[gs-commits] ghostpdl branch, master, updated. jbig2dec-0.14-1880-g0aa9d4f

[email protected] (Ken Sharp) Sat, 16 Nov 2019 14:14:15 +0000 (UTC)
Newsgroups gmane.comp.printing.ghostscript.cvs
Message-ID <[email protected]>
The ghostpdl branch, master has been updated
       via  0aa9d4f8237f7a0b459fc567e76ab8f0c4c2eebd (commit)
       via  ea274a722040b1186374a96d61715ae96d58c36b (commit)
       via  3a913d9dc801508b19a8d5605e785852e1bfb082 (commit)
       via  8bf3152fe37368b49dcd23535a407c632d7157d2 (commit)
       via  5a4c29eeea1f0b63cc0b2fff3a1ca0f5b2d143b6 (commit)
      from  7fc7881b00a43fe1017e593846a0baf28e8837db (commit)

----------------------------------------------------------------------
commit 0aa9d4f8237f7a0b459fc567e76ab8f0c4c2eebd
Author: Ken Sharp <[email protected]>
Date:   Sat Nov 16 10:00:58 2019 +0000

    Coverity ID 350946
    
    Not checking the return from gdev_prn_get_bits in two places
    
    Again, no way for me to see this CID on the Coverity web interface.

diff --git a/contrib/gdevlx7.c b/contrib/gdevlx7.c
index 9f0f127..37f9697 100644
--- a/contrib/gdevlx7.c
+++ b/contrib/gdevlx7.c
@@ -581,6 +581,7 @@ lxmgen_print_page(gx_device_printer *pdev, gp_file *prn_stream)
    int lr_shift=((lxm_device*)pdev)->headSeparation;
    byte *obp[LX7_BSW_H];    /* pointers to buffer lines */
    int bufHeight;
+   int code = 0;
 
    /* initiate vres mapping variable */
    vres=LXR_600; /* default vertical resolution */
@@ -689,19 +690,24 @@ lxmgen_print_page(gx_device_printer *pdev, gp_file *prn_stream)
       int c1200;     /* testing empty line for 1200dpi... */
 
       /* copy one line & test for all zeroes */
-      gdev_prn_get_bits(pdev, pheight-prest, /* current line No. */
+      code = gdev_prn_get_bits(pdev, pheight-prest, /* current line No. */
             pbuf,                /* our buffer if needed */
             &ppbuf);             /* returns pointer to scanline
                                   * either our buffer or
                                   * gs internal data buffer
                                   */
+      if (code < 0)
+          goto error;
+
       if (vres==LXR_1200 && (pheight-prest+LXH_DSKIP1<pheight))
       {
-         gdev_prn_get_bits(pdev, pheight-prest+LXH_DSKIP1,
+         code = gdev_prn_get_bits(pdev, pheight-prest+LXH_DSKIP1,
                                   /* current line No. */
             pbuf+bwidth,                /* our buffer if needed */
             &ppbuf2);
        c1200=LX_LINE_EMPTY(ppbuf2,bwidth);
+         if (code < 0)
+             goto error;
       }
       else
          c1200=1;
@@ -791,13 +797,14 @@ lxmgen_print_page(gx_device_printer *pdev, gp_file *prn_stream)
 
    /* eject page */
    lex_eject(prn_stream);
+error:
    gs_free(pdev->memory->non_gc_memory, (char*)pbuf,rpbufsize, 1, "lxmgen_print_page(pbuf)");
    gs_free(pdev->memory->non_gc_memory, (char*)outbuf,OUT_BUF_SIZE, 1, "lxmgen_print_page(outbuf)");
 
 #ifdef DEBUG
    dprintf1("[%s] print_page() end\n",pdev->dname);
 #endif
-   return 0;
+   return code;
 }
 
    static int

----------------------------------------------------------------------
commit ea274a722040b1186374a96d61715ae96d58c36b
Author: Ken Sharp <[email protected]>
Date:   Sat Nov 16 09:55:36 2019 +0000

    Coverity IDs 350943, 350942 and 350947
    
    Not checking the return value from gdev_prn_get_bits() in three places.
    
    Again, cannot see this on the Coverity web interface.

diff --git a/contrib/gdevlx32.c b/contrib/gdevlx32.c
index 0dd5d27..20b01fa 100644
--- a/contrib/gdevlx32.c
+++ b/contrib/gdevlx32.c
@@ -2220,7 +2220,7 @@ static int
 fill_mono_buffer(pagedata *gendata, int vline)
 {
         byte *in_data, *data;
-        int i, ret, ofs;
+        int i, ret, ofs, code = 0;
 
         /* Initialize the "data" pointer, that will be used to
          * scan all the lines in the buffer, and the "ofs" pointer
@@ -2242,8 +2242,10 @@ fill_mono_buffer(pagedata *gendata, int vline)
         while(vline < gendata->numvlines)
         {
                 /* Ask Ghostscript for one rasterized line */
-                gdev_prn_get_bits((gx_device_printer *)gendata->dev,
+                code = gdev_prn_get_bits((gx_device_printer *)gendata->dev,
                                                                                         vline, data+ofs, &in_data);
+                if (code < 0)
+                    return code;
 
                 /* And check if it's all zero: if not, break out of
                  * the loop. This nice trick with memcpy it's by Stephen
@@ -2301,8 +2303,10 @@ fill_mono_buffer(pagedata *gendata, int vline)
                         /* If we are not at the end of the page, copy one more
                          * scanline into the buffer.
                          */
-                        gdev_prn_get_bits((gx_device_printer *)gendata->dev,
+                        code = gdev_prn_get_bits((gx_device_printer *)gendata->dev,
                                                                                                 vline, data+ofs, &in_data);
+                        if (code < 0)
+                            return code;
                         if(in_data != data+ofs)memcpy(data+ofs, in_data, gendata->numrbytes);
                 }
 
@@ -2333,7 +2337,7 @@ static int
 init_buffer(pagedata *gendata)
 {
         byte *in_data, *data;
-        int i, ret, p1, p2, ofs;
+        int i, ret, p1, p2, ofs, code = 0;
 
         data = gendata->scanbuf;
         ofs = gendata->goffset;
@@ -2375,8 +2379,11 @@ init_buffer(pagedata *gendata)
 
                 if(i < gendata->numvlines)
                 {
-                        gdev_prn_get_bits((gx_device_printer *)gendata->dev,
+                        code = gdev_prn_get_bits((gx_device_printer *)gendata->dev,
                                                                                                 i, data+ofs, &in_data);
+                        if (code < 0)
+                            return code;
+
                         if(in_data != data+ofs)memcpy(data+ofs, in_data, gendata->numrbytes);
                 }
 

----------------------------------------------------------------------
commit 3a913d9dc801508b19a8d5605e785852e1bfb082
Author: Ken Sharp <[email protected]>
Date:   Sat Nov 16 09:52:40 2019 +0000

    Coverity ID 350944
    
    Not checking the return value from gdev_prn_get_bits()
    
    Slightly worryingly, I have the email from Coverity describing this
    as a new issue, but I cannot persuade the Coverity web interface to
    display it.

diff --git a/contrib/gdevmd2k.c b/contrib/gdevmd2k.c
index 374ca0e..afc82e9 100644
--- a/contrib/gdevmd2k.c
+++ b/contrib/gdevmd2k.c
@@ -486,7 +486,7 @@ alps_print_page(gx_device_printer *pdev, gp_file *prn_stream,
     int c_comp, num_comp = pdev->color_info.num_components;
     int n_comp = (dev_alps->mediaType == 1 ? 3 : num_comp);
     int *error, *ep;
-    int i, j;
+    int i, j, code = 0;
 
     /* allocate memory */
     work = (byte *)gs_malloc(pdev->memory->non_gc_memory, 3+sizeof(int), line_size,
@@ -528,7 +528,9 @@ alps_print_page(gx_device_printer *pdev, gp_file *prn_stream,
         for(y = 0; y < y_height; y ++) {
             uint len = line_size;
 
-            gdev_prn_get_bits(pdev, y, in, &dp);
+            code = gdev_prn_get_bits(pdev, y, in, &dp);
+            if (code < 0)
+                return code;
 
             switch (pdev->color_info.depth) {
             case 4:

----------------------------------------------------------------------
commit 8bf3152fe37368b49dcd23535a407c632d7157d2
Author: Ken Sharp <[email protected]>
Date:   Sat Nov 16 09:48:23 2019 +0000

    Coverity IDs 350945 and 350948
    
    In these routines code can only ever be 0 (OK) or 1 (error). So instead
    of testing for code < 0 we need to test for code > 0 for an error.

diff --git a/devices/gdevicov.c b/devices/gdevicov.c
index ad9a903..517ca4f 100644
--- a/devices/gdevicov.c
+++ b/devices/gdevicov.c
@@ -92,7 +92,7 @@ cov_write_page(gx_device_printer *pdev, gp_file *file)
         }
     }
 
-    return (code < 0) ? ecode : 0;
+    return (code > 0) ? ecode : 0;
 }
 
 /*  cov_write_page2 gave ink coverage values not ratecoverage */
@@ -163,7 +163,7 @@ static int cov_write_page_ink(gx_device_printer *pdev, gp_file *file)
         }
     }
 
-    return (code < 0) ? ecode : 0;
+    return (code > 0) ? ecode : 0;
 }
 
 static const gx_device_procs cov_procs =

----------------------------------------------------------------------
commit 5a4c29eeea1f0b63cc0b2fff3a1ca0f5b2d143b6
Author: Ken Sharp <[email protected]>
Date:   Sat Nov 16 09:31:32 2019 +0000

    Coverity IDs 350163, 350949
    
    previous fix for 350163 missed additional unchecked use of xps_fseek()
    
    In addition; copying the cleanup code was not a complete fix, because
    the existing cleanup code had a resource leak which Coverity did not
    previously complain about.....
    
    Fix that too

diff --git a/xps/xpsjxr.c b/xps/xpsjxr.c
index f19596d..e12bbee 100644
--- a/xps/xpsjxr.c
+++ b/xps/xpsjxr.c
@@ -203,7 +203,11 @@ xps_decode_jpegxr(xps_context_t *ctx, byte *buf, int len, xps_image_t *output)
         xps_free(ctx, name);
         return gs_throw(gs_error_invalidfileaccess, "cannot write to scratch file");
     }
-    xps_fseek(file, 0, SEEK_SET);
+    rc = xps_fseek(file, 0, SEEK_SET);
+    if (rc != 0) {
+        xps_free(ctx, name);
+        return gs_throw(gs_error_invalidfileaccess, "cannot write to scratch file");
+    }
 
     container = jxr_create_container();
     rc = jxr_read_image_container(container, gp_get_file(file));
@@ -237,9 +241,10 @@ xps_decode_jpegxr(xps_context_t *ctx, byte *buf, int len, xps_image_t *output)
     jxr_set_user_data(image, &state);
 
     rc = xps_fseek(file, offset, SEEK_SET);
-    if (rc < 0) {
+    if (rc != 0) {
         xps_free(ctx, name);
         jxr_destroy_container(container);
+        jxr_destroy(image);
         return gs_throw1(-1, "jxr_read_image_bitstream: %s", jxr_error_string(rc));
     }
 
@@ -247,6 +252,7 @@ xps_decode_jpegxr(xps_context_t *ctx, byte *buf, int len, xps_image_t *output)
     if (rc < 0) {
         xps_free(ctx, name);
         jxr_destroy_container(container);
+        jxr_destroy(image);
         return gs_throw1(-1, "jxr_read_image_bitstream: %s", jxr_error_string(rc));
     }
 
@@ -271,11 +277,19 @@ xps_decode_jpegxr(xps_context_t *ctx, byte *buf, int len, xps_image_t *output)
         state.output = output;
         jxr_set_user_data(image, &state);
 
-        xps_fseek(file, alpha_offset, SEEK_SET);
+        rc = xps_fseek(file, alpha_offset, SEEK_SET);
+        if (rc != 0) {
+            xps_free(ctx, name);
+            jxr_destroy_container(container);
+            jxr_destroy(image);
+            return gs_throw1(-1, "jxr_read_image_bitstream: %s", jxr_error_string(rc));
+        }
+
         rc = jxr_read_image_bitstream(image, gp_get_file(file));
         if (rc < 0) {
             xps_free(ctx, name);
             jxr_destroy_container(container);
+            jxr_destroy(image);
             return gs_throw1(-1, "jxr_read_image_bitstream: %s", jxr_error_string(rc));
         }
 


Summary of changes:
 contrib/gdevlx32.c | 17 ++++++++++++-----
 contrib/gdevlx7.c  | 13 ++++++++++---
 contrib/gdevmd2k.c |  6 ++++--
 devices/gdevicov.c |  4 ++--
 xps/xpsjxr.c       | 20 +++++++++++++++++---
 5 files changed, 45 insertions(+), 15 deletions(-)