[gs-commits] ghostpdl branch, master, updated. jbig2dec-0.14-1818-g4e71329
[email protected] (Julian Smith) Wed, 6 Nov 2019 12:18:32 +0000 (UTC)
| Newsgroups | gmane.comp.printing.ghostscript.cvs |
|---|---|
| Message-ID | <[email protected]> |
The ghostpdl branch, master has been updated
via 4e713293de84b689c4ab358f3e110ea54aa81925 (commit)
via f70ab2044429fe4b991801476ea3f4b4a5c0cdf4 (commit)
via ce2afc4f02617dee51f3322ae8386c4b46047c18 (commit)
from 027c546e0dd11e0526f1780a7f3c2c66acffe209 (commit)
----------------------------------------------------------------------
commit 4e713293de84b689c4ab358f3e110ea54aa81925
Author: Julian Smith <[email protected]>
Date: Wed Nov 6 11:56:07 2019 +0000
Bug 701843: avoid divide by zero in devices/gdevepsc.c:epsc_print_page().
Fixes:
./sanbin/gs -dBATCH -dNOPAUSE -dSAFER -r8 -dNOCIE -dFitPage -sOutputFile=tmp -sDEVICE=epsonc ../bug-701843.pdf
diff --git a/devices/gdevepsc.c b/devices/gdevepsc.c
index 2f04914..49e83f0 100644
--- a/devices/gdevepsc.c
+++ b/devices/gdevepsc.c
@@ -202,19 +202,23 @@ epsc_print_page(gx_device_printer * pdev, gp_file * prn_stream)
return_error(gs_error_rangecheck);
}
- in =
- (byte *) gs_malloc(pdev->memory, in_size + 1, 1,
- "epsc_print_page(in)");
- out =
- (byte *) gs_malloc(pdev->memory, out_size + 1, 1,
- "epsc_print_page(out)");
-
start_graphics = (char)
((y_24pin ? graphics_modes_24 : graphics_modes_9)[x_dpi / 60]);
first_pass = (start_graphics & DD ? 1 : 0);
last_pass = first_pass * 2;
dots_per_space = x_dpi / 10; /* pica space = 1/10" */
bytes_per_space = dots_per_space * y_mult;
+ if (bytes_per_space == 0) {
+ /* This avoids divide by zero later on, bug 701843. */
+ return_error(gs_error_rangecheck);
+ }
+
+ in =
+ (byte *) gs_malloc(pdev->memory, in_size + 1, 1,
+ "epsc_print_page(in)");
+ out =
+ (byte *) gs_malloc(pdev->memory, out_size + 1, 1,
+ "epsc_print_page(out)");
/* declare color buffer and related vars */
spare_bits = (pdev->width % 8); /* left over bits to go to margin */
----------------------------------------------------------------------
commit f70ab2044429fe4b991801476ea3f4b4a5c0cdf4
Author: Julian Smith <[email protected]>
Date: Wed Nov 6 11:46:10 2019 +0000
Bug 701843: avoid divide by zero caused by custom resolution being too low.
Fixes:
./sanbin/gs -dBATCH -dNOPAUSE -dSAFER -r8 -dNOCIE -dFitPage -sOutputFile=tmp -sDEVICE=eps9mid ../bug-701843.pdf
diff --git a/devices/gdevepsn.c b/devices/gdevepsn.c
index 49faaf3..3e53883 100644
--- a/devices/gdevepsn.c
+++ b/devices/gdevepsn.c
@@ -159,10 +159,10 @@ eps_print_page(gx_device_printer *pdev, gp_file *prn_stream, int y_9pin_high,
int line_size = gdev_mem_bytes_per_scan_line((gx_device *)pdev);
/* Note that in_size is a multiple of 8. */
int in_size = line_size * (8 * in_y_mult);
- byte *buf1 = (byte *)gs_malloc(pdev->memory, in_size, 1, "eps_print_page(buf1)");
- byte *buf2 = (byte *)gs_malloc(pdev->memory, in_size, 1, "eps_print_page(buf2)");
- byte *in = buf1;
- byte *out = buf2;
+ byte *buf1;
+ byte *buf2;
+ byte *in;
+ byte *out;
int out_y_mult = (y_24pin ? 3 : 1);
int x_dpi = (int)pdev->x_pixels_per_inch;
char start_graphics =
@@ -174,6 +174,17 @@ eps_print_page(gx_device_printer *pdev, gp_file *prn_stream, int y_9pin_high,
int bytes_per_space = dots_per_space * out_y_mult;
int tab_min_pixels = x_dpi * MIN_TAB_10THS / 10;
int skip = 0, lnum = 0, pass, ypass;
+
+ if (bytes_per_space == 0) {
+ /* This avoids divide by zero later on, bug 701843. */
+ return_error(gs_error_rangecheck);
+ }
+
+ buf1 = (byte *)gs_malloc(pdev->memory, in_size, 1, "eps_print_page(buf1)");
+ buf2 = (byte *)gs_malloc(pdev->memory, in_size, 1, "eps_print_page(buf2)");
+ in = buf1;
+ out = buf2;
+
/* Check allocations */
if ( buf1 == 0 || buf2 == 0 )
----------------------------------------------------------------------
commit ce2afc4f02617dee51f3322ae8386c4b46047c18
Author: Julian Smith <[email protected]>
Date: Wed Nov 6 11:18:55 2019 +0000
Bug 701842: avoid buffer overflow in lxm5700m_print_page().
Fixes:
./sanbin/gs -dBATCH -sOutputFile=tmp -sDEVICE=lxm5700m ../bug-701842.ps
diff --git a/devices/gdevlxm.c b/devices/gdevlxm.c
index ec350ee..4b0f26e 100644
--- a/devices/gdevlxm.c
+++ b/devices/gdevlxm.c
@@ -296,17 +296,26 @@ quit_ignomiously: /* and a goto into an if statement is pretty ignomious! */
sxBy8 = sx/8;
sxMask = 0x80>>(sx%8);
- /* loop through all the swipeHeight bits of this column */
- for (i = 0, b=1, y= sxBy8+j1*line_size; i < directorySize; i++,b<<=1) {
- sum = false;
- for (j=j1,c=c1 /*,y=i*16*line_size+sxBy8*/; j<16; j+=2, y+=2*line_size, c>>=2) {
- f = (in[y]&sxMask);
- if (f) {
- words[i] |= c;
- sum |= f;
+ /* loop through all the swipeHeight bits of this column.
+
+ Note that <sx> looks like it can get out of range, so we
+ check for this here. This fixes bug 701842.
+
+ [An alternative might be to change above code from 'maxX
+ = (maxX+3)&-2' to 'maxX = (maxX+1)&-2', but that might be
+ risky. */
+ if (sx < pdev->width) {
+ for (i = 0, b=1, y= sxBy8+j1*line_size; i < directorySize; i++,b<<=1) {
+ sum = false;
+ for (j=j1,c=c1 /*,y=i*16*line_size+sxBy8*/; j<16; j+=2, y+=2*line_size, c>>=2) {
+ f = (in[y]&sxMask);
+ if (f) {
+ words[i] |= c;
+ sum |= f;
+ }
}
+ if (!sum) directory |=b;
}
- if (!sum) directory |=b;
}
retval+=2;
buffer_store(directory>>8); buffer_store(directory&0xff);
Summary of changes:
devices/gdevepsc.c | 18 +++++++++++-------
devices/gdevepsn.c | 19 +++++++++++++++----
devices/gdevlxm.c | 27 ++++++++++++++++++---------
3 files changed, 44 insertions(+), 20 deletions(-)