[gs-commits] ghostpdl branch, master, updated. jbig2dec-0.14-1710-g77f7947

The ghostpdl branch, master has been updated
       via  77f79475fd0419d16f1efe7812a44a9720fef10b (commit)
      from  ef597bf4a05814a97d05866868f9b96b98746ae9 (commit)

----------------------------------------------------------------------
commit 77f79475fd0419d16f1efe7812a44a9720fef10b
Author: Chris Liddell <[email protected]>
Date:   Fri Sep 27 13:26:01 2019 +0100

    Bug 701634: Correctly handle file name of "\0"
    
    Attempting to open a file with a filename string starting with a NULL
    character should be treated the same as if the string was zero length.
    
    Not doing so created a broken file object leading to several operations
    resulting in a segfault.
    
    Also, add cleanup in the event of such an error, freeing memory allocated in
    preparing the gs stream object.

diff --git a/base/sfxcommon.c b/base/sfxcommon.c
index e5d5e88..002651b 100644
--- a/base/sfxcommon.c
+++ b/base/sfxcommon.c
@@ -82,8 +82,15 @@ file_open_stream(const char *fname, uint len, const char *file_access,
         return code;
     if (fname == 0)
         return 0;
-    if (fname[0] == 0)		/* fopen_proc gets NUL terminated string, not len */
-        return 0;		/* so this is the same as len == 0, so return NULL */
+    if (fname[0] == 0) {        /* fopen_proc gets NUL terminated string, not len */
+                                /* so this is the same as len == 0, so return NULL */
+        /* discard the stuff we allocated to keep from accumulating stuff needing GC */
+        gs_free_object(mem, (*ps)->cbuf, "file_close(buffer)");
+        gs_free_object(mem, *ps, "file_prepare_stream(stream)");
+        *ps = NULL;
+
+        return 0;
+    }
     code = (*fopen_proc)(iodev, (char *)(*ps)->cbuf, fmode, &file,
                          (char *)(*ps)->cbuf, (*ps)->bsize, mem);
     if (code < 0) {
diff --git a/psi/zfile.c b/psi/zfile.c
index 2b7d168..2f13992 100644
--- a/psi/zfile.c
+++ b/psi/zfile.c
@@ -282,6 +282,8 @@ zfile(i_ctx_t *i_ctx_p)
     }
     if (code < 0)
         return code;
+    if (s == NULL)
+        return_error(gs_error_undefinedfilename);
     code = ssetfilename(s, op[-1].value.const_bytes, r_size(op - 1));
     if (code < 0) {
         sclose(s);
@@ -667,6 +669,7 @@ zlibfile(i_ctx_t *i_ctx_p)
         pname.iodev = iodev_dflt;
     if (pname.iodev != iodev_dflt) { /* Non-OS devices don't have search paths (yet). */
         code = zopen_file(i_ctx_p, &pname, "r", &s, imemory);
+        if (s == NULL) code = gs_note_error(gs_error_undefinedfilename);
         if (code >= 0) {
             code = ssetfilename(s, op->value.const_bytes, r_size(op));
             if (code < 0) {


Summary of changes:
 base/sfxcommon.c | 11 +++++++++--
 psi/zfile.c      |  3 +++
 2 files changed, 12 insertions(+), 2 deletions(-)