[gs-commits] ghostpdl branch, master, updated. jbig2dec-0.14-1864-g5f24a32

The ghostpdl branch, master has been updated
       via  5f24a32f0cc4513dfb9825900d561b3a6771b87c (commit)
       via  de9dc99614f86e4aaa0a447766a58447e76ca8c1 (commit)
      from  0ea433a1a172298eda11203d698ce6fe69be58d2 (commit)

----------------------------------------------------------------------
commit 5f24a32f0cc4513dfb9825900d561b3a6771b87c
Author: Ken Sharp <[email protected]>
Date:   Fri Nov 15 14:22:04 2019 +0000

    Coverity ID 350216 - prevent dangling pointer
    
    The variable pdcs is declared an immediately initialised to be
    dsc->dcs2. Coverity correctly points out that if dsc->page_count is 1
    we enter dsc_alloc_string, which can call dsc_reset() where,
    if dsc->dcs2 is set, it will be freed and dsc->dcs2 will be set to
    Null, leaving pdcs dangling.
    
    By deferring the assignment of pdcs until it is actuallused we can
    be certain that it is valid.

diff --git a/psi/dscparse.c b/psi/dscparse.c
index e754a82..0c34eb1 100644
--- a/psi/dscparse.c
+++ b/psi/dscparse.c
@@ -3822,7 +3822,7 @@ dsc_dcs2_fixup(CDSC *dsc)
         DSC_OFFSET *pbegin;
         DSC_OFFSET *pend;
         DSC_OFFSET end;
-        CDCS2 *pdcs = dsc->dcs2;
+        CDCS2 *pdcs = NULL;
         /* Now treat the initial EPS file as a single page without
          * headers or trailer, so page extraction will fetch the
          * the correct separation. */
@@ -3888,6 +3888,14 @@ dsc_dcs2_fixup(CDSC *dsc)
             *pbegin = *pend;
         end = 0;	/* end of composite is start of first separation */
 
+        /* we used to do this where the pointer is declared, but Coverity points out
+         * that dsc_alloc_string can call dsc_reset which can free dsc and dsc->dcs2.
+         * By deferring the initialisation to here we can ensure we don't have a
+         * dangling pointer. This makes me suspiciouos that DCS (not DSC!) comments
+         * have never worked properly.
+         */
+        pdcs = dsc->dcs2;
+
         while (pdcs) {
             page_number = dsc->page_count;
             if ((pdcs->begin) && (pdcs->colourname != NULL)) {

----------------------------------------------------------------------
commit de9dc99614f86e4aaa0a447766a58447e76ca8c1
Author: Ken Sharp <[email protected]>
Date:   Fri Nov 15 13:28:38 2019 +0000

    Attempted fix for Coverity ID 350194
    
    Thanks to Robin for pointing me at the right bit of code.
    
    There was a pointer cast and address of (&) on an array which was
    already a pointer. This is, of course, silly, so remove the cast and
    &.
    
    At the same time, the quad_glyph_list was using signed shorts to hold
    the Unicode points, when it should have been using unsigned shorts, so
    fix that here too.

diff --git a/devices/vector/gdevagl.h b/devices/vector/gdevagl.h
index e509f89..e356922 100644
--- a/devices/vector/gdevagl.h
+++ b/devices/vector/gdevagl.h
@@ -33,5 +33,5 @@ typedef struct treble_glyph_list_s {
 
 typedef struct quad_glyph_list_s {
   const char *Glyph;
-  short Unicode[4];
+  unsigned short Unicode[4];
 } quad_glyph_list_t;
diff --git a/devices/vector/gdevtxtw.c b/devices/vector/gdevtxtw.c
index 5158418..bb6f1da 100644
--- a/devices/vector/gdevtxtw.c
+++ b/devices/vector/gdevtxtw.c
@@ -1710,10 +1710,10 @@ static int get_unicode(textw_text_enum_t *penum, gs_font *font, gs_glyph glyph,
                 }
             }
             if (length == 0) {
-                single_glyph_list_t *sentry = (single_glyph_list_t *)&SingleGlyphList;
-                double_glyph_list_t *dentry = (double_glyph_list_t *)&DoubleGlyphList;
-                treble_glyph_list_t *tentry = (treble_glyph_list_t *)&TrebleGlyphList;
-                quad_glyph_list_t *qentry = (quad_glyph_list_t *)&QuadGlyphList;
+                single_glyph_list_t *sentry = SingleGlyphList;
+                double_glyph_list_t *dentry = DoubleGlyphList;
+                treble_glyph_list_t *tentry = TrebleGlyphList;
+                quad_glyph_list_t *qentry = QuadGlyphList;
 
                 /* Search glyph to single Unicode value table */
                 while (sentry->Glyph != 0) {


Summary of changes:
 devices/vector/gdevagl.h  |  2 +-
 devices/vector/gdevtxtw.c |  8 ++++----
 psi/dscparse.c            | 10 +++++++++-
 3 files changed, 14 insertions(+), 6 deletions(-)