[gs-commits] ghostpdl branch, master, updated. jbig2dec-0.14-1960-ge9ff39e

The ghostpdl branch, master has been updated
       via  e9ff39ee82680ea1719ddf99cf3809e26df0c946 (commit)
       via  354715346deed252ef7db53160b61d04bd630a2f (commit)
       via  b8c8a6410658fdfe57ad5de4ae57fdc4cbece2ab (commit)
       via  882793bc7f35f21f7857e216966c0b777140a87c (commit)
      from  8f611a6c45fafbea495206773eccf3028cfb4765 (commit)

----------------------------------------------------------------------
commit e9ff39ee82680ea1719ddf99cf3809e26df0c946
Author: Julian Smith <[email protected]>
Date:   Fri Nov 22 18:12:11 2019 +0000

    Coverity 351050: avoid buffer overflow warning.
    
    For simplicity, have used a temp four-character buffer filled in by
    parse_file_access_string(), then snprintf() to append gp_fmode_binary_suffix
    safely.

diff --git a/psi/zfile.c b/psi/zfile.c
index 2f13992..be03a55 100644
--- a/psi/zfile.c
+++ b/psi/zfile.c
@@ -733,7 +733,8 @@ ztempfile(i_ctx_t *i_ctx_p)
     os_ptr op = osp;
     const char *pstr;
     char fmode[4];
-    int code = parse_file_access_string(op, fmode);
+    char fmode_temp[4];
+    int code = parse_file_access_string(op, fmode_temp);
     char *prefix = NULL;
     char *fname= NULL;
     uint fnlen;
@@ -750,7 +751,7 @@ ztempfile(i_ctx_t *i_ctx_p)
         goto done;
     }
 
-    strcat(fmode, gp_fmode_binary_suffix);
+    snprintf(fmode, sizeof(fmode), "%s%s", fmode_temp, gp_fmode_binary_suffix);
     if (r_has_type(op - 1, t_null))
         pstr = gp_scratch_file_name_prefix;
     else {

----------------------------------------------------------------------
commit 354715346deed252ef7db53160b61d04bd630a2f
Author: Julian Smith <[email protected]>
Date:   Fri Nov 22 18:08:05 2019 +0000

    Coverity 351049: avoid buffer overflow warning.
    
    We're actually safe because gp_fmode_binary_suffix is max one-character long,
    but Coverity doesn't know that.

diff --git a/base/gxclfile.c b/base/gxclfile.c
index d2887dd..841009a 100644
--- a/base/gxclfile.c
+++ b/base/gxclfile.c
@@ -476,8 +476,7 @@ clist_rewind(clist_file_ptr cf, bool discard_data, const char *fname)
     IFILE *ocf = fake_path_to_file(fname);
     char fmode[4];
 
-    strcpy(fmode, "w+");
-    strcat(fmode, gp_fmode_binary_suffix);
+    snprintf(fmode, sizeof(fmode), "w+%s", gp_fmode_binary_suffix);
 
     if (ocf) {
         if (discard_data) {

----------------------------------------------------------------------
commit b8c8a6410658fdfe57ad5de4ae57fdc4cbece2ab
Author: Julian Smith <[email protected]>
Date:   Fri Nov 22 18:05:35 2019 +0000

    Coverity 351048: avoid buffer overflow warning.
    
    We're actually safe because gp_fmode_binary_suffix is max one-character long,
    but Coverity doesn't know that.

diff --git a/base/gxclist.c b/base/gxclist.c
index 14b825c..833990b 100644
--- a/base/gxclist.c
+++ b/base/gxclist.c
@@ -636,8 +636,7 @@ clist_open_output_file(gx_device *dev)
     code = clist_init(dev);
     if (code < 0)
         return code;
-    strcpy(fmode, "w+");
-    strcat(fmode, gp_fmode_binary_suffix);
+    snprintf(fmode, sizeof(fmode), "w+%s", gp_fmode_binary_suffix);
     cdev->page_cfname[0] = 0;   /* create a new file */
     cdev->page_bfname[0] = 0;   /* ditto */
     clist_reset_page(cdev);

----------------------------------------------------------------------
commit 882793bc7f35f21f7857e216966c0b777140a87c
Author: Julian Smith <[email protected]>
Date:   Fri Nov 22 17:45:51 2019 +0000

    Coverity 350209: fix bad return path in handle_dash_c().
    
    Also refactored a little.

diff --git a/pcl/pl/plmain.c b/pcl/pl/plmain.c
index 5921413..1f0ea8e 100644
--- a/pcl/pl/plmain.c
+++ b/pcl/pl/plmain.c
@@ -975,14 +975,17 @@ handle_dash_c(pl_main_instance_t *pmi, arg_list *pal, char **collected_commands,
             )
             break;
         code = gs_lib_ctx_stash_sanitized_arg(pmi->memory->gs_lib_ctx, "?");
-        if (code < 0)
-            return code;
+        if (code < 0) {
+            goto end;
+        }
         arglen = strlen(*arg);
         if (*collected_commands == NULL) {
             *collected_commands = (char *)gs_alloc_bytes(pmi->memory, arglen+1,
                                                          "-c buffer");
-            if (*collected_commands == NULL)
-                goto problem_in_dash_c;
+            if (*collected_commands == NULL) {
+                code = gs_note_error(gs_error_VMerror);
+                goto end;
+            }
             memcpy(*collected_commands, *arg, arglen+1);
         } else {
             char *newc;
@@ -991,22 +994,25 @@ handle_dash_c(pl_main_instance_t *pmi, arg_list *pal, char **collected_commands,
                                             *collected_commands,
                                             oldlen + 1 + arglen + 1,
                                             "-c buffer");
-            if (newc == NULL)
-                goto problem_in_dash_c;
+            if (newc == NULL) {
+                code = gs_note_error(gs_error_VMerror);
+                goto end;
+            }
             newc[oldlen] = 32;
             memcpy(newc + oldlen + 1, *arg, arglen + 1);
             *collected_commands = newc;
         }
         *arg = NULL;
     }
-    if (0) {
-problem_in_dash_c:
-        code = gs_error_Fatal;
+
+end:
+    if (code == gs_error_VMerror) {
         dmprintf(pmi->memory, "Failed to allocate memory while handling -c\n");
     }
-    if (code < 0) {
+    else if (code < 0) {
         dmprintf(pmi->memory, "Syntax: -c <postscript commands>\n");
     }
+
     pal->expand_ats = ats;
 
     return code;


Summary of changes:
 base/gxclfile.c |  3 +--
 base/gxclist.c  |  3 +--
 pcl/pl/plmain.c | 26 ++++++++++++++++----------
 psi/zfile.c     |  5 +++--
 4 files changed, 21 insertions(+), 16 deletions(-)