[gs-commits] ghostpdl branch, master, updated. jbig2dec-0.14-1686-gc0df836

The ghostpdl branch, master has been updated
       via  c0df83637a6234f804bef5a7ef31fe1bc5b66d78 (commit)
      from  071b96290c5e524291bb33b132e2cea3efd5f98e (commit)

----------------------------------------------------------------------
commit c0df83637a6234f804bef5a7ef31fe1bc5b66d78
Author: Shailesh Mistry <[email protected]>
Date:   Wed Sep 18 20:40:42 2019 +0100

    Bug 697545 : Prevent SEGV in append_macro.
    
    Prevent SEGV if append_macro is called with a NULL pointer and safe guarded
    calls to chunk_resize_object and chunk_object_size. Also resolved leak when
    resetting macros.
    
    Error created using :-
    MEMENTO_FAILAT=14839 ./membin/gpcl6 -sDEVICE=pbmraw -o /dev/null ./tests_private/pcl/pcl5cfts/fts.1060

diff --git a/base/gsmchunk.c b/base/gsmchunk.c
index 10629b1..f890de0 100644
--- a/base/gsmchunk.c
+++ b/base/gsmchunk.c
@@ -1022,25 +1022,29 @@ chunk_alloc_struct_array(gs_memory_t * mem, size_t num_elements,
 static void *
 chunk_resize_object(gs_memory_t * mem, void *ptr, size_t new_num_elements, client_name_t cname)
 {
-    /* This isn't particularly efficient, but it is rarely used */
-    chunk_obj_node_t *obj = (chunk_obj_node_t *)(((byte *)ptr) - SIZEOF_ROUND_ALIGN(chunk_obj_node_t));
-    size_t new_size = (obj->type->ssize * new_num_elements);
-    size_t old_size = obj->size - obj->padding;
-    /* get the type from the old object */
-    gs_memory_type_ptr_t type = obj->type;
-    void *new_ptr;
-    gs_memory_chunk_t *cmem = (gs_memory_chunk_t *)mem;
-    size_t save_max_used = cmem->max_used;
+    void *new_ptr = NULL;
+
+    if (ptr != NULL) {
+        /* This isn't particularly efficient, but it is rarely used */
+        chunk_obj_node_t *obj = (chunk_obj_node_t *)(((byte *)ptr) - SIZEOF_ROUND_ALIGN(chunk_obj_node_t));
+        size_t new_size = (obj->type->ssize * new_num_elements);
+        size_t old_size = obj->size - obj->padding;
+        /* get the type from the old object */
+        gs_memory_type_ptr_t type = obj->type;
+        gs_memory_chunk_t *cmem = (gs_memory_chunk_t *)mem;
+        size_t save_max_used = cmem->max_used;
+
+        if (new_size == old_size)
+            return ptr;
+        if ((new_ptr = chunk_obj_alloc(mem, new_size, type, cname)) == 0)
+            return NULL;
+        memcpy(new_ptr, ptr, min(old_size, new_size));
+        chunk_free_object(mem, ptr, cname);
+        cmem->max_used = save_max_used;
+        if (cmem->used > cmem->max_used)
+            cmem->max_used = cmem->used;
+    }
 
-    if (new_size == old_size)
-        return ptr;
-    if ((new_ptr = chunk_obj_alloc(mem, new_size, type, cname)) == 0)
-        return 0;
-    memcpy(new_ptr, ptr, min(old_size, new_size));
-    chunk_free_object(mem, ptr, cname);
-    cmem->max_used = save_max_used;
-    if (cmem->used > cmem->max_used)
-        cmem->max_used = cmem->used;
     return new_ptr;
 }
 
@@ -1396,9 +1400,13 @@ chunk_consolidate_free(gs_memory_t *mem)
 static size_t
 chunk_object_size(gs_memory_t * mem, const void *ptr)
 {
-    chunk_obj_node_t *obj = (chunk_obj_node_t *)(((byte *)ptr) - SIZEOF_ROUND_ALIGN(chunk_obj_node_t));
+    if (ptr != NULL) {
+        chunk_obj_node_t *obj = (chunk_obj_node_t *)(((byte *)ptr) - SIZEOF_ROUND_ALIGN(chunk_obj_node_t));
 
-    return obj->size - obj->padding;
+        return obj->size - obj->padding;
+    }
+
+    return 0;
 }
 
 static gs_memory_type_ptr_t
diff --git a/pcl/pcl/pcmacros.c b/pcl/pcl/pcmacros.c
index 7111395..5de0881 100644
--- a/pcl/pcl/pcmacros.c
+++ b/pcl/pcl/pcmacros.c
@@ -314,8 +314,10 @@ pcmacros_do_reset(pcl_state_t * pcs, pcl_reset_type_t type)
         id_set_value(pcs->macro_id, 0);
         pcs->alpha_macro_id.id = 0;
     }
-    if (type & pcl_reset_permanent)
+    if (type & pcl_reset_permanent) {
+        gs_free_object(pcs->memory, pcs->macro_definition, "begin macro definition");
         pl_dict_release(&pcs->macros);
+    }
 
     return 0;
 }
diff --git a/pcl/pcl/pcparse.c b/pcl/pcl/pcparse.c
index 0b8eb03..5fc17b0 100644
--- a/pcl/pcl/pcparse.c
+++ b/pcl/pcl/pcparse.c
@@ -257,16 +257,18 @@ pcl_adjust_arg(pcl_args_t * pargs, const pcl_command_definition_t * pdefn)
 static int
 append_macro(const byte * from, const byte * to, pcl_state_t * pcs)
 {
-    uint count = to - from;
-    uint size = gs_object_size(pcs->memory, pcs->macro_definition);
-    byte *new_defn =
-        gs_resize_object(pcs->memory, pcs->macro_definition, size + count,
-                         "append_macro");
+    if (pcs->macro_definition != NULL) {
+        uint count = to - from;
+        uint size = gs_object_size(pcs->memory, pcs->macro_definition);
+        byte *new_defn =
+            gs_resize_object(pcs->memory, pcs->macro_definition, size + count,
+                             "append_macro");
 
-    if (new_defn == 0)
-        return_error(e_Memory);
-    memcpy(new_defn + size, from + 1, count);
-    pcs->macro_definition = new_defn;
+        if (new_defn == 0)
+            return_error(e_Memory);
+        memcpy(new_defn + size, from + 1, count);
+        pcs->macro_definition = new_defn;
+    }
     return 0;
 }
 


Summary of changes:
 base/gsmchunk.c    | 48 ++++++++++++++++++++++++++++--------------------
 pcl/pcl/pcmacros.c |  4 +++-
 pcl/pcl/pcparse.c  | 22 ++++++++++++----------
 3 files changed, 43 insertions(+), 31 deletions(-)