[gs-commits] ghostpdl branch, master, updated. jbig2dec-0.14-1712-g2d990b0

The ghostpdl branch, master has been updated
       via  2d990b065c228802b3913602b4309165e42c08e9 (commit)
      from  f03bac8ec2dabfff5583bf6afdd2b77f1885f8ef (commit)

----------------------------------------------------------------------
commit 2d990b065c228802b3913602b4309165e42c08e9
Author: Chris Liddell <[email protected]>
Date:   Tue Oct 1 10:35:48 2019 +0100

    Fix memory corruption setting a halftone
    
    When setting a new halftone in the graphics state, we try to re-use the data
    from the existing device halftone.
    
    The problem is that the device halftone can have higher component indices than
    there are components in the new halftone we are creating. In this case, we can
    end up writing off the end of the components array for the new halftone
    structure.
    
    Simply check that the new halftone has enough components before doing the
    duplication.

diff --git a/base/gsht.c b/base/gsht.c
index bced373..df20e84 100644
--- a/base/gsht.c
+++ b/base/gsht.c
@@ -985,7 +985,8 @@ gx_gstate_dev_ht_install(
             gx_ht_order *           p_s_order = &p_s_comp->corder;
             int                     comp_num = p_s_comp->comp_number;
 
-            if (comp_num >= 0 && comp_num < GX_DEVICE_COLOR_MAX_COMPONENTS) {
+            if (comp_num >= 0 && comp_num < GX_DEVICE_COLOR_MAX_COMPONENTS &&
+                comp_num < dht.num_comp) {
                 gx_ht_order *   p_d_order = &dht.components[comp_num].corder;
 
                 /* indicate that this order has been filled in */


Summary of changes:
 base/gsht.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)