[gs-commits] ghostpdl branch, master, updated. jbig2dec-0.14-1810-gb25cad4

The ghostpdl branch, master has been updated
       via  b25cad42dc869e8e9d7ea58adae2c8baba0ee25d (commit)
      from  e7118494be4162b8c2c06d8b7d4cb2d7ebb57f61 (commit)

----------------------------------------------------------------------
commit b25cad42dc869e8e9d7ea58adae2c8baba0ee25d
Author: Julian Smith <[email protected]>
Date:   Tue Nov 5 12:03:23 2019 +0000

    Bug 701830: avoid buffer overflow in lips_rle_encode().
    
    Worst case for lips_rle_encode() is 2*Length+2, so adjust corresponding alloc
    to match.
    
    Fixes:
        ./sanbin/gs -dBATCH -dNOPAUSE -r489 -dFitPage -sOutputFile=tmp -sDEVICE=lips4 ../bug-701830.eps

diff --git a/contrib/lips4/gdevl4r.c b/contrib/lips4/gdevl4r.c
index 9af084f..05f1f81 100644
--- a/contrib/lips4/gdevl4r.c
+++ b/contrib/lips4/gdevl4r.c
@@ -645,7 +645,10 @@ lips4type_print_page_copies(gx_device_printer * pdev, gp_file * prn_stream, int
       {
         if (!(lprn->CompBuf = gs_malloc(pdev->memory->non_gc_memory, bpl * 3 / 2 + 1, maxY, "(CompBuf)")))
           return_error(gs_error_VMerror);
-        if (!(lprn->CompBuf2 = gs_malloc(pdev->memory->non_gc_memory, bpl * 3 / 2 + 1, maxY, "(CompBuf2)")))
+        
+        /* This buffer is used by lips_rle_encode(), which can require double
+        input size plus 2 bytes. */
+        if (!(lprn->CompBuf2 = gs_malloc(pdev->memory->non_gc_memory, bpl * 2 + 2, maxY, "(CompBuf2)")))
           return_error(gs_error_VMerror);
 
         if (lprn->NegativePrint) {


Summary of changes:
 contrib/lips4/gdevl4r.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)