Index: trunk/server/common/patches/ghostscript-CVE-2010-1628.patch
===================================================================
--- trunk/server/common/patches/ghostscript-CVE-2010-1628.patch	(revision 1587)
+++ trunk/server/common/patches/ghostscript-CVE-2010-1628.patch	(revision 1587)
@@ -0,0 +1,127 @@
+Index: gs/psi/idosave.h
+===================================================================
+--- gs/psi/idosave.h	(revision 11306)
++++ gs/psi/idosave.h	(working copy)
+@@ -18,6 +18,22 @@
+ #  define idosave_INCLUDED
+ 
+ /*
++ * Structure for saved change chain for save/restore.  Because of the
++ * garbage collector, we need to distinguish the cases where the change
++ * is in a static object, a dynamic ref, or a dynamic struct.
++ */
++typedef struct alloc_change_s alloc_change_t;
++struct alloc_change_s {
++    alloc_change_t *next;
++    ref_packed *where;
++    ref contents;
++#define AC_OFFSET_STATIC (-2)	/* static object */
++#define AC_OFFSET_REF (-1)	/* dynamic ref */
++#define AC_OFFSET_ALLOCATED (-3) /* a newly allocated ref array */
++    short offset;		/* if >= 0, offset within struct */
++};
++
++/*
+  * Save a change that must be undone by restore.  We have to pass the
+  * pointer to the containing object to alloc_save_change for two reasons:
+  *
+@@ -29,6 +45,7 @@
+  * relocate the pointer to it from the change record during garbage
+  * collection.
+  */
++
+ int alloc_save_change(gs_dual_memory_t *dmem, const ref *pcont,
+ 		      ref_packed *ptr, client_name_t cname);
+ int alloc_save_change_in(gs_ref_memory_t *mem, const ref *pcont,
+@@ -36,6 +53,6 @@
+ /* Remove an AC_OFFSET_ALLOCATED element. */
+ void alloc_save_remove(gs_ref_memory_t *mem, ref_packed *obj, client_name_t cname);
+ /* Allocate a structure for recording an allocation event. */
+-int alloc_save_change_alloc(gs_ref_memory_t *mem, client_name_t cname, ref_packed ***ppr);
++int alloc_save_change_alloc(gs_ref_memory_t *mem, client_name_t cname, alloc_change_t **pcp);
+ 
+ #endif /* idosave_INCLUDED */
+Index: gs/psi/isave.c
+===================================================================
+--- gs/psi/isave.c	(revision 11306)
++++ gs/psi/isave.c	(working copy)
+@@ -156,22 +156,6 @@
+ /* A link to igcref.c . */
+ ptr_proc_reloc(igc_reloc_ref_ptr_nocheck, ref_packed);
+ 
+-/*
+- * Structure for saved change chain for save/restore.  Because of the
+- * garbage collector, we need to distinguish the cases where the change
+- * is in a static object, a dynamic ref, or a dynamic struct.
+- */
+-typedef struct alloc_change_s alloc_change_t;
+-struct alloc_change_s {
+-    alloc_change_t *next;
+-    ref_packed *where;
+-    ref contents;
+-#define AC_OFFSET_STATIC (-2)	/* static object */
+-#define AC_OFFSET_REF (-1)	/* dynamic ref */
+-#define AC_OFFSET_ALLOCATED (-3) /* a newly allocated ref array */
+-    short offset;		/* if >= 0, offset within struct */
+-};
+-
+ static 
+ CLEAR_MARKS_PROC(change_clear_marks)
+ {
+@@ -519,7 +503,7 @@
+ 
+ /* Allocate a structure for recording an allocation event. */
+ int
+-alloc_save_change_alloc(gs_ref_memory_t *mem, client_name_t cname, ref_packed ***ppr)
++alloc_save_change_alloc(gs_ref_memory_t *mem, client_name_t cname, alloc_change_t **pcp)
+ {
+     register alloc_change_t *cp;
+ 
+@@ -533,8 +517,7 @@
+     cp->where = 0;
+     cp->offset = AC_OFFSET_ALLOCATED;
+     make_null(&cp->contents);
+-    mem->changes = cp;
+-    *ppr = &cp->where;
++    *pcp = cp;
+     return 1;
+ }
+ 
+Index: gs/psi/ialloc.c
+===================================================================
+--- gs/psi/ialloc.c	(revision 11306)
++++ gs/psi/ialloc.c	(working copy)
+@@ -185,7 +185,14 @@
+ 	 */
+ 	chunk_t *pcc = mem->pcc;
+ 	ref *end;
++	alloc_change_t *cp = 0;
++        int code = 0;
+ 
++	if ((gs_memory_t *)mem != mem->stable_memory) {
++	    code = alloc_save_change_alloc(mem, "gs_alloc_ref_array", &cp);
++	    if (code < 0)
++		return code;
++	}
+ 	obj = gs_alloc_struct_array((gs_memory_t *) mem, num_refs + 1,
+ 				    ref, &st_refs, cname);
+ 	if (obj == 0)
+@@ -210,14 +217,10 @@
+ 	    chunk_locate_ptr(obj, &cl);
+ 	    cl.cp->has_refs = true;
+ 	}
+-	if ((gs_memory_t *)mem != mem->stable_memory) {
+-	    ref_packed **ppr = 0;
+-	    int code = alloc_save_change_alloc(mem, "gs_alloc_ref_array", &ppr);
+-	    if (code < 0)
+-		return code;
+-            if (ppr)
+-	        *ppr = (ref_packed *)obj;
+-	}
++	if (cp) {
++            mem->changes = cp;
++            cp->where = (ref_packed *)obj;
++        }
+     }
+     make_array(parr, attrs | mem->space, num_refs, obj);
+     return 0;
Index: trunk/server/fedora/Makefile
===================================================================
--- trunk/server/fedora/Makefile	(revision 1586)
+++ trunk/server/fedora/Makefile	(revision 1587)
@@ -19,5 +19,5 @@
 # See /COPYRIGHT in this repository for more information.
 
-upstream_yum	= krb5 krb5.i586 httpd openssh shadow-utils libpng
+upstream_yum	= krb5 krb5.i586 httpd openssh shadow-utils libpng ghostscript
 upstream	= openafs $(upstream_yum) moira cluster-glue heartbeat pacemaker
 oursrc		= execsys tokensys accountadm httpdmods logview sql-signup nss_nonlocal nss_nonlocal.i586 whoisd mit-zephyr athrun php_scripts scripts-wizard scripts-base
Index: trunk/server/fedora/specs/ghostscript.spec.patch
===================================================================
--- trunk/server/fedora/specs/ghostscript.spec.patch	(revision 1587)
+++ trunk/server/fedora/specs/ghostscript.spec.patch	(revision 1587)
@@ -0,0 +1,44 @@
+--- ghostscript.spec	2010-07-16 01:35:28.000000000 -0400
++++ ghostscript.spec	2010-07-16 01:55:49.000000000 -0400
+@@ -5,7 +5,7 @@
+ Name: ghostscript
+ Version: %{gs_ver}
+ 
+-Release: 6%{?dist}
++Release: 6.scripts%{scriptsversion}%{?dist}
+ 
+ # Included CMap data is Redistributable, no modification permitted,
+ # see http://bugzilla.redhat.com/487510
+@@ -35,6 +35,8 @@
+ Patch17: ghostscript-tiff-default-strip-size.patch
+ Patch18: ghostscript-tiff-fixes.patch
+ 
++Patch100: ghostscript-CVE-2010-1628.patch
++
+ Requires: urw-fonts >= 1.1, ghostscript-fonts
+ BuildRequires: xz
+ BuildRequires: libjpeg-devel, libXt-devel
+@@ -151,6 +153,9 @@
+ # Backported some more TIFF fixes (bug #573970).
+ %patch18 -p1 -b .tiff-fixes
+ 
++# Avoid an exploitable overflow (scripts.mit.edu local patch).
++%patch100 -p1 -b .CVE-2010-1628
++
+ # Convert manual pages to UTF-8
+ from8859_1() {
+ 	iconv -f iso-8859-1 -t utf-8 < "$1" > "${1}_"
+@@ -332,6 +337,13 @@
+ %{_libdir}/libgs.so
+ 
+ %changelog
++* Fri Jul 16 2010 Geoffrey Thomas <geofft@mit.edu> 8.71-6.scripts
++- Include the patch
++  http://bugs.ghostscript.com/attachment.cgi?id=6350
++  to fix CVE-2010-1628 (potential arbitrary code execution via
++  an overflow), from the upstream bug report:
++  http://bugs.ghostscript.com/show_bug.cgi?id=691295
++
+ * Tue Mar 16 2010 Tim Waugh <twaugh@redhat.com> 8.71-6
+ - Backported some more TIFF fixes (bug #573970).
+ - Use upstream fix for TIFF default strip size (bug #571520).