fix(cve): CVE-2025-59798 - pdfwrite - avoid buffer overrun

[deepin-ci-robot]

CVE: CVE-2025-59798 (medium) - Buffer overflow in pdf_write_cmap
Upstream: ArtifexSoftware/ghostpdl@0cae41b

Co-authored-by: hudeng hudeng@deepin.org
Generated-By: qwen3.6-35b

---

CVE: CVE-2025-59800 (medium) - Heap overflow in ocr_line8 - PDF OCR 8 bit device raster size calculation overflow vulnerability
Upstream: ArtifexSoftware/ghostpdl@176cf01

Co-authored-by: hudeng hudeng@deepin.org
Generated-By: qwen3.6-35b

---

CVE: CVE-2025-59801 (medium) - In Artifex GhostXPS before 10.06.0, there is a stack-based buffer overflow in xps_unpredict_tiff in xpstiff.c because the samplesperpixel value is not checked.
Upstream: ArtifexSoftware/ghostpdl@d12002b

Co-authored-by: hudeng hudeng@deepin.org
Generated-By: qwen3.6-35b

[deepin-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign liujianqiang-niu for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• https:/raw.githubusercontent.com/deepin-community/template-repository/master/debian/deepin/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[deepin-ci-robot]

/hold
因为该quilt包的上游版本号变更，详情见: deepin-community/infra-settings#134

[github-actions]

TAG Bot

TAG: 10.05.1_dfsg-3deepin3
EXISTED: no
DISTRIBUTION: unstable

[Zeno-sole]

审查结论：暂不建议合并（存在合并冲突）

[P1] 与 master 冲突，CVE-2025-59800/59801 补丁已在 master 上存在

本 PR 基于旧 master e459ed3，而 master 已在其后通过 ea5a9f9 独立合入了 CVE-2025-59800 与 CVE-2025-59801（debian/patches/CVE-2025-59800.patch、CVE-2025-59801.patch 及 series、changelog），随后 f0fc40b 又为这两个补丁补了文件尾换行。本 PR 再次新建同名补丁并追加 series、changelog，导致三处（changelog 版本号、series 列表、两个补丁文件）冲突，无法干净合并。

经比对：PR 与 master 的 CVE-2025-59800.patch 代码完全一致；CVE-2025-59801.patch 代码也完全一致，仅 Origin 引用的上游 commit 不同（PR 用 d12002b16…，master 用 99727069…，两者代码内容相同）。因此本 PR 真正新增的有效内容只有 CVE-2025-59798（pdf_write_cmap 缓冲区溢出修复），另外两个是重复劳动。

建议：将分支 rebase 到当前 master，丢弃重复的 59800/59801 两个 commit，仅保留 59798 的补丁与 changelog 条目后重新提交。

唯一新增补丁 CVE-2025-59798 的质量验证（合格）

该补丁与上游 0cae41b2（"pdfwrite - avoid buffer overrun"）逐行一致，无回移植偏差：

• pdf_write_cid_system_info_to_stream：Registry/Ordering 加 = NULL 初始化、检查 stream_puts() 返回值并在失败时 goto error，最终 return code 而非固定 return 0，正确传播错误并避免用未初始化缓冲区继续写 PDF。
• pdf_write_cmap：把原 200 字节栈缓冲区 byte buf[200] 改为按 Registry.size + Ordering.size + CMapName.size + 100 动态分配，并加 buflen > max_uint 上限检查、所有错误路径 gs_free_object 释放、用 buflen 而非 sizeof(buf) 传给 swrite_string。

修复逻辑正确、内存释放路径完整，补丁本身无问题。

结论：CVE-2025-59798.patch 本身合格，但 PR 整体因与 master 冲突且重复携带已合并的 59800/59801 而暂不可合并，需先 rebase 并去除重复补丁。

[Zeno-sole]

/integrate

[github-actions]

AutoIntegrationPr Bot
auto integrate with pr url: deepin-community/Repository-Integration#4532
PrNumber: 4532
PrBranch: auto-integration-33728750782