Fix for 686779, /ioerror in --token--, new approach
Alex Cherepanov <[email protected]>
| Newsgroups | gmane.comp.printing.ghostscript.patches |
|---|---|
| Message-ID | <[email protected]> |
JAWS PDF generator encodes empty stream as jaws_empty[]. The stream declares that the data block length is zero but zlib routines regard a zero length data block to be a error. Check for this case and return EOF without calling zlib. Fix bug 686779 from the customer 131 If we choose to apply /SubFileDecode filter to all streams we can compare the length for equality and reduce the number of calls to memcmp(). I think that a half of the bug bounty should go to Shailesh L Mistry <[email protected]> who have analyzed the problem and whose proposal was eventually implemented. _______________________________________________ gs-code-review mailing list [email protected] http://www.ghostscript.com/mailman/listinfo/gs-code-review
szlibd.c.diff
(text/plain, 2 KB)
Index: gs/src/szlibd.c
===================================================================
RCS file: /cvs/ghostscript/gs/src/szlibd.c,v
retrieving revision 1.5
diff -b -u -r1.5 szlibd.c
--- gs/src/szlibd.c 21 Feb 2002 22:24:54 -0000 1.5
+++ gs/src/szlibd.c 14 Nov 2003 16:42:37 -0000
@@ -16,6 +16,7 @@
/* $Id: szlibd.c,v 1.5 2002/02/21 22:24:54 giles Exp $ */
/* zlib decoding (decompression) filter stream */
+#include "memory_.h"
#include "std.h"
#include "gsmemory.h"
#include "gsmalloc.h" /* for gs_memory_default */
@@ -62,6 +63,7 @@
z_stream *zs = &ss->dynamic->zstate;
const byte *p = pr->ptr;
int status;
+ static const unsigned char jaws_empty[] = {0x58, 0x85, 1, 0, 0, 0, 0, 0, 1, 0x0A};
/* Detect no input or full output so that we don't get */
/* a Z_BUF_ERROR return. */
@@ -73,6 +75,14 @@
zs->avail_in = pr->limit - p;
zs->next_out = pw->ptr + 1;
zs->avail_out = pw->limit - pw->ptr;
+ if (zs->total_in == 0 && zs->avail_in >= 10 && !memcmp(zs->next_in, jaws_empty, 10)) {
+ /* JAWS PDF generator encodes empty stream as jaws_empty[].
+ * The stream declares that the data block length is zero
+ * but zlib routines regard a zero length data block to be a error.
+ */
+ pr->ptr += 10;
+ return EOFC;
+ }
status = inflate(zs, Z_PARTIAL_FLUSH);
pr->ptr = zs->next_in - 1;
pw->ptr = zs->next_out - 1;
Index: gs/src/lib.mak
===================================================================
RCS file: /cvs/ghostscript/gs/src/lib.mak,v
retrieving revision 1.146
diff -b -u -r1.146 lib.mak
--- gs/src/lib.mak 30 Oct 2003 09:33:33 -0000 1.146
+++ gs/src/lib.mak 14 Nov 2003 16:42:41 -0000
@@ -1462,7 +1462,7 @@
$(SETMOD) $(GLD)szlibd $(szlibd_)
$(ADDMOD) $(GLD)szlibd -include $(ZGENDIR)$(D)zlibd.dev
-$(GLOBJ)szlibd.$(OBJ) : $(GLSRC)szlibd.c $(AK) $(std_h)\
+$(GLOBJ)szlibd.$(OBJ) : $(GLSRC)szlibd.c $(AK) $(std_h) $(memory__h)\
$(gsmalloc_h) $(gsmemory_h) $(strimpl_h) $(szlibxx_h)
$(GLZCC) $(GLO_)szlibd.$(OBJ) $(C_) $(GLSRC)szlibd.c