[gs-commits] ghostpdl branch, master, updated. jbig2dec-0.14-1577-gfd14a8e
[email protected] (Chris Liddell)
| Newsgroups | gmane.comp.printing.ghostscript.cvs |
|---|---|
| Message-ID | <[email protected]> |
The ghostpdl branch, master has been updated
via fd14a8e3701a7f75d758a1e536bcafbddeb70289 (commit)
via 79a06b45e784e6839b2b2129cd2620ea606254e1 (commit)
via 9883f2a931407503778bb94948b47480eff858b2 (commit)
via 7abf720f46dd9ff6018b7f29141ba0573016d59d (commit)
via d86ecec686d77e69f7c4a10df9da8c4cd8336a03 (commit)
via 7ca1bb5794997e0dba059a5be6f85a9eaefc915d (commit)
via 34dac4d2a1b195536fcb9d796168cd1360c0e500 (commit)
via 4d53f6ee868205c76950027e76a27f0278513a39 (commit)
from 00af0eb11b82c4dfddbe91bcb70caed2e61a1cc8 (commit)
----------------------------------------------------------------------
commit fd14a8e3701a7f75d758a1e536bcafbddeb70289
Author: Chris Liddell <[email protected]>
Date: Tue Aug 13 14:43:51 2019 +0100
Document the new SAFER/file access controls
The documentation for the old SAFER remains in place (noted as deprecated) until
we actually remove it. Document accessing the old SAFER functionality
(-dOLDSAFER).
Generally, tidy up the HTML/formatting of the parameter and operator lists
in Use.htm and Language.htm - mainly making indenting even and consistent.
List .setpdfwrite as deprecated
Include setting the target of the first parameter of gsapi_new_instance() to
NULL before calling it, and fix the examples in API.htm
diff --git a/doc/API.htm b/doc/API.htm
index 3545963..913ca22 100644
--- a/doc/API.htm
+++ b/doc/API.htm
@@ -337,6 +337,10 @@ now, certain devices are known not to be (particularly the contrib
devices). The makefiles currently make no attempt to exclude these
from builds. If you enable GS_THREADSAFE then you should check to ensure
that you do not rely on such devices (check for global variable use).</p>
+<p>
+The first parameter, is a pointer to an opaque pointer ("<code>void **</code>").
+The opaque pointer ("<code>void *</code>") must be initialised to <code>NULL</code> before
+the call to <code>gsapi_new_instance()</code>. See <a href="#Example_1">Example 1</a>.
</blockquote>
@@ -799,7 +803,7 @@ by adding their location (the <tt>src</tt> directory in the Ghostscript source
distribution) to the project's search path, or by copying ierrors.h and iapi.h into the
same directory as the example source.</p>
-<h3>Example 1</h3>
+<h3><a name="Example_1"></a>Example 1</h3>
<pre>
/* Example of using GS DLL as a ps2pdf converter. */
@@ -817,24 +821,21 @@ same directory as the example source.</p>
#include "ierrors.h"
#include "iapi.h"
-void *minst;
+void *minst = NULL;
int main(int argc, char *argv[])
{
int code, code1;
- const char * gsargv[10];
+ const char * gsargv[7];
int gsargc;
- gsargv[0] = "ps2pdf"; /* actual value doesn't matter */
+ gsargv[0] = "";
gsargv[1] = "-dNOPAUSE";
gsargv[2] = "-dBATCH";
gsargv[3] = "-dSAFER";
gsargv[4] = "-sDEVICE=pdfwrite";
gsargv[5] = "-sOutputFile=out.pdf";
- gsargv[6] = "-c";
- gsargv[7] = ".setpdfwrite";
- gsargv[8] = "-f";
- gsargv[9] = "input.ps";
- gsargc=10;
+ gsargv[6] = "input.ps";
+ gsargc=7;
code = gsapi_new_instance(&minst, NULL);
if (code < 0)
@@ -906,7 +907,7 @@ gsdll_stderr(void *instance, const char *str, int len)
return len;
}
-void *minst;
+void *minst = NULL;
const char start_string[] = "systemdict /start get exec\n";
int main(int argc, char *argv[])
diff --git a/doc/Language.htm b/doc/Language.htm
index ed45118..3c90f92 100644
--- a/doc/Language.htm
+++ b/doc/Language.htm
@@ -600,13 +600,14 @@ a ...<code>show</code>, <code>stringwidth</code>, or
in the font dictionary to find a procedure to run. If it does not find
this name, and if the <code>FontType</code> is 1, the interpreter
instead uses the value (looked up on the dictionary stack in the usual way)
-of the name <code>%Type1BuildChar</code>.</dd>
+of the name <code>%Type1BuildChar</code>.
<p>
The standard definition of <code>%Type1BuildChar</code> is in the
initialization file <code>gs_type1.ps</code>. Users should not need to
redefine <code>%Type1BuildChar</code>, except perhaps for tracing or
debugging.</p>
+</dd>
</dl>
<dl>
@@ -703,11 +704,8 @@ E.g., if <code><prefix_string></code> is
<code>/my/tmpdir/zza1234</code>.</li>
<p>
When running in <code>SAFER</code> mode, the absolute path must
-be one of the strings on the list given by the <code>PermitFileWriting</code>
-userparameter. Temporary files created with <code>.tempfile</code> can
-be deleted when in SAFER mode, and can be renamed to one of the paths
-that is on <b>both</b> the PermitFileControl and PermitFileWriting
-paths.</p>
+be one of the strings on the permit file writing list
+(see <a href="Use.htm#Safer"><b>-dSAFER</b></a>) .</p>
</ul>
</dl>
@@ -774,7 +772,7 @@ the DELAYBIND flag.</dd>
<dt><code>- .bindnow -</code></dt>
<dd>Applies <code>bind</code> operator to all saved procedures after binding has been
deferred through -dDELAYBIND. Note that idiom recognition has no effect for the deferred
-binding because the value returned from <code>bind</code> is discarded.</dd>
+binding because the value returned from <code>bind</code> is discarded.
<p>
Since v. 8.12 <code>.bindnow</code> undefines itself and restores standard definition of
<code>bind</code> operator. In earlier versions after calling <code>.bindnow</code>,
@@ -786,6 +784,7 @@ the postscript <code>bind</code> operator needs to be rebound to the internal im
} if
</tt></pre></blockquote>
This is necessary for correct behavior with later code that uses the <code>bind</code> operator.</p>
+</dd>
</dl>
<dl>
@@ -802,7 +801,7 @@ false.</dd>
<code><string></code> based on the value of
<code><boolean></code>. These correspond to the debug
flags set by <code>-Z</code> on the command line and enable
-debug and tracing output from various internal modules.</dd>
+debug and tracing output from various internal modules.
<p>Note that most tracing output is only produced if the Ghostscript
interpreter was built with the <code>DEBUG</code> preprocessor
@@ -817,6 +816,7 @@ array, indexed by character value. The <code>zsetdebug</code> function will
be entered, and <code>gs_debug[]</code> updated, whether or not Ghostscript
is built with the <code>DEBUG</code> preprocessor symbol defined, so this
is useful even with release builds.</p>
+</dd>
</dl>
<dl>
@@ -825,6 +825,8 @@ is useful even with release builds.</p>
<code>-dDELAYSAFER</code>, this operator can be used to enter <b>SAFER</b>
mode (see <a href="Use.htm#Safer"><b>-dSAFER</b></a>)</dd>
<p>
+<strong>The following is deprecated, see <a href="Use.htm#Safer"><b>-dSAFER</b></a></strong>
+<p>
Since <b>SAFER</b> mode is implemented with userparameters and device parameters,
it is possible to use <code>save</code> and <code>restore</code> before
and after <code>.setsafe</code> to return to <b>NOSAFER</b> mode, but note
@@ -839,11 +841,14 @@ will be erased as a side effect of this operator</b></p>
<dl>
<dt><code>- .locksafe -</code></dt>
<dd>
+<p>
+<strong>The following is deprecated, see <a href="Use.htm#Safer"><b>-dSAFER</b></a></strong>
+<p>
This operator sets the current device's <code>.LockSafetyParams</code>
and the <code>LockFilePermissions</code> userparameter true as well as
adding the paths on LIBPATH and FONTPATH and the paths given by the
system params /GenericResourceDir and /FontResourceDir to the current
-PermitFileReading list of paths.</dd>
+PermitFileReading list of paths.
<p>
If Ghostscript is started with <code>-dNOSAFER</code> or
<code>-dDELAYSAFER</code>, this operator can be used to enter <b>SAFER</b>
@@ -871,14 +876,50 @@ will be erased as a side effect of this operator</b></p>
<p>
See also <a href="#LockSafetyParams">.LockSafetyParams</a> and
<a href="#User_parameters">User Parameters</a>.</p>
+</dd>
+</dl>
+
+<dl>
+<dt><a name="#addcontrolpath"></a>
+<code><name> <string> .addcontrolpath</code></dt>
+<dd>
+Adds a single path to the file access control lists.
+<p>The <name> parameter can be one of:
+<ul>
+<li>
+<p><code>/PermitFileReading</code>
+</li>
+<li>
+<p><code>/PermitFileWriting</code>
+</li>
+<li>
+<p><code>/PermitFileControl</code>
+</li>
+</ul>
+<p>Whilst the string paramater is the path to be added to the requested list.
+<p><strong>NOTE: Any attempt to call this operator after <a href="#activatepathcontrol">.activatepathcontrol</a>
+has been called will result in a <code>Fatal</code> error, and the interpreter
+will immediately exit.</strong>
+</dd>
+</dl>
+
+<dl>
+<dt><a name="#activatepathcontrol"></a>
+<code>.activatepathcontrol</code></dt>
+<dd>
+Activates file access controls. Once activated, these access controls remain
+in place until the interpreter shuts down.
+</dd>
</dl>
<dl>
<dt><a name=".setpdfwrite"></a>
<code>.setpdfwrite</code></dt>
-<dd>This operator conditions the environment for the <tt>pdfwrite</tt> output device.
+<dd>
+<strong>This operator is now deprecated, and its use is discouraged</strong>
+<p>This operator conditions the environment for the <tt>pdfwrite</tt> output device.
It is a shorthand for setting parameters that have been deemed benificial. While not strictly necessary, it is usually helpful to set call this when using the pdfwrite device.
-For example, this is how the ps2pdf script calls Ghostscript:</dd>
+For example, this is how the ps2pdf script calls Ghostscript:
<blockquote><code>
gs -q -dSAFER -dNOPAUSE -dBATCH -sOutputFile=file.pdf </code><em>[more options]</em><code> \<br>
-sDEVICE=pdfwrite -c .setpdfwrite -f </code><em>source1.ps [more files]</em>
@@ -886,6 +927,7 @@ gs -q -dSAFER -dNOPAUSE -dBATCH -sOutputFile=file.pdf </code><em>[more options]<
<p>Currently, the operator just sets a minimum 3 MB vmthreshold to allow for
accumulating shared object data and to reduce the incidence of garbage
collection as a performance improvement. Additional settings may be added in the future.</p>
+</dd>
</dl>
<dl>
@@ -894,7 +936,7 @@ collection as a performance improvement. Additional settings may be added in the
<dt><code><dict> .genordered <string></code> (/OutputType /ThreshString).</dt>
<dt><code><dict> .genordered <array></code> (/OutputType /TOSArray).</dt>
<dd>This operator creates an ordered dither screening pattern with the parameters from the dictionary, returning (by default) a PostScript HalftoneType 3 (threshold array based) dictionary suitable for use with <code>sethalftone</code> or as a component Halftone of a <code>HalftoneType 5</code> Halftone dictionary. The /OutputType parameter can also select other than Halftone Type 3 as the return paramter,
-<code><dict></code> has the following keys (all are optional):</dd>
+<code><dict></code> has the following keys (all are optional):
<dl>
<dt><code>/Frequency</code></dt>
<dd>Integer; default value = 75</dd>
@@ -915,18 +957,30 @@ collection as a performance improvement. Additional settings may be added in the
<dd>SuperCellSize may need to be specified large enough to achieve the requested number of gray levels.</dd>
<dt><code>/OutputType</code></dt>
<dd>Name; default value = /Type3 (HalftoneType 3 dictionary). Other shapes available are:</dd>
+<dt><code>/ThreshString</code></dt>
+<dd>
+First two bytes are width (high byte first), next two bytes are height, followed by the
+threshold array bytes (same as /Thresholds of the Type3 dictionary).
+</dd>
+<dt><code>/TOSArray</code></dt>
+<dd>
+First element is the width, next is the height, followed by pairs X, then Y, of the turn-on-sequence of the threshold array. This information can be used to construct a threshold array with a transfer function "pickled into" the threshold array, which is useful if the turn-on-sequence has more than 256 pairs. Refer to toolbin/halftone/thresh_remap for more information.</dt>
+</dd>
<dl>
-<dt>/ThreshString: first two bytes are width (high byte first), next two bytes are height, followed by the
-threshold array bytes (same as /Thresholds of the Type3 dictionary).</dt>
-<dt>/TOSArray: first element is the width, next is the height, followed by pairs X, then Y, of the turn-on-sequence of the threshold array. This information can be used to construct a threshold array with a transfer function "pickled into" the threshold array, which is useful if the turn-on-sequence has more than 256 pairs. Refer to toolbin/halftone/thresh_remap for more information.</dt>
</dl>
</dl>
+</dd>
</dl>
<dl>
<dt><a name=".shellarguments"></a>
<code>.shellarguments</code></dt>
-<dd>This operator is used to access the ARGUMENTS command line option. See examples in lib for more information.</dd>
+<dd>
+<p>This operator is used to access the ARGUMENTS command line option.
+<p>Relies on Ghostscript being called with the "--" command
+line option - see <a href="Use.htm#Input_control">Input Control</a>
+<p>See examples in lib for more information.
+</dd>
</dl>
@@ -975,7 +1029,7 @@ palette must contain exactly 2, 4, 16, or 256 entries, and must contain an
entry for black and an entry for white; if it contains any entries that
aren't black, white, or gray, it must contain at least the six primary
colors (red, green, blue, and their complements cyan, magenta, and yellow);
-aside from this, its contents are arbitrary.</dd>
+aside from this, its contents are arbitrary.
<p>
Alternatively, palette can be 16, 24, 32, or null (equivalent to 24).
@@ -1001,6 +1055,7 @@ These are interpreted as:</p>
Note that one can also make an image device (with the same palette as an
existing image device) by copying a device using the
<code>copydevice</code> operator.</p>
+</dd>
</dl>
<dl>
@@ -1183,7 +1238,7 @@ See the Adobe <a href="http://partners.adobe.com/public/developer/pdf/index_refe
<dt><code><source> <dict> /PNGPredictorDecode filter <file></code></dt>
<p><dd>Implements the "filter" algorithms of the
<a href="http://www.libpng.org/pub/png/">Portable Network Graphics (PNG)
-graphics format</a>. Recognized keys are:</dd></p>
+graphics format</a>. Recognized keys are:</p>
<blockquote><table>
<tr><th colspan="5">Keys recognized in PNG filter algorithms</th></tr>
@@ -1225,6 +1280,7 @@ specification</p>
<blockquote>
<a href="http://www.w3.org/TR/WD-png-960128.html">http://www.w3.org/TR/WD-png-960128.html</a>
</blockquote>
+</dd>
</dl>
<dl>
@@ -1378,9 +1434,10 @@ or the implementation.</dd>
<dt><code>TextAlphaBits, GraphicsAlphaBits (usually read-only)</code></dt>
<dd>The number of bits of anti-aliasing information for text or graphics
respectively. Legal values are 1 (no anti-aliasing, the default for most
-devices), 2, or 4.</dd>
+devices), 2, or 4.
<p>Because this feature relies upon rendering the input it is incompatible, and will generate
an error on attempted use, with any of the vector output devices.</p>
+</dd>
</dl>
<p>
@@ -1428,11 +1485,12 @@ For raster printers and image format (jpeg*, tiff*, png* ...) devices these
page device parameters are also defined:</b></p>
<dl>
<dt><code>MaxBitmap <integer></code></dt>
-<dd>Maximum space for a full page raster image (bitmap) in memory.</dd>
+<dd>Maximum space for a full page raster image (bitmap) in memory.
<p>This value includes the space for padding raster lines and for an array of
pointers for each raster line, thus the <code>MaxBitmap</code> value to allow
a given PageSize of a specific number of bits per pixel to be rendered in a
full page buffer may be somewhat larger than the bitmap size alone.</p>
+</dd>
</dl>
<dl>
@@ -1441,13 +1499,14 @@ full page buffer may be somewhat larger than the bitmap size alone.</p>
Since <code>memory</code> is always included, specifying <code>-sBandListStorage=memory</code>
when the default is <code>file</code> will use memory based storage for the
band list of the page. This is primarily intended for testing, but if the disk I/O is
-slow, band list storage in memory may be faster.</dd>
+slow, band list storage in memory may be faster.
+</dd>
</dl>
<dl>
<dt><code>BufferSpace <integer></code></dt>
<dd>Size of the buffer space for band lists, if the full page raster image
-(bitmap) is larger than <code>MaxBitmap</code> (see above.)</dd>
+(bitmap) is larger than <code>MaxBitmap</code> (see above.)
<p>The buffer space is used to collect display list (clist) commands for the
bands and then to consolidate those commands when writing the clist to the
@@ -1457,6 +1516,7 @@ is large enough, the display list (clist) will consist of a single band.</p>
<p>The <code>BufferSpace</code> will determine the size of the 'consolidation'
buffer (above) even if the <code>MaxBitmap</code> value is low enough to force
banding/clist mode.</p>
+</dd>
</dl>
<dl>
@@ -1465,7 +1525,7 @@ banding/clist mode.</p>
the page rendering and output can be performed in a background thread.
The default value, <code>false</code>, causes the rendering and printing to be
done in the same thread as the parser. When <code>-dBGPrint=true</code>, the
-page output will be overlapped with parsing and writing the clist for the next page.</dd>
+page output will be overlapped with parsing and writing the clist for the next page.
<p>If the device does not support background printing, rendering and printing will
be performed as if <code>-dBGPrint=false</code>.</p>
<p>Note that the background printing thread will allocate a band buffer (size determined
@@ -1476,6 +1536,7 @@ will use the specified number of rendering threads as children of the background
thread. The background printing thread will perform any processing of the raster data
delivered by the rendering threads. Note that BGPrint is disabled for vector devices such as pdfwrite
and NumRenderingThreads has no effect on these devices eitehr.</p>
+</dd>
</dl>
<dl>
@@ -1485,7 +1546,7 @@ during writing of the clist, the color processing logic collects information abo
colors used <b>before</b> the device color profile is applied. This allows special devices
that examine <code>dev->icc_struct->pageneutralcolor</code> with the information that all
colors on the page are near <i>neutral</i>, i.e. monochrome, and converting the rendered
-raster to gray may be used to reduce the use of color toners/inks.</dd>
+raster to gray may be used to reduce the use of color toners/inks.
<p>
Since the determination of whether or not the page uses colors is determined before the
conversion to device colors, this information is independent of the device output profile.
@@ -1529,6 +1590,7 @@ for no benefit.</p>
<p>
Since GrayDetection=true is only effective when in clist (banding) mode, it is recommended
to also force banding. For example: <b><tt>-dGrayDetection=true -dMaxBitmap=0</tt></b></p>
+</dd>
</dl>
<dl>
@@ -1537,7 +1599,7 @@ to also force banding. For example: <b><tt>-dGrayDetection=true -dMaxBitmap=0</t
in separate threads. The default value, 0, causes the rendering of bands to be
done in the same thread as the parser and device driver. <code>NumRenderingThreads</code>
of 1 or higher results in bands rendering in the specified number of 'background'
-threads.</dd>
+threads.
<p>The number of threads should generally be set to the number of available
processor cores for best throughput.</p>
<p>Note that each thread will allocate a band buffer (size determined by the
@@ -1547,6 +1609,7 @@ the band buffer in the 'main' thread.</p>
render to a bitmap output, such as the vector devices (eg pdfwrite) and has no effect
when rendering, but not using a clist. See <a href="Use.htm#Improving_performance">Improving_performance</a>
</p>
+</dd>
</dl>
<dl>
@@ -1556,10 +1619,11 @@ the file name for output; <code>%d</code> is replaced by the page number
for page-oriented output devices;
on Unix systems <code>%pipe%</code><em>command</em> writes to a pipe.
(<code>|</code><em>command</em> also writes to a pipe, but is now
-deprecated). Also see the <code>-o</code> parameter.</dd>
+deprecated). Also see the <code>-o</code> parameter.
<p>
Attempts to set this parameter if <code>.LockSafetyParams</code> is true
will signal an <code>invalidaccess</code> error.</p>
+</dd>
</dl>
<dl>
@@ -1643,7 +1707,7 @@ parameters cannot be changed. Attempts to change any of the values
when LockFilePermissions is <tt>true</tt> will signal <code>invalidaccess</code>.
Also, when this value is <tt>true</tt>, the <code>file</code> operator
will give <code>invalidaccess</code> when attempting to open files
-(processes) using the <code>%pipe</code> device.</dd>
+(processes) using the <code>%pipe</code> device.
<p>
Also when <code>LockFilePermissions</code> is <tt>true</tt>, strings
cannot reference the parent directory (platform specific). For example
@@ -1652,6 +1716,7 @@ and Macintosh, and <code>([.#.#.XYZ])</code> is illegal on VMS.</p>
<p>
This parameter is set <tt>true</tt> by the <code>.setsafe</code> and
<code>.locksafe</code> operators.</p>
+</dd>
</dl>
<dl>
@@ -1664,7 +1729,7 @@ operations are <code>deletefile</code> and <code>renamefile</code>.
For <code>renamefile</code>, the filename for the current filename
must match one of the paths on the PermitFileControl list, and the
new filename must be on <b>both</b> the PermitFileControl and the
-PermitFileWriting lists of paths.</dd>
+PermitFileWriting lists of paths.
<p>
The strings can contain wildcard characters as for the <code>filenameforall</code>
operator and unless specifying a single file, will end with a <b>*</b>
@@ -1689,6 +1754,7 @@ anywhere and cannot be deleted or renamed except for files created with the
SAFER mode in release versions before 7.11 and corresponds to the use of
<code>-dPARANOIDSAFER</code> in version 7.04 (up to and not including
version 7.10) and GPL versions 6.53 (up to and not including 6.60).</p>
+</dd>
</dl>
<dl>
@@ -1710,7 +1776,7 @@ may be overridden by the command line argument
<dd>Control the use of True Type grid fitting.
Ghostscript, by default, uses Freetype for rendering Truetype (and most other) glyphs
(but other scaler/renderer libraries can be used), thus has access to a complete Truetype
-bytecode interpreter.</dd>
+bytecode interpreter.
<p>
This parameter controls the hinting of Truetype glyphs.</p>
<ul>
@@ -1737,6 +1803,7 @@ With Freetype, a value of 3 is effectively equivalent to 1.
This parameter defaults to 1, but this
may be overridden on the command line with
<code>-dGridFitTT=n</code>.</p>
+</dd>
</dl>
<hr>
diff --git a/doc/Use.htm b/doc/Use.htm
index d1f5489..6a2bf55 100644
--- a/doc/Use.htm
+++ b/doc/Use.htm
@@ -626,12 +626,13 @@ Ghostscript is normally built to interpret both PostScript and PDF files, examin
<dd>Rather than selecting a PageSize given by the PDF MediaBox, BleedBox (see -dUseBleedBox),
TrimBox (see -dUseTrimBox), ArtBox (see -dUseArtBox), or CropBox (see -dUseCropBox),
the PDF file will be scaled to fit the current device page size
-(usually the default page size).</dd>
+(usually the default page size).
<p>
This is useful for creating fixed size images of PDF files that may have
a variety of page sizes, for example thumbnail images.</p>
<p>
This option is also set by the <code>-dFitPage</code> option.</p>
+</dd>
</dl>
<dl>
@@ -759,21 +760,21 @@ be drawn, whilst those not listed will not be drawn.</p>
</dl>
<dl>
- <dt><code>-sPageList=</code><em>pagenumber</em>
- <dd>There are three possible values for this; even, odd or a list of pages to be processed.
- A list can include single pages or ranges of pages.
- Ranges of pages use the minus sign '-', individual pages and ranges of pages are separated
- by commas ','. A trailing minus '-' means process all remaining pages. For example;</dd></dt>
+ <dt><code>-sPageList=</code><em>pagenumber</em></dt>
+
+<dd>There are three possible values for this; even, odd or a list of pages to be processed.
+A list can include single pages or ranges of pages.
+Ranges of pages use the minus sign '-', individual pages and ranges of pages are separated
+by commas ','. A trailing minus '-' means process all remaining pages. For example;
<p><blockquote><pre>
-sPageList=1,3,5 indicates that pages 1, 3 and 5 should be processed.
-sPageList=5-10 indicates that pages 5, 6, 7, 8, 9 and 10 should be processed.
-sPageList=1,5-10,12- indicates that pages 1, 5, 6, 7, 8, 9, 10 and 12 onwards should be processed.
</pre></blockquote>
-<dd>Note: Use of PageList overrides FirstPage and/or LastPage, if you set these as well as PageList they will be ignored. The
+Note: Use of PageList overrides FirstPage and/or LastPage, if you set these as well as PageList they will be ignored. The
list of pages should be given in increasing order, you cannot process pages out of order and inserting higher numbered pages before lower numbered
- pages in the list will generate an error. </dd>
+ pages in the list will generate an error.
</p>
-</dl>
<p>The PDF interpreter and the other language interpreters handle these in slightly different ways. Because
PDF files enable random access to pages in the document the PDF inerpreter only interprets and renders
@@ -795,6 +796,8 @@ is applied to each PDF file separately. So if you were to set <code>-sPageList=1
exercise caution when using this switch, and probably should not use it at all when processing a mixture of PostScript
and PDF files on the same command line.
</p>
+</dd>
+</dl>
<h3><a name="PDF_problems"></a>Problems interpreting a PDF file</h3>
@@ -2203,12 +2206,13 @@ contains just the word "<code>quit</code>", then
<code>-c quit</code> on the command line is equivalent to
<code>quit.ps</code> there. Each argument must be valid PostScript,
either individual tokens as defined by the <code>token</code> operator,
- or a string containing valid PostScript.</dd>
+ or a string containing valid PostScript.
<p>
Because Ghostscript must initialize the PostScript environment
before executing the commands specified by this option it should
be specified after other setup options. Specifically this option
'bind's all operations and sets the systemdict to readonly.</p>
+</dd>
</dl>
<dl>
@@ -2297,8 +2301,7 @@ whereas <code>-sXYZ=35</code> is equivalent to</p>
<dl>
<dt><code>-u</code><em>name</em></dt>
- <dd>Un-define a name, cancelling <code>-d</code> or <code>-s</code>.</dd>
-</dl>
+ <dd>Un-define a name, cancelling <code>-d</code> or <code>-s</code>.
<p>
Note that the initialization file <code>gs_init.ps</code> makes
@@ -2309,6 +2312,8 @@ superseded by definitions in <code>userdict</code> or other dictionaries.
However, device parameters set this way (<code>PageSize</code>,
<code>Margins</code>, etc.) are <em>not</em> read-only, and <em>can</em>
be changed by code in PostScript files.</p>
+</dd>
+</dl>
<dl>
<dt><code>-g</code><em>number1</em><code>x</code><em>number2</em></dt>
@@ -2317,7 +2322,8 @@ be changed by code in PostScript files.</p>
width and height in pixels for the benefit of devices such as X11 windows
and VESA displays that require (or allow) you to specify width and height.
Note that this causes documents of other sizes to be clipped, not scaled:
- see <code>-dFIXEDMEDIA</code> below.</dd>
+ see <code>-dFIXEDMEDIA</code> below.
+</dd>
</dl>
<dl>
@@ -2381,7 +2387,7 @@ the actual device resolution. Reasonable values for <em>lpi</em> are
<dl>
<dt><code>-dInterpolateControl=</code><em>control_value</em></dt>
- <dd>This allows control of the image interpolation.</dd>
+ <dd>This allows control of the image interpolation.
<p>
By default <code>InterpolateControl</code> is 1 and the image rendering
@@ -2424,22 +2430,26 @@ to scale the contributions for each output pixel. When upscaling, every output
pixel ends up being the weighted sum of 16 input pixels, When downscaling more
source pixels will contribute to the interpolated pixels. Every source pixel has
some effect on the output pixels.</p>
+</dd>
</dl>
<dl>
-<code>-dDOINTERPOLATE</code>
+<dt><code>-dDOINTERPOLATE</code></dt>
<dd>This option still works, but is deprecated, and is the equivalent of
<code>-dInterpolateControl=-1</code>.</dd>
</dl>
<dl>
-<code>-dNOINTERPOLATE</code> This option still works, but is deprecated and is
+<dt><code>-dNOINTERPOLATE</code></dt>
+<dd>
+This option still works, but is deprecated and is
the equivalent of <code>-dInterpolateControl=0</code>
+</dd>
</dl>
<dl>
<dt><code>-dTextAlphaBits=</code><em>n</em></dt>
<dt><code>-dGraphicsAlphaBits=</code><em>n</em></dt>
<dd>These options control the use of subsample antialiasing. Their use is highly recommended for producing high quality rasterizations. The subsampling box size <em>n</em> should be 4 for optimum output, but smaller values can be used for faster rendering. Antialiasing is enabled separately for text and graphics content.
- Allowed values are 1, 2 or 4.</dd>
+ Allowed values are 1, 2 or 4.
<p>
Note that because of the way antialiasing blends the edges of shapes into the background when
they are drawn some files that rely on joining separate filled polygons together to cover
@@ -2448,6 +2458,7 @@ strange lines within solid areas, try rendering that file again with
<code>-dGraphicsAlphaBits=1</code>.</p>
<p>Further note; because this feature relies upon rendering the input it is incompatible, and will generate
an error on attempted use, with any of the vector output devices.</p>
+</dd>
</dl>
<dl>
@@ -2457,7 +2468,7 @@ or to subpixels (value 0). Subpixels are a smaller raster grid
which is used internally for text antialiasing.
The number of subpixels in a pixel usually is <code>2^TextAlphaBits</code>,
but this may be automatically reduced for big characters to save space
- in character cache.</dd>
+ in character cache.
<p>
The parameter has no effect if <code>-dTextAlphaBits=1</code>.
@@ -2466,6 +2477,7 @@ Default value is 0.</p>
<p>
Setting <code>-dAlignToPixels=0</code> can improve rendering
of poorly hinted fonts, but may impair the appearance of well-hinted fonts.</p>
+</dd>
</dl>
<dl>
@@ -2572,18 +2584,17 @@ processing of PostScript source files. Note: in releases 7.30 and
</dl>
<dl>
-<dt><code>-sPageList=</code><em>pagenumber</em>
-There are three possible values for this; even, odd or a list of pages to be processed.
+<dt><code>-sPageList=</code><em>pagenumber</em></dt>
+<dd>There are three possible values for this; even, odd or a list of pages to be processed.
A list can include single pages or ranges of pages.
Ranges of pages use the minus sign '-', individual pages and ranges of pages are separated
- by commas ','. A trailing minus '-' means process all remaining pages. For example;</dt>
+ by commas ','. A trailing minus '-' means process all remaining pages. For example;
<p><blockquote><pre>
-sPageList=1,3,5 indicates that pages 1, 3 and 5 should be processed.
-sPageList=5-10 indicates that pages 5, 6, 7, 8, 9 and 10 should be processed.
-sPageList=1, 5-10, 12- indicates that pages 1, 5, 6, 7, 8, 9, 10 and 12 onwards should be processed.
</pre></blockquote>
</p>
-</dl>
<p>The PDF interpreter and the other language interpreters handle these in slightly different ways. Because
PDF files enable random access to pages in the document the PDF inerpreter only interprets and renders
@@ -2605,6 +2616,8 @@ is applied to each PDF file separately. So if you were to set <code>-sPageList=1
exercise caution when using this switch, and probably should not use it at all when processing a mixture of PostScript
and PDF files on the same command line.
</p>
+</dd>
+</dl>
<dl>
<dt><a name="FIXEDMEDIA"></a><code>-dFIXEDMEDIA</code></dt>
@@ -2629,10 +2642,11 @@ or one of the older <code>statusdict</code> page size operators (such as
<code>letter</code> or <code>a4</code>) will be rotated, scaled and centered on the
"best fit" page size from those availiable in the InputAttributes list.
The <code>-dPSFitPage</code> is most easily used to fit pages when used with the
- <code>-dFIXEDMEDIA</code> option.</dd>
+ <code>-dFIXEDMEDIA</code> option.
<p>
This option is also set by the <code>-dFitPage</code> option.</p>
+</dd>
</dl>
<dl>
@@ -2671,10 +2685,11 @@ the default size).
<dl>
<dt><code>-dFitPage</code></dt>
<dd>This is a "convenience" operator that sets the various options to perform
- page fitting for specific file types.</dd>
+ page fitting for specific file types.
<p>
This option sets the <code>-dEPSFitPage</code>, <code>-dPDFFitPage</code>, and
the <code>-dFitPage</code> options.</p>
+</dd>
</dl>
<h4><a name="Font_related_parameters"></a>Font-related parameters</h4>
@@ -2749,20 +2764,12 @@ limiting all future users of the document to the same approximate
rendering.</dd>
</dl>
-<dl>
- <dt><code>-dOLDCFF</code></dt>
-<dd>Reverts to using the old, sequential, PostScript CFF parser.
-New CFF parser is coded in C and uses direct access to the font data.
-This option and the old parser will be removed when the new parser
- proves its reliability.</dd>
-</dl>
-
<h4><a name="Resource_related_parameters"></a>Resource-related parameters</h4>
<dl>
<dt><a name="GenericResourceDir"></a><code>-sGenericResourceDir=path</code></dt>
<dd>Specifies a path to resource files.
- The value is platform dependent. It must end with a directory separator.</dd>
+ The value is platform dependent. It must end with a directory separator.
<p>
<b><font size="+1">
A note for Windows users, Artifex recommends the use of the
@@ -2788,16 +2795,18 @@ The extended search method does not call <code>ResourceFileName</code> .</p>
<p>
Default value is <code>(./Resource/)</code> for Unix, and an equivalent one on other
platforms.</p>
+</dd>
</dl>
<dl>
<dt><a name="FontResourceDir"></a><code>-sFontResourceDir=path</code></dt>
<dd>Specifies a path where font files are installed.
- It's meaning is similar to <code>GenericResourceDir</code>.</dd>
+ It's meaning is similar to <code>GenericResourceDir</code>.
<p>
Default value is <code>(./Font/)</code> for Unix, and an equivalent one on other
platforms.</p>
+</dd>
</dl>
@@ -2852,12 +2861,13 @@ directly into Ghostscript, as long as the data doesn't refer to
<code>stderr</code>, to avoid it being mixed with device stdout.
To redirect stdout to stderr use <code>-sstdout=%stderr</code>.
To cancel redirection of stdout use <code>-sstdout=%stdout</code>
- or <code>-sstdout=-</code>.</dd>
+ or <code>-sstdout=-</code>.
<p>
Note that this redirects PostScript output to %stdout but <b>does not</b>
change the destination FILE of device output as with <code>-sOutputFile=-</code>
or even <code>-sOutputFile=%stdout</code> since devices write directly using
the stdout FILE * pointer with C function calls such as fwrite or fputs.</p>
+</dd>
</dl>
<dl>
@@ -2867,14 +2877,6 @@ Causes Ghostscript to read a character from <code>/dev/tty</code>,
rather than standard input, at the end of each page. This may be useful if
input is coming from a pipe. Note that <code>-dTTYPAUSE</code>
overrides <code>-dNOPAUSE</code>.
-
-Also note that <code>-dTTYPAUSE</code> requires opening the terminal
-device directly, and may cause problems in combination with -dSAFER.
-Permission errors can be avoided by adding the device to the permitted
-reading list before invoking safer mode. For example:
-<code>gs -dTTYPAUSE -dDELAYSAFER
--c '<< /PermitFileReading [ (/dev/tty)] >>
- setuserparams .locksafe' -dSAFER</code></dd>
</dl>
<h4><a name="Output_selection_parameters"></a>Device and output selection parameters</h4>
@@ -2914,7 +2916,7 @@ ignore a request to print multiple copies, giving more consistent
<dd>Raster printers and image formats that can use the "command list" (clist)
to store a representation of the page prior to rendering can use the
<code>--saved-pages=</code><em>string</em> on the command line for
- deferred rendering of pages.</dd>
+ deferred rendering of pages.
<p>
Pages that are <em>saved</em> instead of printed are retained until the
list of saved pages is emptied by the <code>flush</code> command of the
@@ -2927,6 +2929,7 @@ printed multiple times, in any order.</p>
<p>
Refer to the <a href="SavedPages.htm">SavedPages</a> document for
details.</p>
+</dd>
</dl>
<h4><a name="EPS_parameters"></a>EPS parameters</h4>
@@ -2940,16 +2943,18 @@ details.</p>
<dl>
<dt><code>-dEPSFitPage</code></dt>
<dd>Resize an EPS file to fit the page.
- This is useful for shrinking or enlarging an EPS file to fit the paper size when printing.</dd>
+ This is useful for shrinking or enlarging an EPS file to fit the paper size when printing.
<p>
This option is also set by the <code>-dFitPage</code> option.</p>
+</dd>
</dl>
<dl>
<dt><code>-dNOEPS</code></dt>
<dd>Prevent special processing of EPS files.
This is useful when EPS files have incorrect Document
- Structuring Convention comments.</dd>
+ Structuring Convention comments.
+</dd>
</dl>
<h4><a name="ICC_color_parameters"></a>ICC color parameters</h4>
@@ -3285,7 +3290,7 @@ not make use of these output intents. Instead, if desired, these standard
<dl>
<dt><code>-sUseOutputIntent=</code><em>string</em></dt>
<dd>Like <code>UsePDFX3Profile</code> above, this option enables rendering with an output intent defined in the
- PDF source file.</dd>
+ PDF source file.
<p>
This option behaves the same way as the <code>UsePDFX3Profile</code>, but the selection criteria are different.
Because its possible (as of PDF 2.0) for each page to have a different array, its not sufficient just to supply
@@ -3297,12 +3302,13 @@ then it should be Custom and the <code>UseOutputIntent</code> string will be mat
<code>Info</code> key instead. If the <code>OutputConditionIdentifier</code> or <code>Info</code> matches the
value of <code>UseOuttpuIntent</code>, then that OutputIntent is selected <b>if</b> the OutputIntent contains
a <code>DestOutputProfile</code> key.</p>
+</dd>
</dl>
<dl>
<dt><code>-sICCProfilesDir=</code><em>path</em></dt>
<dd>Set a directory in which to search for the above profiles.
- The directory path must end with a file system delimiter.</dd>
+ The directory path must end with a file system delimiter.
<p>
If the user doesn't use the -sICCProfilesDir= command line option,
Ghostscript creates a default value for it by looking on the
@@ -3327,6 +3333,7 @@ the Microsoft C startup code. See
<a href="http://msdn.microsoft.com/en-us/library/a1y7w461.aspx">Parsing C Command-Line Arguments</a>
for more information.
</font></b></p>
+</dd>
</dl>
<h4><a name="Other_parameters"></a>Other parameters</h4>
@@ -3375,7 +3382,7 @@ server. The <code>-dNOOUTERSAVE</code> switch is ignored if <code>-dJOBSERVER</c
is specified since job servers <b>always</b> execute the input PostScript
under a save level, although the <code>exitserver</code> operator can
be used to escape from the encapsulated job and execute as if the
- <code>-dNOOUTERSAVE</code> was specified.</dd>
+ <code>-dNOOUTERSAVE</code> was specified.
<p>
This also requires that the input be from stdin, otherwise an error will
result (<code>Error: /invalidrestore in --restore--</code>).</p>
@@ -3391,6 +3398,7 @@ Binary Communication Protocol) to cause an out-of-band <code>^D</code> to
signal EOF in a stream input data. This means that direct file actions
on stdin such as <code>flushfile</code> and <code>closefile</code>
will affect processing of data beyond the <code>^D</code> in the stream.</p>
+</dd>
</dl>
<dl>
@@ -3425,17 +3433,131 @@ system permissions.</dd>
<p><b>This mode should be used with caution, and <code>.setsafe</code> should be
run prior to running any PostScript file with unknown contents.</b></p>
</dl>
-
<a name="Safer"></a>
<dl>
<dt><code>-dSAFER</code></dt>
-<dd>Disables the <code>deletefile</code> and <code>renamefile</code>
+<dd>
+Enables access controls on files. Access controls fall into three catagories,
+files from which Ghostscript is permitted to read, ones to which it is permitted
+to write, and ones over which it has "control" (i.e. delete/rename). These
+access controls apply to <strong>all</strong> files accessed via Ghostscript's internal
+interface to the C library file handling. Whilst we have taken considerable pains to
+ensure that all the code we maintain (as well as the so called "contrib" devices,
+that are devices included in our release packages, but not strictly maintained by the
+Ghostscript development team) uses this interface, we have no control over thirdparty
+code.
+<p>
+This is an entirely new implementation of <code>SAFER</code> for Ghostscript versions
+9.28 and later. Earlier versions (see "<a href="#OldSafer">-dOLDSAFER</a>") relied on
+storing the file permission lists in Postscript VM (Virtual Memory), and only applied
+file access permissions to the Postscript file related operators. It relied on restricting
+the function of <code>setpagedevice</code> to avoid the device code from being manipulated
+into opening arbitrary files. The application of the file permissions was done within the
+internal context of the Postscript interpreter, and some other aspects of the Postscript
+restrictions were applied in the Postscript environment. With so many of the feature's
+capabilities relying on the Postscript context and environment, by using other (Ghostscript
+specific) features maliciously, the restrictions could be overridden.
+<p>
+Whilst the path storage and application of the permissions is implemented entirely in C,
+it is still possible for Postscript to add and remove paths from the permissions lists
+(see <a href="Language.htm#.addcontrolpath">.addcontrolpath</a>) until such time as the
+access controls are enabled (see <a href="Language.htm#.activatepathcontrol">.activatepathcontrol</a>),
+any call to <code>.addcontrolpath</code> after <code>.activatepathcontrol</code> will result in a
+<code>Fatal</code> error causing the interpreter to immediately exit.
+<p>
+An incompatibility exists between the pre-9.28 and 9.28 and later <code>SAFER</code>.
+By removing storage and application entirely from the Postscript language
+environment and internal context, SAFER is no longer affected by Postscript
+<code>save</code>/<code>restore</code> operations. Previously, it was possible
+to do the equivalent of:
+<blockquote>
+<br><code>save</code>
+<br><code>.setsafe</code>
+<br><code>Postscript ops</code>
+<br><code>restore</code>
+</blockquote>
+<p>
+In that sequence, then <code>Postscript ops</code> would run with <code>SAFER</code> protection
+but after the restore, <code>SAFER</code> would no longer be in force. This is no longer the case.
+After the call to <code>.setsafe</code> the file controls are in force until the
+interpter exits. As the 9.28 and later implementation no longer restricts the
+operation of <code>setpagedevice</code>, and because this capability is <i>extremely</i>
+rarely used, we feel the improvement in security warrants the small reduction in
+flexibility.
+<p>
+Path matching is simple: we do not implement full featured "globbing" or
+regular expression matching (such complexity would significantly and negatively
+impact performance). The following cases are handled:
+<ul>
+<li>
+<dt><code>"/path/to/file"</code></dt>
+<p>Permits access only to the file: "/path/to/file"
+</li>
+<li>
+<dt><code>"/path/to/directory/"</code></dt>
+<p>Permits access to any file in, and only in, the directory: "/path/to/directory"
+</li>
+<li>
+<dt><code>"/path/to/directory/*"</code></dt>
+<p>Permits access to any file in the directory: "/path/to/directory" and
+any child of that directory.
+</li>
+</ul>
+<p>
+Four command line parameters permit explicit control of the paths included in
+the access control lists:
+<ul>
+<li><dt><code>--permit-file-read<code></dt>
+<p> Adds a path, or list of paths, to the "permit read" list. A list
+of paths is a series of paths separated by the appropriate path list separator
+for your platform (for example, on Unix-like systems it is ":"
+and on MS Windows it is ";").
+</li>
+<li><dt><code>--permit-file-write<code></dt>
+<p> Adds a path, or list of paths, to the "permit write" list. A list
+of paths is a series of paths separated by the appropriate path list separator
+for your platform (for example, on Unix-like systems it is ":"
+and on MS Windows it is ";").
+</li>
+<li><dt><code>--permit-file-control<code></dt>
+<p> Adds a path, or list of paths, to the "permit control" list. A list
+of paths is a series of paths separated by the appropriate path list separator
+for your platform (for example, on Unix-like systems it is ":"
+and on MS Windows it is ";").
+</li>
+<li><dt><code>--permit-file-all<code></dt>
+<p> Adds a path, or list of paths, to the all the above lists. A list
+of paths is a series of paths separated by the appropriate path list separator
+for your platform (for example, on Unix-like systems it is ":"
+and on MS Windows it is ";").
+</li>
+</ul>
+<p>
+Finally, paths supplied on the command line (such as those in <code>-I</code>,
+<code>-sFONTPATH</code> parameters) are added to the permitted reading list.
+Similarly, paths read during initialisation from <code>Fontmap</code>, <code>cidfmap</code>,
+and the platform specific font file enumeration (i.e. <code>fontconfig</code> on Unix systems)
+are automatically added to the permit read lists.
+</dd>
+</dl>
+<br>
+<a name="OldSafer"></a>
+<dl>
+ <dt><code>-dOLDSAFER</code></dt>
+<dd>
+<strong>NOTE: This enables deprecated code which will shortly be removed</strong>
+<p>Used in combination with <code>-dSAFER</code> (or <code>.setsafe</code>) enables
+the pre-9.28 SAFER implementation. It is included (for now) in case any users find
+a case where the 9.28 and later <code>SAFER</code> does not work for them. It means
+such users can keep working until we have assessed the issue, and distributed a solution.
+<p>
+Disables the <code>deletefile</code> and <code>renamefile</code>
operators, and the ability to open piped commands (<code>%pipe%</code><em>cmd</em>)
at all. Only <code>%stdout</code> and <code>%stderr</code> can be opened
for writing. Disables reading of files other than <code>%stdin</code>,
those given as a command line argument, or those contained on one of the paths
given by LIBPATH and FONTPATH and specified by the system params /FontResourceDir
- and /GenericResourceDir.</dd>
+ and /GenericResourceDir.
<p>
This mode also sets the <a href="Language.htm#LockSafetyParams">.LockSafetyParams</a>
parameter of the default device, or the device specified with the <code>-sDEVICE= </code>
@@ -3456,6 +3578,7 @@ When running -dNOSAFER it is possible to perform a <code>save</code>,
followed by <code>.setsafe</code>, execute a file or procedure in SAFER mode,
then use <code>restore</code> to return to NOSAFER mode. It is possible that the
a crafted foreign file could restore back to a point when NOSAFER was in operation.</p>
+</dd>
</dl>
<dl>
diff --git a/doc/VectorDevices.htm b/doc/VectorDevices.htm
index c939fdd..74dabed 100644
--- a/doc/VectorDevices.htm
+++ b/doc/VectorDevices.htm
@@ -528,7 +528,7 @@ For example, including the PostScript string in your file <tt>in.ps</tt>:
is equivalent to invoking:
<blockquote><code>gs -dBATCH -dSAFER -DNOPAUSE -q -sDEVICE=pdfwrite -sOutputFile=out.pdf -c
-'.setpdfwrite <</AlwaysEmbed [/Helvetica /Times-Roman]>> setdistillerparams' -f
+'<</AlwaysEmbed [/Helvetica /Times-Roman]>> setdistillerparams' -f
in.ps</code></blockquote>
or using the extra parameters in a file:
diff --git a/doc/style.css b/doc/style.css
index 5985d51..8978b86 100644
--- a/doc/style.css
+++ b/doc/style.css
@@ -43,6 +43,10 @@ p {
font-size: 14px;
}
+dt {
+ font-weight: 600;
+ }
+
h1 {
margin-top: 0px;
margin-bottom: 14px;
----------------------------------------------------------------------
commit 79a06b45e784e6839b2b2129cd2620ea606254e1
Author: Chris Liddell <[email protected]>
Date: Tue Aug 13 14:40:45 2019 +0100
Enable new 'SAFER' protection by default.
We'll now run by default with file access controls enabled. SAFER (and
.setsafe) now *only* enables file access controls. The old SAFER functionality
is (temporarily) available by specifying "-dSAFER -dOLDSAFER" on the command
line, or "-dOLDSAFER" before the call to .setsafe.
diff --git a/Resource/Init/gs_init.ps b/Resource/Init/gs_init.ps
index 8620f53..2e37db0 100644
--- a/Resource/Init/gs_init.ps
+++ b/Resource/Init/gs_init.ps
@@ -182,8 +182,7 @@ currentdict /DELAYSAFER known { /DELAYSAFER //true def /NOSAFER //true def } if
/SAFER currentdict /NOSAFER known {
//false
} {
- currentdict /SAFER known
- currentdict /PARANOIDSAFER known or % PARANOIDSAFER is equivalent
+ //true
}
ifelse def
@@ -2286,13 +2285,7 @@ currentdict /tempfilepaths undef
%% --- These are documented extensions ---
/.locksafe {
- OLDSAFER
- {
- //.locksafe_userparams exec
- }
- {
- //.lockfileaccess exec
- } ifelse
+ //.locksafe_userparams exec
//systemdict /getenv {pop //false} .forceput
% setpagedevice has the side effect of clearing the page, but
% we will just document that. Using setpagedevice keeps the device
@@ -2306,15 +2299,19 @@ currentdict /tempfilepaths undef
/.setsafe
{
- SAFETY /safe get not {
- <<
- /PermitFileReading [ ]
- /PermitFileWriting [ ]
- /PermitFileControl [ ]
- >> setuserparams
+ OLDSAFER {
+ SAFETY /safe get not {
+ <<
+ /PermitFileReading [ ]
+ /PermitFileWriting [ ]
+ /PermitFileControl [ ]
+ >> setuserparams
+ }
+ if
+ .locksafe
}
- if
- .locksafe
+ {//.lockfileaccess exec}
+ ifelse
} .bind executeonly odef
%% --- End documented extensions ---
@@ -2325,19 +2322,7 @@ currentdict /tempfilepaths undef
% in gs_setpd.ps)
%
/.locksafeglobal {
- OLDSAFER
- {
- //.locksafe_userparams exec
- }
- {
- <<
- /PermitFileReading [(*)]
- /PermitFileWriting [(*)]
- /PermitFileControl [(*)]
- >> setuserparams
- //.lockfileaccess exec
- } ifelse
-
+ //.locksafe_userparams exec
systemdict /getenv {pop //false} put
% setpagedevice has the side effect of clearing the page, but
% we will just document that. Using setpagedevice keeps the device
@@ -2354,15 +2339,20 @@ currentdict /tempfilepaths undef
% See /.locksafeglobal above.
%
/.setsafeglobal {
- SAFETY /safe get not {
- <<
- /PermitFileReading [ ]
- /PermitFileWriting [ ]
- /PermitFileControl [ ]
- >> setuserparams
+ OLDSAFER
+ {
+ SAFETY /safe get not {
+ <<
+ /PermitFileReading [ ]
+ /PermitFileWriting [ ]
+ /PermitFileControl [ ]
+ >> setuserparams
+ }
+ if
+ //.locksafeglobal exec
}
- if
- //.locksafeglobal exec
+ {//.lockfileaccess exec}
+ ifelse
} .bind def
% If we are running in SAFER mode, lock things down
----------------------------------------------------------------------
commit 9883f2a931407503778bb94948b47480eff858b2
Author: Chris Liddell <[email protected]>
Date: Tue Aug 13 08:28:06 2019 +0100
Add null file to the permit writing list
diff --git a/base/gslibctx.c b/base/gslibctx.c
index a27f16e..5cf141c 100644
--- a/base/gslibctx.c
+++ b/base/gslibctx.c
@@ -363,6 +363,8 @@ int gs_lib_ctx_init(gs_lib_ctx_t *ctx, gs_memory_t *mem)
if (gs_lib_ctx_alloc_root_structure(mem, &pio->font_dir_root))
goto Failure;
+ if (gs_add_control_path(mem, gs_permit_file_writing, gp_null_file_name) < 0)
+ goto Failure;
return 0;
----------------------------------------------------------------------
commit 7abf720f46dd9ff6018b7f29141ba0573016d59d
Author: Chris Liddell <[email protected]>
Date: Mon Aug 12 12:21:50 2019 +0100
Use enum values for shutting down the file access lists
diff --git a/base/gslibctx.c b/base/gslibctx.c
index b69d553..a27f16e 100644
--- a/base/gslibctx.c
+++ b/base/gslibctx.c
@@ -425,9 +425,10 @@ void gs_lib_ctx_fin(gs_memory_t *mem)
#ifdef WITH_CAL
cal_fin(ctx->core->cal_ctx, ctx->core->memory);
#endif
- gs_purge_control_paths(ctx->core->memory, 0);
- gs_purge_control_paths(ctx->core->memory, 1);
- gs_purge_control_paths(ctx->core->memory, 2);
+ gs_purge_control_paths(ctx->core->memory, gs_permit_file_reading);
+ gs_purge_control_paths(ctx->core->memory, gs_permit_file_writing);
+ gs_purge_control_paths(ctx->core->memory, gs_permit_file_control);
+
fs = ctx->core->fs;
while (fs) {
gs_fs_list_t *next = fs->next;
----------------------------------------------------------------------
commit d86ecec686d77e69f7c4a10df9da8c4cd8336a03
Author: Chris Liddell <[email protected]>
Date: Fri Aug 9 14:43:17 2019 +0100
Tweak to better handle undefined transparency ops
diff --git a/examples/transparency_example.ps b/examples/transparency_example.ps
index 107c914..82ffada 100644
--- a/examples/transparency_example.ps
+++ b/examples/transparency_example.ps
@@ -1,6 +1,8 @@
%!PS
% Postscript that uses Ghostscript extensions to do simple transparency
+/PageUsesTransparency true def
+
systemdict /.pushpdf14devicefilter known not
{
(\n\n%%%% WARNING: Transparency operations ignored - probably due to using -dSAFER\n\n) print flush
@@ -10,11 +12,12 @@ systemdict /.pushpdf14devicefilter known not
/.poppdf14devicefilter {} bind def
/.setopacityalpha {pop} bind def
/.setshapealpha {pop} bind def
+ /PageUsesTransparency false def
} if
<<
- /PageUsesTransparency true % needed if we are using transparency
+ /PageUsesTransparency PageUsesTransparency % needed if we are using transparency
/CompatibilityLevel 1.4
/PageSpotColors 0
>> setpagedevice % in case we are going to pdfwrite
----------------------------------------------------------------------
commit 7ca1bb5794997e0dba059a5be6f85a9eaefc915d
Author: Chris Liddell <[email protected]>
Date: Thu Aug 8 10:46:39 2019 +0100
Fix gs_add_explicit_control_path()
it was always adding to the "read" list, rather than the list requested by the
parameter.
diff --git a/base/gslibctx.c b/base/gslibctx.c
index 6e57fe0..b69d553 100644
--- a/base/gslibctx.c
+++ b/base/gslibctx.c
@@ -628,7 +628,7 @@ gs_add_explicit_control_path(gs_memory_t *mem, const char *arg, gs_path_control_
int code = 0;
while (code >= 0 && p1 < lim && (p2 = strchr(p1, (int)gp_file_name_list_separator)) != NULL) {
- code = gs_add_control_path_len(mem, gs_permit_file_reading, p1, (int)(p2 - p1));
+ code = gs_add_control_path_len(mem, control, p1, (int)(p2 - p1));
p1 = p2 + 1;
}
if (p1 < lim)
----------------------------------------------------------------------
commit 34dac4d2a1b195536fcb9d796168cd1360c0e500
Author: Chris Liddell <[email protected]>
Date: Thu Aug 8 10:33:18 2019 +0100
Don't bind and undefine .copytree
.copytree is a Postscript proc that calls itself recursively, hence we cannot
bind it nor undefine it.
diff --git a/Resource/Init/gs_setpd.ps b/Resource/Init/gs_setpd.ps
index 6c998ee..0733af0 100644
--- a/Resource/Init/gs_setpd.ps
+++ b/Resource/Init/gs_setpd.ps
@@ -497,7 +497,7 @@ SETPDDEBUG { (Result of putting.) = pstack flush } if
dup length dict exch {
dup type /dicttype eq { .copytree } if 2 index 3 1 roll put
} forall
-} bind def
+} def
/currentpagedevice {
.currentpagedevice {
@@ -1030,12 +1030,12 @@ SETPDDEBUG { (Installing.) = pstack flush } if
/.trysetparams
/.installpagedevice
/.postinstall
- /.copytree
/.defaultdeviceparams
/.makecurrentpagedevice
/.mergespecial
/.requiredattrs
/.applypolicies
+% /.copytree
% /.uninstallpagedevice % (called from C code)
] dup currentdict .undefinternalnames
systemdict .undefinternalnames
----------------------------------------------------------------------
commit 4d53f6ee868205c76950027e76a27f0278513a39
Author: Chris Liddell <[email protected]>
Date: Tue Aug 6 09:32:32 2019 +0100
Tweak the interaction of file permissions and -I
The new file permissions code differentiates between 'path', 'path/' and
'path/*', whilst the old -I code did not.
This slightly modifies how the -I stuff drives the file permissions stuff so it
works (more) like the previous -I behaviour.
The remaining difference is that the new code always treats '*' as a wildcard,
where the old code would permit '*' as a 'real' character in a path.
diff --git a/Resource/Init/gs_init.ps b/Resource/Init/gs_init.ps
index c2bd754..8620f53 100644
--- a/Resource/Init/gs_init.ps
+++ b/Resource/Init/gs_init.ps
@@ -2220,10 +2220,12 @@ readonly def
[
//tempfilepaths (*) .generate_dir_list_templates
/FONTPATH .systemvar (*) .generate_dir_list_templates
- .languagelevel 2 ge {
+ /level2dict where {
+ pop
% Default resources :
[ currentsystemparams /GenericResourceDir get] (*) .generate_dir_list_templates
} if
+ /LIBPATH .systemvar (*) .generate_dir_list_templates
currentuserparams /ICCProfilesDir known {
[currentuserparams /ICCProfilesDir get] (*)
.generate_dir_list_templates
Summary of changes:
Resource/Init/gs_init.ps | 70 ++++++------
Resource/Init/gs_setpd.ps | 4 +-
base/gslibctx.c | 11 +-
doc/API.htm | 21 ++--
doc/Language.htm | 125 ++++++++++++++++-----
doc/Use.htm | 227 ++++++++++++++++++++++++++++++---------
doc/VectorDevices.htm | 2 +-
doc/style.css | 4 +
examples/transparency_example.ps | 5 +-
9 files changed, 331 insertions(+), 138 deletions(-)