[gs-commits] ghostpdl branch, master, updated. jbig2dec-0.14-1880-g0aa9d4f
[email protected] (Ken Sharp) Sat, 16 Nov 2019 14:14:15 +0000 (UTC)
| Newsgroups | gmane.comp.printing.ghostscript.cvs |
|---|---|
| Message-ID | <[email protected]> |
The ghostpdl branch, master has been updated
via 0aa9d4f8237f7a0b459fc567e76ab8f0c4c2eebd (commit)
via ea274a722040b1186374a96d61715ae96d58c36b (commit)
via 3a913d9dc801508b19a8d5605e785852e1bfb082 (commit)
via 8bf3152fe37368b49dcd23535a407c632d7157d2 (commit)
via 5a4c29eeea1f0b63cc0b2fff3a1ca0f5b2d143b6 (commit)
from 7fc7881b00a43fe1017e593846a0baf28e8837db (commit)
----------------------------------------------------------------------
commit 0aa9d4f8237f7a0b459fc567e76ab8f0c4c2eebd
Author: Ken Sharp <[email protected]>
Date: Sat Nov 16 10:00:58 2019 +0000
Coverity ID 350946
Not checking the return from gdev_prn_get_bits in two places
Again, no way for me to see this CID on the Coverity web interface.
diff --git a/contrib/gdevlx7.c b/contrib/gdevlx7.c
index 9f0f127..37f9697 100644
--- a/contrib/gdevlx7.c
+++ b/contrib/gdevlx7.c
@@ -581,6 +581,7 @@ lxmgen_print_page(gx_device_printer *pdev, gp_file *prn_stream)
int lr_shift=((lxm_device*)pdev)->headSeparation;
byte *obp[LX7_BSW_H]; /* pointers to buffer lines */
int bufHeight;
+ int code = 0;
/* initiate vres mapping variable */
vres=LXR_600; /* default vertical resolution */
@@ -689,19 +690,24 @@ lxmgen_print_page(gx_device_printer *pdev, gp_file *prn_stream)
int c1200; /* testing empty line for 1200dpi... */
/* copy one line & test for all zeroes */
- gdev_prn_get_bits(pdev, pheight-prest, /* current line No. */
+ code = gdev_prn_get_bits(pdev, pheight-prest, /* current line No. */
pbuf, /* our buffer if needed */
&ppbuf); /* returns pointer to scanline
* either our buffer or
* gs internal data buffer
*/
+ if (code < 0)
+ goto error;
+
if (vres==LXR_1200 && (pheight-prest+LXH_DSKIP1<pheight))
{
- gdev_prn_get_bits(pdev, pheight-prest+LXH_DSKIP1,
+ code = gdev_prn_get_bits(pdev, pheight-prest+LXH_DSKIP1,
/* current line No. */
pbuf+bwidth, /* our buffer if needed */
&ppbuf2);
c1200=LX_LINE_EMPTY(ppbuf2,bwidth);
+ if (code < 0)
+ goto error;
}
else
c1200=1;
@@ -791,13 +797,14 @@ lxmgen_print_page(gx_device_printer *pdev, gp_file *prn_stream)
/* eject page */
lex_eject(prn_stream);
+error:
gs_free(pdev->memory->non_gc_memory, (char*)pbuf,rpbufsize, 1, "lxmgen_print_page(pbuf)");
gs_free(pdev->memory->non_gc_memory, (char*)outbuf,OUT_BUF_SIZE, 1, "lxmgen_print_page(outbuf)");
#ifdef DEBUG
dprintf1("[%s] print_page() end\n",pdev->dname);
#endif
- return 0;
+ return code;
}
static int
----------------------------------------------------------------------
commit ea274a722040b1186374a96d61715ae96d58c36b
Author: Ken Sharp <[email protected]>
Date: Sat Nov 16 09:55:36 2019 +0000
Coverity IDs 350943, 350942 and 350947
Not checking the return value from gdev_prn_get_bits() in three places.
Again, cannot see this on the Coverity web interface.
diff --git a/contrib/gdevlx32.c b/contrib/gdevlx32.c
index 0dd5d27..20b01fa 100644
--- a/contrib/gdevlx32.c
+++ b/contrib/gdevlx32.c
@@ -2220,7 +2220,7 @@ static int
fill_mono_buffer(pagedata *gendata, int vline)
{
byte *in_data, *data;
- int i, ret, ofs;
+ int i, ret, ofs, code = 0;
/* Initialize the "data" pointer, that will be used to
* scan all the lines in the buffer, and the "ofs" pointer
@@ -2242,8 +2242,10 @@ fill_mono_buffer(pagedata *gendata, int vline)
while(vline < gendata->numvlines)
{
/* Ask Ghostscript for one rasterized line */
- gdev_prn_get_bits((gx_device_printer *)gendata->dev,
+ code = gdev_prn_get_bits((gx_device_printer *)gendata->dev,
vline, data+ofs, &in_data);
+ if (code < 0)
+ return code;
/* And check if it's all zero: if not, break out of
* the loop. This nice trick with memcpy it's by Stephen
@@ -2301,8 +2303,10 @@ fill_mono_buffer(pagedata *gendata, int vline)
/* If we are not at the end of the page, copy one more
* scanline into the buffer.
*/
- gdev_prn_get_bits((gx_device_printer *)gendata->dev,
+ code = gdev_prn_get_bits((gx_device_printer *)gendata->dev,
vline, data+ofs, &in_data);
+ if (code < 0)
+ return code;
if(in_data != data+ofs)memcpy(data+ofs, in_data, gendata->numrbytes);
}
@@ -2333,7 +2337,7 @@ static int
init_buffer(pagedata *gendata)
{
byte *in_data, *data;
- int i, ret, p1, p2, ofs;
+ int i, ret, p1, p2, ofs, code = 0;
data = gendata->scanbuf;
ofs = gendata->goffset;
@@ -2375,8 +2379,11 @@ init_buffer(pagedata *gendata)
if(i < gendata->numvlines)
{
- gdev_prn_get_bits((gx_device_printer *)gendata->dev,
+ code = gdev_prn_get_bits((gx_device_printer *)gendata->dev,
i, data+ofs, &in_data);
+ if (code < 0)
+ return code;
+
if(in_data != data+ofs)memcpy(data+ofs, in_data, gendata->numrbytes);
}
----------------------------------------------------------------------
commit 3a913d9dc801508b19a8d5605e785852e1bfb082
Author: Ken Sharp <[email protected]>
Date: Sat Nov 16 09:52:40 2019 +0000
Coverity ID 350944
Not checking the return value from gdev_prn_get_bits()
Slightly worryingly, I have the email from Coverity describing this
as a new issue, but I cannot persuade the Coverity web interface to
display it.
diff --git a/contrib/gdevmd2k.c b/contrib/gdevmd2k.c
index 374ca0e..afc82e9 100644
--- a/contrib/gdevmd2k.c
+++ b/contrib/gdevmd2k.c
@@ -486,7 +486,7 @@ alps_print_page(gx_device_printer *pdev, gp_file *prn_stream,
int c_comp, num_comp = pdev->color_info.num_components;
int n_comp = (dev_alps->mediaType == 1 ? 3 : num_comp);
int *error, *ep;
- int i, j;
+ int i, j, code = 0;
/* allocate memory */
work = (byte *)gs_malloc(pdev->memory->non_gc_memory, 3+sizeof(int), line_size,
@@ -528,7 +528,9 @@ alps_print_page(gx_device_printer *pdev, gp_file *prn_stream,
for(y = 0; y < y_height; y ++) {
uint len = line_size;
- gdev_prn_get_bits(pdev, y, in, &dp);
+ code = gdev_prn_get_bits(pdev, y, in, &dp);
+ if (code < 0)
+ return code;
switch (pdev->color_info.depth) {
case 4:
----------------------------------------------------------------------
commit 8bf3152fe37368b49dcd23535a407c632d7157d2
Author: Ken Sharp <[email protected]>
Date: Sat Nov 16 09:48:23 2019 +0000
Coverity IDs 350945 and 350948
In these routines code can only ever be 0 (OK) or 1 (error). So instead
of testing for code < 0 we need to test for code > 0 for an error.
diff --git a/devices/gdevicov.c b/devices/gdevicov.c
index ad9a903..517ca4f 100644
--- a/devices/gdevicov.c
+++ b/devices/gdevicov.c
@@ -92,7 +92,7 @@ cov_write_page(gx_device_printer *pdev, gp_file *file)
}
}
- return (code < 0) ? ecode : 0;
+ return (code > 0) ? ecode : 0;
}
/* cov_write_page2 gave ink coverage values not ratecoverage */
@@ -163,7 +163,7 @@ static int cov_write_page_ink(gx_device_printer *pdev, gp_file *file)
}
}
- return (code < 0) ? ecode : 0;
+ return (code > 0) ? ecode : 0;
}
static const gx_device_procs cov_procs =
----------------------------------------------------------------------
commit 5a4c29eeea1f0b63cc0b2fff3a1ca0f5b2d143b6
Author: Ken Sharp <[email protected]>
Date: Sat Nov 16 09:31:32 2019 +0000
Coverity IDs 350163, 350949
previous fix for 350163 missed additional unchecked use of xps_fseek()
In addition; copying the cleanup code was not a complete fix, because
the existing cleanup code had a resource leak which Coverity did not
previously complain about.....
Fix that too
diff --git a/xps/xpsjxr.c b/xps/xpsjxr.c
index f19596d..e12bbee 100644
--- a/xps/xpsjxr.c
+++ b/xps/xpsjxr.c
@@ -203,7 +203,11 @@ xps_decode_jpegxr(xps_context_t *ctx, byte *buf, int len, xps_image_t *output)
xps_free(ctx, name);
return gs_throw(gs_error_invalidfileaccess, "cannot write to scratch file");
}
- xps_fseek(file, 0, SEEK_SET);
+ rc = xps_fseek(file, 0, SEEK_SET);
+ if (rc != 0) {
+ xps_free(ctx, name);
+ return gs_throw(gs_error_invalidfileaccess, "cannot write to scratch file");
+ }
container = jxr_create_container();
rc = jxr_read_image_container(container, gp_get_file(file));
@@ -237,9 +241,10 @@ xps_decode_jpegxr(xps_context_t *ctx, byte *buf, int len, xps_image_t *output)
jxr_set_user_data(image, &state);
rc = xps_fseek(file, offset, SEEK_SET);
- if (rc < 0) {
+ if (rc != 0) {
xps_free(ctx, name);
jxr_destroy_container(container);
+ jxr_destroy(image);
return gs_throw1(-1, "jxr_read_image_bitstream: %s", jxr_error_string(rc));
}
@@ -247,6 +252,7 @@ xps_decode_jpegxr(xps_context_t *ctx, byte *buf, int len, xps_image_t *output)
if (rc < 0) {
xps_free(ctx, name);
jxr_destroy_container(container);
+ jxr_destroy(image);
return gs_throw1(-1, "jxr_read_image_bitstream: %s", jxr_error_string(rc));
}
@@ -271,11 +277,19 @@ xps_decode_jpegxr(xps_context_t *ctx, byte *buf, int len, xps_image_t *output)
state.output = output;
jxr_set_user_data(image, &state);
- xps_fseek(file, alpha_offset, SEEK_SET);
+ rc = xps_fseek(file, alpha_offset, SEEK_SET);
+ if (rc != 0) {
+ xps_free(ctx, name);
+ jxr_destroy_container(container);
+ jxr_destroy(image);
+ return gs_throw1(-1, "jxr_read_image_bitstream: %s", jxr_error_string(rc));
+ }
+
rc = jxr_read_image_bitstream(image, gp_get_file(file));
if (rc < 0) {
xps_free(ctx, name);
jxr_destroy_container(container);
+ jxr_destroy(image);
return gs_throw1(-1, "jxr_read_image_bitstream: %s", jxr_error_string(rc));
}
Summary of changes:
contrib/gdevlx32.c | 17 ++++++++++++-----
contrib/gdevlx7.c | 13 ++++++++++---
contrib/gdevmd2k.c | 6 ++++--
devices/gdevicov.c | 4 ++--
xps/xpsjxr.c | 20 +++++++++++++++++---
5 files changed, 45 insertions(+), 15 deletions(-)