[gs-commits] ghostpdl branch, master, updated. jbig2dec-0.14-1881-gda03855

The ghostpdl branch, master has been updated
       via  da03855bf9ca18eab05d4ac870d73f457758a77f (commit)
      from  0aa9d4f8237f7a0b459fc567e76ab8f0c4c2eebd (commit)

----------------------------------------------------------------------
commit da03855bf9ca18eab05d4ac870d73f457758a77f
Author: Ken Sharp <[email protected]>
Date:   Sun Nov 17 19:48:10 2019 +0000

    txtwrite - fix buffer overflow
    
    Bug #701877 "heap-buffer-overflow at devices/vector/gdevtxtw.c:2114 in txt_add_fragment"
    
    We were trying to read too many entries from the enumerator 'Widths'
    array, because we were reading the number of Unicode code points,
    instead of the number of character codes.
    
    At the same time.....
    
    re-instate the code which uses & on the glyph lists and casts them to
    appropriate pointers. While gcc happily works with the code that was
    modified to make Coverity happy, Visual Studio absolutely does not.
    In order to make Visual Studio happy we do need the crazy pointers and
    casting. I think this is wrong, but this way works on both compilers
    and I couldn't find any other construction which did.

diff --git a/devices/vector/gdevtxtw.c b/devices/vector/gdevtxtw.c
index bb6f1da..7738321 100644
--- a/devices/vector/gdevtxtw.c
+++ b/devices/vector/gdevtxtw.c
@@ -1710,10 +1710,10 @@ static int get_unicode(textw_text_enum_t *penum, gs_font *font, gs_glyph glyph,
                 }
             }
             if (length == 0) {
-                single_glyph_list_t *sentry = SingleGlyphList;
-                double_glyph_list_t *dentry = DoubleGlyphList;
-                treble_glyph_list_t *tentry = TrebleGlyphList;
-                quad_glyph_list_t *qentry = QuadGlyphList;
+                single_glyph_list_t *sentry = (single_glyph_list_t *)&SingleGlyphList;
+                double_glyph_list_t *dentry = (double_glyph_list_t *)&DoubleGlyphList;
+                treble_glyph_list_t *tentry = (treble_glyph_list_t *)&TrebleGlyphList;
+                quad_glyph_list_t *qentry = (quad_glyph_list_t *)&QuadGlyphList;
 
                 /* Search glyph to single Unicode value table */
                 while (sentry->Glyph != 0) {
@@ -2111,7 +2111,8 @@ txt_add_fragment(gx_device_txtwrite_t *tdev, textw_text_enum_t *penum)
         penum->TextBufferIndex, sizeof(float), "txtwrite alloc widths array");
     if (!penum->text_state->Widths)
         return gs_note_error(gs_error_VMerror);
-    memcpy(penum->text_state->Widths, penum->Widths, penum->TextBufferIndex * sizeof(float));
+    memset(penum->text_state->Widths, 0x00, penum->TextBufferIndex * sizeof(float));
+    memcpy(penum->text_state->Widths, penum->Widths, penum->text.size * sizeof(float));
 
     unsorted_entry->Unicode_Text = (unsigned short *)gs_malloc(tdev->memory->stable_memory,
         penum->TextBufferIndex, sizeof(unsigned short), "txtwrite alloc sorted text buffer");
@@ -2123,7 +2124,8 @@ txt_add_fragment(gx_device_txtwrite_t *tdev, textw_text_enum_t *penum)
         penum->TextBufferIndex, sizeof(float), "txtwrite alloc widths array");
     if (!unsorted_entry->Widths)
         return gs_note_error(gs_error_VMerror);
-    memcpy(unsorted_entry->Widths, penum->Widths, penum->TextBufferIndex * sizeof(float));
+    memset(unsorted_entry->Widths, 0x00, penum->TextBufferIndex * sizeof(float));
+    memcpy(unsorted_entry->Widths, penum->Widths, penum->text.size * sizeof(float));
 
     unsorted_entry->FontName = (char *)gs_malloc(tdev->memory->stable_memory,
         (strlen(penum->text_state->FontName) + 1), sizeof(unsigned char), "txtwrite alloc sorted text buffer");


Summary of changes:
 devices/vector/gdevtxtw.c | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)