[gs-commits] ghostpdl branch, master, updated. jbig2dec-0.14-1779-g714e899

The ghostpdl branch, master has been updated
       via  714e8995cd582d418276915cbbec3c70711fb19e (commit)
      from  c64d06deea998199a0e30180fd884286b4b2256c (commit)

----------------------------------------------------------------------
commit 714e8995cd582d418276915cbbec3c70711fb19e
Author: Julian Smith <[email protected]>
Date:   Thu Oct 31 11:55:38 2019 +0000

    Bug 701807: avoid buffer overflow in tiff12_print_page().
    
    Fixes:
        ./sanbin/gs -r650 -sOutputFile=tmp -sDEVICE=tiff12nc ../bug-701807.pdf

diff --git a/devices/gdevtfnx.c b/devices/gdevtfnx.c
index f07cc15..578e964 100644
--- a/devices/gdevtfnx.c
+++ b/devices/gdevtfnx.c
@@ -146,12 +146,16 @@ tiff12_print_page(gx_device_printer * pdev, gp_file * file)
     {
         int y;
         int size = gdev_prn_raster(pdev);
-        byte *data = gs_alloc_bytes(pdev->memory, size, "tiff12_print_page");
+
+        /* We allocate an extra 5 bytes to avoid buffer overflow when accessing
+        src[5] below, if size if not multiple of 6. This fixes bug-701807. */
+        int size_alloc = size + 5;
+        byte *data = gs_alloc_bytes(pdev->memory, size_alloc, "tiff12_print_page");
 
         if (data == 0)
             return_error(gs_error_VMerror);
 
-        memset(data, 0, size);
+        memset(data, 0, size_alloc);
 
         for (y = 0; y < pdev->height; ++y) {
             const byte *src;


Summary of changes:
 devices/gdevtfnx.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)