[gs-commits] ghostpdl branch, master, updated. jbig2dec-0.14-1771-g849e74e

The ghostpdl branch, master has been updated
       via  849e74e5ab450dd581942192da7101e0664fa5af (commit)
       via  89f58f1aa95b3482cadf6977da49457194ee5358 (commit)
       via  863ada11f9a942a622a581312e2be022d9e2a6f7 (commit)
       via  9f39ed4a92578a020ae10459643e1fe72573d134 (commit)
      from  d31e25ed5b130499e0d880e4609b1b4824699768 (commit)

----------------------------------------------------------------------
commit 849e74e5ab450dd581942192da7101e0664fa5af
Author: Julian Smith <[email protected]>
Date:   Tue Oct 29 17:28:53 2019 +0000

    Bug 701799: avoid out-of-range array access in mj_color_correct().
    
    Code is obscure, so this fix merely avoids out-of-range access in the simplest
    way possible, without understanding what the code is trying to do.
    
    Fixes:
        ./sanbin/gs -sOutputFile=tmp -sDEVICE=mj6000c ../bug-701799.pdf

diff --git a/contrib/japanese/gdevmjc.c b/contrib/japanese/gdevmjc.c
index f7f6a13..a181304 100644
--- a/contrib/japanese/gdevmjc.c
+++ b/contrib/japanese/gdevmjc.c
@@ -1504,7 +1504,10 @@ mj_color_correct(gx_color_value *Rptr ,gx_color_value *Gptr , gx_color_value *Bp
         if (Y<0)
                 Y=0;
 
-        if(H>256 && H<1024){		/* green correct */
+        /* 2019-10-29 this used to be 'if(H>256 && H<1024)', which can then go
+        beyond bounds of the 512-element grnsep2[]. So have patched up to avoid
+        this, but without any proper idea about what's going on. */
+        if(H>256 && H<768){		/* green correct */
                 short	work;
                 work=(((long)grnsep[M]*(long)grnsep2[H-256])>>16);
                 C+=work;

----------------------------------------------------------------------
commit 89f58f1aa95b3482cadf6977da49457194ee5358
Author: Julian Smith <[email protected]>
Date:   Tue Oct 29 16:49:13 2019 +0000

    Bug 701794: check for x_dpi out of range in epsc_print_page().
    
    Avoids out-of-bounds of local arrays graphics_modes_9 and graphics_modes_24.
    
    Larger diff than would like, because can't return error from within
    declarations in old-style C.
    
    Fixes:
        ./sanbin/gs -r680 -sOutputFile=tmp -sDEVICE=epsonc ../bug-701794.pdf

diff --git a/devices/gdevepsc.c b/devices/gdevepsc.c
index 192128a..2f04914 100644
--- a/devices/gdevepsc.c
+++ b/devices/gdevepsc.c
@@ -174,27 +174,51 @@ epsc_print_page(gx_device_printer * pdev, gp_file * prn_stream)
     int y_mult = (y_24pin ? 3 : 1);
     int line_size = (pdev->width + 7) >> 3;     /* always mono */
     int in_size = line_size * (8 * y_mult);
-    byte *in =
-        (byte *) gs_malloc(pdev->memory, in_size + 1, 1,
-                           "epsc_print_page(in)");
     int out_size = ((pdev->width + 7) & -8) * y_mult;
-    byte *out =
-        (byte *) gs_malloc(pdev->memory, out_size + 1, 1,
-                           "epsc_print_page(out)");
+    byte *in;
+    byte *out;
     int x_dpi = (int)pdev->x_pixels_per_inch;
-    char start_graphics = (char)
-        ((y_24pin ? graphics_modes_24 : graphics_modes_9)[x_dpi / 60]);
-    int first_pass = (start_graphics & DD ? 1 : 0);
-    int last_pass = first_pass * 2;
-    int dots_per_space = x_dpi / 10;    /* pica space = 1/10" */
-    int bytes_per_space = dots_per_space * y_mult;
+
+    char start_graphics;
+    int first_pass;
+    int last_pass;
+    int dots_per_space; 
+    int bytes_per_space;
     int skip = 0, lnum = 0, pass;
 
-/* declare color buffer and related vars */
     byte *color_in;
     int color_line_size, color_in_size;
-    int spare_bits = (pdev->width % 8); /* left over bits to go to margin */
-    int whole_bits = pdev->width - spare_bits;
+    int spare_bits;
+    int whole_bits;
+
+    int max_dpi = 60 * (
+            (y_24pin) ?
+            sizeof(graphics_modes_24) / sizeof(graphics_modes_24[0])
+            :
+            sizeof(graphics_modes_9) / sizeof(graphics_modes_9[0])
+            )
+            - 1;
+    if (x_dpi > max_dpi) {
+        return_error(gs_error_rangecheck);
+    }
+    
+    in =
+        (byte *) gs_malloc(pdev->memory, in_size + 1, 1,
+                           "epsc_print_page(in)");
+    out =
+        (byte *) gs_malloc(pdev->memory, out_size + 1, 1,
+                           "epsc_print_page(out)");
+
+    start_graphics = (char)
+        ((y_24pin ? graphics_modes_24 : graphics_modes_9)[x_dpi / 60]);
+    first_pass = (start_graphics & DD ? 1 : 0);
+    last_pass = first_pass * 2;
+    dots_per_space = x_dpi / 10;    /* pica space = 1/10" */
+    bytes_per_space = dots_per_space * y_mult;
+
+    /* declare color buffer and related vars */
+    spare_bits = (pdev->width % 8); /* left over bits to go to margin */
+    whole_bits = pdev->width - spare_bits;
 
     /* Check allocations */
     if (in == 0 || out == 0) {

----------------------------------------------------------------------
commit 863ada11f9a942a622a581312e2be022d9e2a6f7
Author: Julian Smith <[email protected]>
Date:   Tue Oct 29 16:20:56 2019 +0000

    Bug 701793: check we are within buffer before comparing buffer contents.
    
    Fixes:
        ./sanbin/gs -sOutputFile=tmp -sDEVICE=mj700v2c ../bug-701793.pdf

diff --git a/contrib/japanese/gdevmjc.c b/contrib/japanese/gdevmjc.c
index 85fa6a8..f7f6a13 100644
--- a/contrib/japanese/gdevmjc.c
+++ b/contrib/japanese/gdevmjc.c
@@ -667,7 +667,7 @@ mj_raster_cmd(int c_id, int in_size, byte* in, byte* buf2,
        ** walk forward, looking for matches:
        */
 
-      for( q++ ; *q == *p && q < in_end ; q++ ) {
+      for( q++ ; q < in_end && *q == *p ; q++ ) {
         if( (q-p) >= 128 ) {
           if( p > inp ) {
             count = p - inp;

----------------------------------------------------------------------
commit 9f39ed4a92578a020ae10459643e1fe72573d134
Author: Julian Smith <[email protected]>
Date:   Tue Oct 29 15:49:25 2019 +0000

    Bug 701792: Avoid going beyond buffer in GetNumSameData() and GetNumWrongData().
    
    GetNumSameData() compared buffer contents before checking that we are still
    within bounds of buffer, which caused the bug.
    
    Have made similar fix to GetNumWrongData() because it has similar error.
    
    Fixes address sanitizer error in:
        ./sanbin/gs -sOutputFile=tmp -sDEVICE=lips4v ../bug-701792.pdf

diff --git a/contrib/lips4/gdevlips.c b/contrib/lips4/gdevlips.c
index 11aa832..6dd0704 100644
--- a/contrib/lips4/gdevlips.c
+++ b/contrib/lips4/gdevlips.c
@@ -145,7 +145,7 @@ GetNumSameData(const byte * curPtr, const int maxnum)
     if (1 == maxnum) {
         return (1);
     }
-    while (*curPtr == *(curPtr + count) && maxnum > count) {
+    while (maxnum > count && *curPtr == *(curPtr + count)) {
         count++;
     }
 
@@ -160,7 +160,7 @@ GetNumWrongData(const byte * curPtr, const int maxnum)
     if (1 == maxnum) {
         return (1);
     }
-    while (*(curPtr + count) != *(curPtr + count + 1) && maxnum > count) {
+    while (maxnum > count+1 && *(curPtr + count) != *(curPtr + count + 1)) {
         count++;
     }
 


Summary of changes:
 contrib/japanese/gdevmjc.c |  7 ++++--
 contrib/lips4/gdevlips.c   |  4 ++--
 devices/gdevepsc.c         | 54 +++++++++++++++++++++++++++++++++-------------
 3 files changed, 46 insertions(+), 19 deletions(-)