[gs-commits] ghostpdl branch, master, updated. jbig2dec-0.14-1853-g9e1d2f7

The ghostpdl branch, master has been updated
       via  9e1d2f76cabf84576424af0c38dceef5881c2b21 (commit)
       via  e6d0fcd87934f01d4fb3c3029558fea134fbd086 (commit)
       via  d11a43b64a2e623aebdfa34f8ee992887dc5b2b2 (commit)
      from  24ec06a27df63297796a379c95ee5d4b39040410 (commit)

----------------------------------------------------------------------
commit 9e1d2f76cabf84576424af0c38dceef5881c2b21
Author: Julian Smith <[email protected]>
Date:   Tue Nov 12 15:51:23 2019 +0000

    jbig2_hd_new(): return error if params->GRAYMAX is large enough that N wraps to zero.
    
    This was noticed when investigating coverity warnings about params->GRAYMAX
    being tainted.

diff --git a/jbig2dec/jbig2_halftone.c b/jbig2dec/jbig2_halftone.c
index 69bd21e..e67c6d1 100644
--- a/jbig2dec/jbig2_halftone.c
+++ b/jbig2dec/jbig2_halftone.c
@@ -50,6 +50,12 @@ jbig2_hd_new(Jbig2Ctx *ctx, const Jbig2PatternDictParams *params, Jbig2Image *im
     uint32_t i;
     int j;
 
+    if (N == 0) {
+        /* We've wrapped. */
+        jbig2_error(ctx, JBIG2_SEVERITY_WARNING, -1, "params->GRAYMAX out of range");
+        return NULL;
+    }
+
     /* allocate a new struct */
     new = jbig2_new(ctx, Jbig2PatternDict, 1);
     if (new != NULL) {

----------------------------------------------------------------------
commit e6d0fcd87934f01d4fb3c3029558fea134fbd086
Author: Julian Smith <[email protected]>
Date:   Tue Nov 12 15:48:50 2019 +0000

    Attempt to quieten coverity complaints about tainted data from jbig2_get_int32() and jbig2_get_uint32().
    
    E.g. see Coverity p11408:94824.

diff --git a/jbig2dec/jbig2.c b/jbig2dec/jbig2.c
index 97018ea..3d9f270 100644
--- a/jbig2dec/jbig2.c
+++ b/jbig2dec/jbig2.c
@@ -191,12 +191,14 @@ jbig2_get_uint16(const byte *bptr)
     return get_uint16(bptr);
 }
 
+/* coverity[ -tainted_data_return ] */
 int32_t
 jbig2_get_int32(const byte *bptr)
 {
     return ((int32_t) get_int16(bptr) << 16) | get_uint16(bptr + 2);
 }
 
+/* coverity[ -tainted_data_return ] */
 uint32_t
 jbig2_get_uint32(const byte *bptr)
 {

----------------------------------------------------------------------
commit d11a43b64a2e623aebdfa34f8ee992887dc5b2b2
Author: Julian Smith <[email protected]>
Date:   Tue Nov 12 11:22:41 2019 +0000

    Coverity p11408:350203: Stop coverity overflow warning about array of floats.
    
    &lutatobparts->matrix->cu.u points to something the size of three floats,
    but add_matrixwithbias() takes pointer to nine floats, which makes coverity
    complain.
    
    This fix changes things so that we pass a pointer to something nine floats in
    size, which satisfies coverity.

diff --git a/base/gsicc_create.c b/base/gsicc_create.c
index 6965db5..ef46460 100644
--- a/base/gsicc_create.c
+++ b/base/gsicc_create.c
@@ -1206,7 +1206,7 @@ add_lutAtoBtype(unsigned char *input_ptr, gsicc_lutatob *lutatobparts)
     }
     /* Then the matrix */
     if (lutatobparts->matrix != NULL) {
-        add_matrixwithbias(curr_ptr,&(lutatobparts->matrix->cu.u),true);
+        add_matrixwithbias(curr_ptr,(float*) lutatobparts->matrix,true);
         curr_ptr += (12*4);
         /* M curves */
         if (lutatobparts->m_curves != NULL) {


Summary of changes:
 base/gsicc_create.c       | 2 +-
 jbig2dec/jbig2.c          | 2 ++
 jbig2dec/jbig2_halftone.c | 6 ++++++
 3 files changed, 9 insertions(+), 1 deletion(-)