[gs-commits] ghostpdl branch, master, updated. jbig2dec-0.14-1764-g1e6b251

The ghostpdl branch, master has been updated
       via  1e6b2518ed4b130ad649b96bf914558e642e414d (commit)
       via  a2df79b5fdf97e1e33503634910ad08672bcee39 (commit)
       via  450da26a76286a8342ec0864b3d113856709f8f6 (commit)
      from  93cb0c0adbd9bcfefd021d59c472388f67d3300d (commit)

----------------------------------------------------------------------
commit 1e6b2518ed4b130ad649b96bf914558e642e414d
Author: Julian Smith <[email protected]>
Date:   Mon Oct 28 14:56:56 2019 +0000

    clusterpush.pl: also exclude sanbin and sanobj directories.

diff --git a/toolbin/localcluster/clusterpush.pl b/toolbin/localcluster/clusterpush.pl
index 6ec2681..84d2e1d 100755
--- a/toolbin/localcluster/clusterpush.pl
+++ b/toolbin/localcluster/clusterpush.pl
@@ -203,6 +203,7 @@ my $cmd="rsync -avxcz ".
 " --exclude bin64 --exclude obj64 --exclude debugobj64 --exclude pgobj64".
 " --exclude membin --exclude memobj --exclude membin64 --exclude memobj64".
 " --exclude profbin --exclude profobj --exclude profbin64 --exclude profobj64".
+" --exclude sanbin --exclude sanobj --exclude sanbin64 --exclude sanobj64".
 " --exclude sobin --exclude soobj --exclude debugbin".
 " --exclude ufst --exclude ufst-obj --exclude ufst-debugobj".
 " --exclude config.log --exclude .png".

----------------------------------------------------------------------
commit a2df79b5fdf97e1e33503634910ad08672bcee39
Author: Julian Smith <[email protected]>
Date:   Mon Oct 28 14:41:35 2019 +0000

    Added support for MEMENTO_BREAKAT, equivalent to (gdb) call Memento_breakAt(...).
    
    It can be more convenient to specify this on the command line rather than
    manually stop in gdb.

diff --git a/base/memento.c b/base/memento.c
index 38d4020..d5ee75b 100644
--- a/base/memento.c
+++ b/base/memento.c
@@ -1629,6 +1629,9 @@ static void Memento_init(void)
     env = getenv("MEMENTO_FAILAT");
     memento.failAt = (env ? atoi(env) : 0);
 
+    env = getenv("MEMENTO_BREAKAT");
+    memento.breakAt = (env ? atoi(env) : 0);
+
     env = getenv("MEMENTO_PARANOIA");
     memento.paranoia = (env ? atoi(env) : 0);
     if (memento.paranoia == 0)

----------------------------------------------------------------------
commit 450da26a76286a8342ec0864b3d113856709f8f6
Author: Julian Smith <[email protected]>
Date:   Mon Oct 28 14:37:48 2019 +0000

    Bug 701785: fixed sanitizer heap-buffer-overflow in lprn_is_black().
    
    In contrib/lips4/gdevlprn.c:lprn_is_black(), it seems that bpl is not
    necessarily a multiple of lprn->nBw, so we need to explicitly avoid straying
    into the next line's data.
    
    This also avoids accessing beyond our buffer if we are already on the last
    line, and so fixes the sanitizer error.
    
    Fixes:
        ./sanbin/gs -sOutputFile=tmp -sDEVICE=lips2p ../bug-701785.pdf

diff --git a/contrib/lips4/gdevlprn.c b/contrib/lips4/gdevlprn.c
index df8f862..7461e46 100644
--- a/contrib/lips4/gdevlprn.c
+++ b/contrib/lips4/gdevlprn.c
@@ -334,9 +334,16 @@ lprn_is_black(gx_device_printer * pdev, int r, int h, int bx)
     y0 = (r + h - bh) % maxY;
     for (y = 0; y < bh; y++) {
         p = &lprn->ImageBuf[(y0 + y) * bpl + bx * lprn->nBw];
-        for (x = 0; x < lprn->nBw; x++)
+        for (x = 0; x < lprn->nBw; x++) {
+            /* bpl isn't necessarily a multiple of lprn->nBw, so
+            we need to explicitly stop after the last byte in this
+            line to avoid accessing either the next line's data or
+            going off the end of our buffer completely. This avoids
+            https://bugs.ghostscript.com/show_bug.cgi?id=701785. */
+            if (bx * lprn->nBw + x >= bpl)  break;
             if (p[x] != 0)
                 return 1;
+        }
     }
     return 0;
 }


Summary of changes:
 base/memento.c                      | 3 +++
 contrib/lips4/gdevlprn.c            | 9 ++++++++-
 toolbin/localcluster/clusterpush.pl | 1 +
 3 files changed, 12 insertions(+), 1 deletion(-)