 index exch .undef }
         ifelse
-  } .bind
+  } .bind executeonly % must be bound and hidden for .forceput
   7 {           % For PageSize only, just impose the request.
         1 index /PageSize eq
          { pop pop 1 index /PageSize 7 put }
diff --git a/Resource/Init/gs_typ32.ps b/Resource/Init/gs_typ32.ps
index 747196f48..b6600b0ce 100644
--- a/Resource/Init/gs_typ32.ps
+++ b/Resource/Init/gs_typ32.ps
@@ -85,7 +85,7 @@ systemdict /.removeglyphs .undef
 { dup /FontType 32 .forceput
   dup /CharStrings 20 dict .forceput
   1 index exch .buildfont32 exch pop
-} bind def
+} .bind executeonly def % must be bound and hidden for .forceput
 
 end             % .cidfonttypes