Description of problem:

It was found that ghostscript-9.07-31.el7_6.1.x86_64 introduced regression with the below patch:

ghostscript-cve-2018-15909.patch

It is caused by a typo in backported patch:

~~~
My patch:
 
@@ -1131,7 +1131,7 @@ drawopdict begin
             exch
             pop
           } {
-           .buildshading
+           .buildshading_and_shfill
           } ifelse
           .shfill
         } stopped {
 
 
Upstream patch:
 
     { dup /.shading .knownget {
         exch pop
       } {
-       .buildshading
+       .buildshading_and_shfill
       } ifelse
-      .shfill
     } stopped {
~~~

Notice the line removing ".shfill". That was badly overlooked.

If I remove the ".shfill", it fixes this regression.


Version-Release number of selected component (if applicable):

- RHEL 7.6.z
- ghostscript-9.07-31.el7_6.1.x86_64


How reproducible:

Always.


Steps to Reproduce:

1. Unpack the attached file MapSource_CZ.pdf.xz and run the below:

~~~
$ unxz MapSource_CZ.pdf.xz
$ gs -dSAFER -sDEVICE=bitcmyk -sOutputFile=lala.bitcmyk -dBATCH -dNOPAUSE -f ~/MapSource_CZ.pdf
~~~


Actual results:

~~~
$ gs -dSAFER -sDEVICE=bitcmyk -sOutputFile=MapSource_CZ.pdf.bitcmyk -dBATCH -dNOPAUSE -f ~/MapSource_CZ.pdf
GPL Ghostscript 9.07 (2013-02-14)
Copyright (C) 2012 Artifex Software, Inc.  All rights reserved.
This software comes with NO WARRANTY: see the file PUBLIC for details.
Processing pages 1 through 97.
Page 1
Page 2
Page 3
Page 4
Page 5
Page 6
Page 7
Page 8
Page 9
Page 10
Page 11
Page 12
   **** Warning: Dropping incorrect smooth shading object.
   **** Error reading a content stream. The page may be incomplete.
   **** File did not complete the page properly and may be damaged.
Error: /rangecheck in --run--
Operand stack:
   -1   --nostringval--
Execution stack:
   %interp_exit   .runexec2   --nostringval--   --nostringval--   --nostringval--   2   %stopped_push   --nostringval--   --nostringval--   --nostringval--   false   1   %stopped_push   1884   1   3   %oparray_pop   1883   1   3   %oparray_pop   1867   1   3   %oparray_pop   --nostringval--   --nostringval--   13   1   97   --nostringval--   %for_pos_int_continue   --nostringval--   --nostringval--
Dictionary stack:
   --dict:951/1684(ro)(G)--   --dict:1/20(G)--   --dict:82/200(L)--   --dict:82/200(L)--   --dict:109/127(ro)(G)--   --dict:292/300(ro)(G)--   --dict:27/32(L)--   --dict:6/8(L)--   --dict:22/40(L)--   --dict:16/25(L)--   --dict:1/1(ro)(G)--   --dict:1/1(ro)(G)--   --dict:5/5(L)--   --dict:1/1(ro)(G)--   --dict:3/5(L)--
Current allocation mode is local
Last OS error: No such file or directory
GPL Ghostscript 9.07: Unrecoverable error, exit code 1
$
~~~


Expected results:

No error.


Additional info:

The same problem was hit by somebody on Stack Overflow:

https://stackoverflow.com/questions/53625560/imagemagick-convert-pptx-to-jpg-failing-in-ghostscript-call

~~~
$ convert test.pptx[0] -thumbnail 650x650 -gravity center -extent 1500x1000 s1.jpg

\convert /tmp/magick-17292VzAbA_mfaxJX -> /tmp/magick-17292VzAbA_mfaxJX.pdf using filter : impress_pdf_Export
convert: PDFDelegateFailed `[ghostscript library 9.07] -sstdout=%stderr -dQUIET -dSAFER -dBATCH -dNOPAUSE -dNOPROMPT -dMaxBitmap=500000000 -dAlignToPixels=0 -dGridFitTT=2 '-sDEVICE=pngalpha' -dTextAlphaBits=4 -dGraphicsAlphaBits=4 '-r72x72' -dFirstPage=1 -dLastPage=1 '-sOutputFile=/tmp/magick-17292RtJq2Z8iF5iK%d' '-f/tmp/magick-17292wskX7eyNic7t' '-f/tmp/magick-17292jHMWYZOpLjVd'':    **** Warning: Dropping incorrect smooth shading object.
   **** File did not complete the page properly and may be damaged.
Error: /rangecheck in --run--
Operand stack:
   -1   --nostringval--
Execution stack:
   %interp_exit   .runexec2   --nostringval--   --nostringval--   --nostringval--   2   %stopped_push   --nostringval--   --nostringval--   --nostringval--   false   1   %stopped_push   1884   1   3   %oparray_pop   1883   1   3   %oparray_pop   1867   1   3   %oparray_pop   --nostringval--   --nostringval--   2   1   1   --nostringval--   %for_pos_int_continue   --nostringval--   --nostringval--   false   1   %stopped_push   --nostringval--   --nostringval--
Dictionary stack:
   --dict:946/1684(ro)(G)--   --dict:1/20(G)--   --dict:82/200(L)--   --dict:82/200(L)--   --dict:109/127(ro)(G)--   --dict:292/300(ro)(G)--   --dict:27/32(L)--   --dict:6/8(L)--   --dict:21/40(L)--
Current allocation mode is local
GPL Ghostscript 9.07: Unrecoverable error, exit code 1
 @ error/pdf.c/InvokePDFDelegate/276.
convert: no images defined `s1.jpg' @ error/convert.c/ConvertImageCommand/3288.
~~~