[gs-commits] ghostpdl branch, master, updated. jbig2dec-0.14-1694-ga38bf66

The ghostpdl branch, master has been updated
       via  a38bf66e8e041f21ebb25492e576262a55b318b1 (commit)
      from  893018e1c7aca3218555701208cc41daee34b8c4 (commit)

----------------------------------------------------------------------
commit a38bf66e8e041f21ebb25492e576262a55b318b1
Author: Shailesh Mistry <[email protected]>
Date:   Mon Sep 23 09:25:27 2019 +0100

    Bug 697545 : Prevent memory leaks and SEGV in pcl_font_header.
    
    Update pcl_font_header to avoid freeing uninitialised font structure and also
    double freeing the font.
    
    Error created using :-
    MEMENTO_FAILAT=17247 ./membin/gpcl6 -sDEVICE=pbmraw -o /dev/null ./tests_private/pcl/pcl5cfts/fts.0573

diff --git a/pcl/pcl/pcsfont.c b/pcl/pcl/pcsfont.c
index 8820abf..e547563 100644
--- a/pcl/pcl/pcsfont.c
+++ b/pcl/pcl/pcsfont.c
@@ -444,6 +444,12 @@ pcl_font_header(pcl_args_t * pargs, pcl_state_t * pcs)
                     goto fail;
                 }
 
+                code =
+                    pl_fill_in_font((gs_font *) pfont, plfont, pcs->font_dir,
+                                    mem, "nameless_font");
+                if (code < 0)
+                    goto fail;
+
                 {
                     uint num_chars = pl_get_uint16(pfh->LastCode);
 
@@ -456,11 +462,6 @@ pcl_font_header(pcl_args_t * pargs, pcl_state_t * pcs)
                     if (code < 0)
                         goto fail;
                 }
-                code =
-                    pl_fill_in_font((gs_font *) pfont, plfont, pcs->font_dir,
-                                    mem, "nameless_font");
-                if (code < 0)
-                    goto fail;
                 code = pl_fill_in_tt_font(pfont, NULL, gs_next_ids(mem, 1));
                 if (code < 0)
                     goto fail;
@@ -515,8 +516,10 @@ pcl_font_header(pcl_args_t * pargs, pcl_state_t * pcs)
 
     code = pl_dict_put(&pcs->soft_fonts, current_font_id,
                 current_font_id_size, plfont);
-    if (code < 0)
-        goto fail;
+    if (code < 0) {
+        /* on error, pl_dict_put consumes plfont */
+        return code;
+    }
     plfont->pfont->procs.define_font = gs_no_define_font;
 
     if ((code = gs_definefont(pcs->font_dir, plfont->pfont)) != 0) {
@@ -526,6 +529,8 @@ pcl_font_header(pcl_args_t * pargs, pcl_state_t * pcs)
     if (plfont->scaling_technology == plfst_TrueType)
         code = pl_fapi_passfont(plfont, 0, NULL, NULL, NULL, 0);
 
+    return code;
+
 fail:
     if (code < 0)
         pl_free_font(mem, plfont, "pcl_font_header(pl_font_t)");


Summary of changes:
 pcl/pcl/pcsfont.c | 19 ++++++++++++-------
 1 file changed, 12 insertions(+), 7 deletions(-)