ghostscript crashes after loading 20 page repeatedly

[ecyrbe]

Binary package hint: ghostscript

while testing gostscript i found a bug while loading repeatedly 20 page using psapi_init_with_args multiple times.
this bug seems to be corrected upstream :
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=453048
thanks for applying the patch

[Martin Pitt (pitti)]

This was fixed during the Hardy merge process.

[ecyrbe (ecyrbe)]

it's a security fix, because it generate an overflow...
this patch should be applied to gutsy too...

[Martin Pitt (pitti)]

Security team, can you please do that update for stables?

[Jamie Strandboge (jdstrand)]

I have confirmed this with a private reproducer. However, I am marking this as Won't Fix because:
1. Requires malicious code to call gs_main_init_with_args() multiple times. The gs binary itself does not do this, so it is safe.
2. checked rdepends on libgs8, libgs-esp (for multiple calls to gsapi_init_with_args, which calls gs_main_init_with_args())-- only okular from kde4graphics calls it, and does so once per instance
3. if the user has the ability to compile and run malicious code, there are far worse things that could be done