fix(cve): CVE-2025-59799 - [PATCH] pdfwrite - bounds check some strings

debian/changelog

@@ -1,8 +1,15 @@
 ghostscript (10.05.1~dfsg-3deepin4) unstable; urgency=medium
 
-  * Rebuild with LTO enabled (dpkg vendor feature optimize/lto).
-
- -- tunaichao <tunaichao@uniontech.com>  Fri, 11 Sep 2026 14:57:34 +0800
+  * fix(cve): CVE-2025-59799 (medium) - [PATCH] pdfwrite - bounds check
+    some strings   Upstream:
+    https://github.com/ArtifexSoftware/ghostpdl/commit/6dab38fb211f15226
+    c242ab7a83fa53e4b0ff781
+  * fix(cve): CVE-2026-39919 (critical) - OpenJPEG - Fix overreading
+    bytes in some conditions.   Upstream:
+    https://github.com/ArtifexSoftware/ghostpdl/commit/0a8bf88e39db07b07
+    51a58d6ec1cf992073e4dc1
+
+ -- deepin-ci-robot <packages@deepin.org>  Fri, 04 Sep 2026 01:44:28 +0800
 
 ghostscript (10.05.1~dfsg-3deepin3) unstable; urgency=medium
 

debian/patches/CVE-2025-59799.patch

@@ -0,0 +1,28 @@
+Description: CVE-2025-59799 (medium) - Artifex Ghostscript through 10.05.1 has a stack-based buffer overflow in pdfmark_coerce_dest in devices/vector/gdevpdfm.c via a large size value.
+Author: Piotr Kajda <petermasterperfect@gmail.com>
+Origin: https://github.com/ArtifexSoftware/ghostpdl/commit/6dab38fb211f15226c242ab7a83fa53e4b0ff781
+Bug: https://security-tracker.debian.org/tracker/CVE-2025-59799
+Last-Update: 2025-05-08
+---
+diff --git a/devices/vector/gdevpdfm.c b/devices/vector/gdevpdfm.c
+index d1237c9..c120ba1 100644
+--- a/devices/vector/gdevpdfm.c
++++ b/devices/vector/gdevpdfm.c
+@@ -199,6 +199,8 @@ pdfmark_coerce_dest(gs_param_string *dstr, char dest[MAX_DEST_STRING])
+ {
+     const byte *data = dstr->data;
+     uint size = dstr->size;
++    if (size > MAX_DEST_STRING)
++        return_error(gs_error_limitcheck);
+     if (size == 0 || data[0] != '(')
+         return 0;
+     /****** HANDLE ESCAPES ******/
+@@ -859,6 +861,8 @@ pdfmark_put_ao_pairs(gx_device_pdf * pdev, cos_dict_t *pcd,
+             char buf[30];
+             int d0, d1;
+
++            if (Action[1].size > 29)
++                return_error(gs_error_rangecheck);
+             memcpy(buf, Action[1].data, Action[1].size);
+             buf[Action[1].size] = 0;
+             if (sscanf(buf, "%d %d R", &d0, &d1) == 2)

debian/patches/CVE-2026-39919.patch

@@ -0,0 +1,41 @@
+Description: CVE-2026-39919 (critical) - 堆缓冲区溢出在 JPEG 2000 (JPXDecode) 输出适配器中，通过组件重采样不匹配导致
+Author: Ken Sharp <Ken.Sharp@artifex.com>
+Origin: https://github.com/ArtifexSoftware/ghostpdl/commit/0a8bf88e39db07b0751a58d6ec1cf992073e4dc1
+Bug: https://nvd.nist.gov/vuln/detail/CVE-2026-39919
+Last-Update: 2026-08-24
+---
+diff --git a/base/sjpx_openjpeg.c b/base/sjpx_openjpeg.c
+index a4e3644..16e5e6c 100644
+--- a/base/sjpx_openjpeg.c
++++ b/base/sjpx_openjpeg.c
+@@ -490,6 +490,9 @@ static int decode_image(stream_jpxd_state * const state)
+     if (state->bpp == 12)
+         state->bpp = 16;
+
++    if (state->bpp != 1 && state->bpp != 2 && state->bpp != 4 && state->bpp != 8 && state->bpp != 16)
++        return ERRC;
++
+     /* calculate  total data */
+     rowbytes =  (state->width*state->bpp*state->out_numcomps+7)/8;
+     state->totalbytes = (ulong)rowbytes*state->height;
+@@ -654,16 +657,17 @@ static int process_one_trunk(stream_jpxd_state * const state, stream_cursor_writ
+                 int ppbyte1 = 8/state->bpp;
+                 /* sampling required */
+                 /* only grayscale can have such bit-depth, also shift_bit = 0, bpp < 8 */
+-                for (i = 0; i < state->width; i++)
++                for (i = 0; i < state->width; )
+                 {
+-                    for (b=0; b<ppbyte1; b++)
++                    for (b=0; b<ppbyte1; b++, i++)
+                     {
+                         int dx = state->image->comps[compno].dx;
+                         int dy = state->image->comps[compno].dy;
+                         int w = state->image->comps[compno].w;
+                         int in_offset_scaled = (y_offset/dy * w) + i / dx;
+                         bt = bt<<state->bpp;
+-                        bt += state->image->comps[compno].data[in_offset_scaled] + state->sign_comps[compno];
++                        if (i < state->width)
++                            bt += state->image->comps[compno].data[in_offset_scaled] + state->sign_comps[compno];
+                     }
+                     *row++ = bt;
+                 }

debian/patches/series

@@ -17,3 +17,5 @@
 CVE-2025-59798.patch
 CVE-2025-59801.patch
 CVE-2025-59800.patch
+CVE-2025-59799.patch
+CVE-2026-39919.patch