Auto sync2gitlab import of ghostscript-9.27-1.el8.src.rpm
This commit is contained in:
parent
f1bb817d98
commit
10ef686270
.gitignoreEMPTYghostscript-9.23-100-run-dvipdf-securely.patchghostscript-cve-2019-10216.patchghostscript-cve-2019-14811-14812-14813.patchghostscript-cve-2019-14817.patchghostscript-cve-2020-16290.patchghostscript-cve-2020-16291.patchghostscript-cve-2020-16293.patchghostscript-cve-2020-16295.patchghostscript-cve-2020-16299.patchghostscript-cve-2020-16302.patchghostscript-cve-2020-16304.patchghostscript-cve-2020-16306.patchghostscript-cve-2020-16307.patchghostscript-cve-2020-16310.patchghostscript.specsources
1
.gitignore
vendored
Normal file
1
.gitignore
vendored
Normal file
@ -0,0 +1 @@
|
||||
/ghostscript-9.27.tar.xz
|
22
ghostscript-9.23-100-run-dvipdf-securely.patch
Normal file
22
ghostscript-9.23-100-run-dvipdf-securely.patch
Normal file
@ -0,0 +1,22 @@
|
||||
From 91c9c6d17d445781ee572c281b8b9d75d96f9df8 Mon Sep 17 00:00:00 2001
|
||||
From: "David Kaspar [Dee'Kej]" <dkaspar@redhat.com>
|
||||
Date: Fri, 7 Oct 2016 13:57:01 +0200
|
||||
Subject: [PATCH] Make sure 'dvipdf' is being run securely
|
||||
|
||||
---
|
||||
lib/dvipdf | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/lib/dvipdf b/lib/dvipdf
|
||||
index 802aeab..c92dfb0 100755
|
||||
--- a/lib/dvipdf
|
||||
+++ b/lib/dvipdf
|
||||
@@ -43,4 +43,4 @@ fi
|
||||
|
||||
# We have to include the options twice because -I only takes effect if it
|
||||
# appears before other options.
|
||||
-exec dvips -Ppdf $DVIPSOPTIONS -q -f "$infile" | $GS_EXECUTABLE $OPTIONS -q -P- -dSAFER -dNOPAUSE -dBATCH -sDEVICE=pdfwrite -sstdout=%stderr -sOutputFile="$outfile" $OPTIONS -c .setpdfwrite -
|
||||
+exec dvips -R -Ppdf $DVIPSOPTIONS -q -f "$infile" | $GS_EXECUTABLE $OPTIONS -q -P- -dSAFER -dNOPAUSE -dBATCH -sDEVICE=pdfwrite -sstdout=%stderr -sOutputFile="$outfile" $OPTIONS -c .setpdfwrite -
|
||||
--
|
||||
2.14.3
|
||||
|
43
ghostscript-cve-2019-10216.patch
Normal file
43
ghostscript-cve-2019-10216.patch
Normal file
@ -0,0 +1,43 @@
|
||||
From 5b85ddd19a8420a1bd2d5529325be35d78e94234 Mon Sep 17 00:00:00 2001
|
||||
From: Chris Liddell <chris.liddell@artifex.com>
|
||||
Date: Fri, 2 Aug 2019 15:18:26 +0100
|
||||
Subject: Bug 701394: protect use of .forceput with executeonly
|
||||
|
||||
|
||||
diff --git a/Resource/Init/gs_type1.ps b/Resource/Init/gs_type1.ps
|
||||
index 6c7735bc0c..a039ccee35 100644
|
||||
--- a/Resource/Init/gs_type1.ps
|
||||
+++ b/Resource/Init/gs_type1.ps
|
||||
@@ -118,25 +118,25 @@
|
||||
( to be the same as glyph: ) print 1 index //== exec } if
|
||||
3 index exch 3 index .forceput
|
||||
% scratch(string) RAGL(dict) AGL(dict) CharStrings(dict) cstring gname
|
||||
- }
|
||||
+ }executeonly
|
||||
{pop} ifelse
|
||||
- } forall
|
||||
+ } executeonly forall
|
||||
pop pop
|
||||
- }
|
||||
+ } executeonly
|
||||
{
|
||||
pop pop pop
|
||||
} ifelse
|
||||
- }
|
||||
+ } executeonly
|
||||
{
|
||||
% scratch(string) RAGL(dict) AGL(dict) CharStrings(dict) cstring gname
|
||||
pop pop
|
||||
} ifelse
|
||||
- } forall
|
||||
+ } executeonly forall
|
||||
3 1 roll pop pop
|
||||
- } if
|
||||
+ } executeonly if
|
||||
pop
|
||||
dup /.AGLprocessed~GS //true .forceput
|
||||
- } if
|
||||
+ } executeonly if
|
||||
|
||||
%% We need to excute the C .buildfont1 in a stopped context so that, if there
|
||||
%% are errors we can put the stack back sanely and exit. Otherwise callers won't
|
56
ghostscript-cve-2019-14811-14812-14813.patch
Normal file
56
ghostscript-cve-2019-14811-14812-14813.patch
Normal file
@ -0,0 +1,56 @@
|
||||
From 885444fcbe10dc42787ecb76686c8ee4dd33bf33 Mon Sep 17 00:00:00 2001
|
||||
From: Ken Sharp <ken.sharp@artifex.com>
|
||||
Date: Tue, 20 Aug 2019 10:10:28 +0100
|
||||
Subject: make .forceput inaccessible
|
||||
|
||||
Bug #701343, #701344, #701345
|
||||
|
||||
More defensive programming. We don't want people to access .forecput
|
||||
even though it is no longer sufficient to bypass SAFER. The exploit
|
||||
in #701343 didn't work anyway because of earlier work to stop the error
|
||||
handler being used, but nevertheless, prevent access to .forceput from
|
||||
.setuserparams2.
|
||||
|
||||
diff --git a/Resource/Init/gs_lev2.ps b/Resource/Init/gs_lev2.ps
|
||||
index 4cc7f820f..0fd416465 100644
|
||||
--- a/Resource/Init/gs_lev2.ps
|
||||
+++ b/Resource/Init/gs_lev2.ps
|
||||
@@ -158,7 +158,7 @@ end
|
||||
{
|
||||
pop pop
|
||||
} ifelse
|
||||
- } forall
|
||||
+ } executeonly forall
|
||||
% A context switch might have occurred during the above loop,
|
||||
% causing the interpreter-level parameters to be reset.
|
||||
% Set them again to the new values. From here on, we are safe,
|
||||
@@ -229,9 +229,9 @@ end
|
||||
{ pop pop
|
||||
}
|
||||
ifelse
|
||||
- }
|
||||
+ } executeonly
|
||||
forall pop
|
||||
-} .bind odef
|
||||
+} .bind executeonly odef
|
||||
|
||||
% Initialize the passwords.
|
||||
% NOTE: the names StartJobPassword and SystemParamsPassword are known to
|
||||
diff --git a/Resource/Init/gs_pdfwr.ps b/Resource/Init/gs_pdfwr.ps
|
||||
index c158a8faf..422e66e1a 100644
|
||||
--- a/Resource/Init/gs_pdfwr.ps
|
||||
+++ b/Resource/Init/gs_pdfwr.ps
|
||||
@@ -658,11 +658,11 @@ currentdict /.pdfmarkparams .undef
|
||||
systemdict /.pdf_hooked_DSC_Creator //true .forceput
|
||||
} executeonly if
|
||||
pop
|
||||
- } if
|
||||
+ } executeonly if
|
||||
} {
|
||||
pop
|
||||
} ifelse
|
||||
- }
|
||||
+ } executeonly
|
||||
{
|
||||
pop
|
||||
} ifelse
|
189
ghostscript-cve-2019-14817.patch
Normal file
189
ghostscript-cve-2019-14817.patch
Normal file
@ -0,0 +1,189 @@
|
||||
diff --git a/Resource/Init/pdf_base.ps b/Resource/Init/pdf_base.ps
|
||||
index 1a218f4..cffde5c 100644
|
||||
--- a/Resource/Init/pdf_base.ps
|
||||
+++ b/Resource/Init/pdf_base.ps
|
||||
@@ -157,7 +157,7 @@ currentdict /num-chars-dict .undef
|
||||
{
|
||||
dup ==only () = flush
|
||||
} ifelse % PDFSTEP
|
||||
- } if % PDFDEBUG
|
||||
+ } executeonly if % PDFDEBUG
|
||||
2 copy .knownget {
|
||||
exch pop exch pop exch pop exec
|
||||
} {
|
||||
diff --git a/Resource/Init/pdf_draw.ps b/Resource/Init/pdf_draw.ps
|
||||
index e18a7c2..0a3924c 100644
|
||||
--- a/Resource/Init/pdf_draw.ps
|
||||
+++ b/Resource/Init/pdf_draw.ps
|
||||
@@ -501,8 +501,8 @@ end
|
||||
( Output may be incorrect.\n) pdfformaterror
|
||||
//pdfdict /.gs_warning_issued //true .forceput
|
||||
PDFSTOPONERROR { /gs /undefined signalerror } if
|
||||
- } if
|
||||
- }
|
||||
+ } executeonly if
|
||||
+ } executeonly
|
||||
ifelse
|
||||
} bind executeonly def
|
||||
|
||||
@@ -1142,7 +1142,7 @@ currentdict end readonly def
|
||||
.setglobal
|
||||
pdfformaterror
|
||||
} executeonly ifelse
|
||||
- }
|
||||
+ } executeonly
|
||||
{
|
||||
currentglobal //pdfdict gcheck .setglobal
|
||||
//pdfdict /.Qqwarning_issued //true .forceput
|
||||
@@ -1150,8 +1150,8 @@ currentdict end readonly def
|
||||
pdfformaterror
|
||||
} executeonly ifelse
|
||||
end
|
||||
- } ifelse
|
||||
- } loop
|
||||
+ } executeonly ifelse
|
||||
+ } executeonly loop
|
||||
{
|
||||
(\n **** Error: File has unbalanced q/Q operators \(too many q's\)\n Output may be incorrect.\n)
|
||||
//pdfdict /.Qqwarning_issued .knownget
|
||||
@@ -1165,14 +1165,14 @@ currentdict end readonly def
|
||||
.setglobal
|
||||
pdfformaterror
|
||||
} executeonly ifelse
|
||||
- }
|
||||
+ } executeonly
|
||||
{
|
||||
currentglobal //pdfdict gcheck .setglobal
|
||||
//pdfdict /.Qqwarning_issued //true .forceput
|
||||
.setglobal
|
||||
pdfformaterror
|
||||
} executeonly ifelse
|
||||
- } if
|
||||
+ } executeonly if
|
||||
pop
|
||||
|
||||
% restore pdfemptycount
|
||||
diff --git a/Resource/Init/pdf_font.ps b/Resource/Init/pdf_font.ps
|
||||
index 9fb85f6..357ba30 100644
|
||||
--- a/Resource/Init/pdf_font.ps
|
||||
+++ b/Resource/Init/pdf_font.ps
|
||||
@@ -677,7 +677,7 @@ currentdict end readonly def
|
||||
currentglobal 2 index dup gcheck setglobal
|
||||
/FontInfo 5 dict dup 5 1 roll .forceput
|
||||
setglobal
|
||||
- } if
|
||||
+ } executeonly if
|
||||
dup /GlyphNames2Unicode .knownget not {
|
||||
//true % No existing G2U, make one
|
||||
} {
|
||||
@@ -701,9 +701,9 @@ currentdict end readonly def
|
||||
} if
|
||||
PDFDEBUG {
|
||||
(.processToUnicode end) =
|
||||
- } if
|
||||
- } if
|
||||
- } stopped
|
||||
+ } executeonly if
|
||||
+ } executeonly if
|
||||
+ } executeonly stopped
|
||||
{
|
||||
.dstackdepth 1 countdictstack 1 sub
|
||||
{pop end} for
|
||||
@@ -1233,19 +1233,20 @@ currentdict /eexec_pdf_param_dict .undef
|
||||
//pdfdict /.Qqwarning_issued //true .forceput
|
||||
} executeonly if
|
||||
Q
|
||||
- } repeat
|
||||
+ } executeonly repeat
|
||||
Q
|
||||
- } PDFfile fileposition 2 .execn % Keep pdfcount valid.
|
||||
+ } executeonly PDFfile fileposition 2 .execn % Keep pdfcount valid.
|
||||
PDFfile exch setfileposition
|
||||
- } ifelse
|
||||
- } {
|
||||
+ } executeonly ifelse
|
||||
+ } executeonly
|
||||
+ {
|
||||
% PDF Type 3 fonts don't use .notdef
|
||||
% d1 implementation adjusts the width as needed
|
||||
0 0 0 0 0 0
|
||||
pdfopdict /d1 get exec
|
||||
} ifelse
|
||||
end end
|
||||
- } bdef
|
||||
+ } executeonly bdef
|
||||
dup currentdict Encoding .processToUnicode
|
||||
currentdict end .completefont exch pop
|
||||
} bind executeonly odef
|
||||
@@ -2045,9 +2046,9 @@ currentdict /CMap_read_dict undef
|
||||
(Will continue, but content may be missing.) = flush
|
||||
} ifelse
|
||||
} if
|
||||
- } if
|
||||
+ } executeonly if
|
||||
/findresource cvx /undefined signalerror
|
||||
- } loop
|
||||
+ } executeonly loop
|
||||
} bind executeonly odef
|
||||
|
||||
/buildCIDType0 { % <CIDFontType0-font-resource> buildCIDType0 <font>
|
||||
diff --git a/Resource/Init/pdf_main.ps b/Resource/Init/pdf_main.ps
|
||||
index 5305ea6..a59e63c 100644
|
||||
--- a/Resource/Init/pdf_main.ps
|
||||
+++ b/Resource/Init/pdf_main.ps
|
||||
@@ -2749,15 +2749,15 @@ currentdict /PDF2PS_matrix_key undef
|
||||
.setglobal
|
||||
pdfformaterror
|
||||
} executeonly ifelse
|
||||
- }
|
||||
+ } executeonly
|
||||
{
|
||||
currentglobal //pdfdict gcheck .setglobal
|
||||
//pdfdict /.Qqwarning_issued //true .forceput
|
||||
.setglobal
|
||||
pdfformaterror
|
||||
} executeonly ifelse
|
||||
- } if
|
||||
- } if
|
||||
+ } executeonly if
|
||||
+ } executeonly if
|
||||
pop
|
||||
count PDFexecstackcount sub { pop } repeat
|
||||
(after exec) VMDEBUG
|
||||
diff --git a/Resource/Init/pdf_ops.ps b/Resource/Init/pdf_ops.ps
|
||||
index 285e582..6c1f100 100644
|
||||
--- a/Resource/Init/pdf_ops.ps
|
||||
+++ b/Resource/Init/pdf_ops.ps
|
||||
@@ -186,14 +186,14 @@ currentdict /gput_always_allow .undef
|
||||
.setglobal
|
||||
pdfformaterror
|
||||
} executeonly ifelse
|
||||
- }
|
||||
+ } executeonly
|
||||
{
|
||||
currentglobal //pdfdict gcheck .setglobal
|
||||
//pdfdict /.Qqwarning_issued //true .forceput
|
||||
.setglobal
|
||||
pdfformaterror
|
||||
} executeonly ifelse
|
||||
- } if
|
||||
+ } executeonly if
|
||||
} bind executeonly odef
|
||||
|
||||
% Save PDF gstate
|
||||
@@ -440,11 +440,12 @@ currentdict /gput_always_allow .undef
|
||||
dup type /booleantype eq {
|
||||
.currentSMask type /dicttype eq {
|
||||
.currentSMask /Processed 2 index .forceput
|
||||
+ } executeonly
|
||||
+ {
|
||||
+ .setSMask
|
||||
+ }ifelse
|
||||
} executeonly
|
||||
{
|
||||
- .setSMask
|
||||
- }ifelse
|
||||
- }{
|
||||
.setSMask
|
||||
}ifelse
|
||||
|
18
ghostscript-cve-2020-16290.patch
Normal file
18
ghostscript-cve-2020-16290.patch
Normal file
@ -0,0 +1,18 @@
|
||||
diff --git a/devices/gdev3852.c b/devices/gdev3852.c
|
||||
index e21b403..2bee8ec 100644
|
||||
--- a/devices/gdev3852.c
|
||||
+++ b/devices/gdev3852.c
|
||||
@@ -76,6 +76,13 @@ jetp3852_print_page(gx_device_printer *pdev, FILE *prn_stream)
|
||||
{ int lnum;
|
||||
int line_size = gdev_mem_bytes_per_scan_line((gx_device *)pdev);
|
||||
int num_blank_lines = 0;
|
||||
+
|
||||
+ if (line_size > DATA_SIZE) {
|
||||
+ emprintf2(pdev->memory, "invalid resolution and/or width gives line_size = %d, max. is %d\n",
|
||||
+ line_size, DATA_SIZE);
|
||||
+ return_error(gs_error_rangecheck);
|
||||
+ }
|
||||
+
|
||||
for ( lnum = 0; lnum < pdev->height; lnum++ )
|
||||
{ byte *end_data = data + line_size;
|
||||
gdev_prn_copy_scan_lines(pdev, lnum,
|
257
ghostscript-cve-2020-16291.patch
Normal file
257
ghostscript-cve-2020-16291.patch
Normal file
@ -0,0 +1,257 @@
|
||||
diff --git a/contrib/gdevdj9.c b/contrib/gdevdj9.c
|
||||
index eec1c77..a4e8e9c 100644
|
||||
--- a/contrib/gdevdj9.c
|
||||
+++ b/contrib/gdevdj9.c
|
||||
@@ -575,26 +575,55 @@ static int cdj_set_bpp(gx_device *, int, int);
|
||||
static int
|
||||
hp_colour_open(gx_device * pdev)
|
||||
{
|
||||
- int retCode;
|
||||
+ int retCode = 0;
|
||||
+
|
||||
+ /* Change the margins if necessary. */
|
||||
+ static const float dj_a4[4] = {
|
||||
+ DESKJET_MARGINS_A4
|
||||
+ };
|
||||
+
|
||||
+ static const float dj_letter[4] = {
|
||||
+ DESKJET_MARGINS_LETTER
|
||||
+ };
|
||||
+ const float *m = (float *)0;
|
||||
|
||||
cdj970->PageCtr = 0;
|
||||
|
||||
+ /* quality setup */
|
||||
+ if (cdj970->quality == DRAFT) {
|
||||
+ gx_device_set_resolution((gx_device *) pdev, 300.0, 300.0);
|
||||
+ cdj970->xscal = 0;
|
||||
+ cdj970->yscal = 0;
|
||||
+ cdj970->intensities = 2;
|
||||
+ } else if (cdj970->quality == NORMAL) {
|
||||
+ gx_device_set_resolution((gx_device *) pdev, 600.0, 600.0);
|
||||
+ cdj970->xscal = 1;
|
||||
+ cdj970->yscal = 1;
|
||||
+ /* intensities = 4 from initialization */
|
||||
+ } else { /* quality == PRESENTATION */
|
||||
+ gx_device_set_resolution((gx_device *) pdev, 600.0, 600.0);
|
||||
+ cdj970->xscal = 0;
|
||||
+ cdj970->yscal = 0;
|
||||
+ /* intensities = 4 from initialization */
|
||||
+ }
|
||||
+
|
||||
+ m = (gdev_pcl_paper_size((gx_device *) pdev) ==
|
||||
+ PAPER_SIZE_A4 ? dj_a4 : dj_letter);
|
||||
+
|
||||
+ gx_device_set_margins((gx_device *) pdev, m, true);
|
||||
+
|
||||
/* Set up colour params if put_params has not already done so */
|
||||
if (pdev->color_info.num_components == 0) {
|
||||
- int code = cdj_set_bpp(pdev, pdev->color_info.depth,
|
||||
+ retCode = cdj_set_bpp(pdev, pdev->color_info.depth,
|
||||
pdev->color_info.num_components);
|
||||
|
||||
- if (code < 0)
|
||||
- return code;
|
||||
+ if (retCode < 0)
|
||||
+ return retCode;
|
||||
}
|
||||
|
||||
retCode = gdev_prn_open(pdev);
|
||||
- if (retCode < 0)
|
||||
- return (retCode);
|
||||
- else {
|
||||
+ if (retCode >= 0) {
|
||||
retCode = gdev_prn_open_printer(pdev, true);
|
||||
- if (retCode < 0)
|
||||
- return (retCode);
|
||||
}
|
||||
|
||||
return 0;
|
||||
@@ -648,26 +677,25 @@ cdj970_put_params(gx_device * pdev, gs_param_list * plist)
|
||||
int bpp = 0;
|
||||
int code = 0;
|
||||
|
||||
- code = cdj_put_param_int(plist, "BitsPerPixel", &bpp, 1, 32, code);
|
||||
- code = cdj_put_param_int(plist, "Quality", &quality, 0, 2, code);
|
||||
- code = cdj_put_param_int(plist, "Papertype", &papertype, 0, 4, code);
|
||||
- code = cdj_put_param_int(plist, "Duplex", &duplex, 0, 2, code);
|
||||
- code =
|
||||
- cdj_put_param_float(plist, "MasterGamma", &mastergamma, 0.1, 9.0,
|
||||
- code);
|
||||
- code =
|
||||
- cdj_put_param_float(plist, "GammaValC", &gammavalc, 0.0, 9.0, code);
|
||||
- code =
|
||||
- cdj_put_param_float(plist, "GammaValM", &gammavalm, 0.0, 9.0, code);
|
||||
- code =
|
||||
- cdj_put_param_float(plist, "GammaValY", &gammavaly, 0.0, 9.0, code);
|
||||
- code =
|
||||
- cdj_put_param_float(plist, "GammaValK", &gammavalk, 0.0, 9.0, code);
|
||||
- code =
|
||||
- cdj_put_param_float(plist, "BlackCorrect", &blackcorrect, 0.0, 9.0,
|
||||
- code);
|
||||
-
|
||||
- if (code < 0)
|
||||
+ if ((code = cdj_put_param_int(plist, "BitsPerPixel", &bpp, 1, 32, code)) < 0)
|
||||
+ return code;
|
||||
+ if ((code = cdj_put_param_int(plist, "Quality", &quality, 0, 2, code)) < 0)
|
||||
+ return code;
|
||||
+ if ((code = cdj_put_param_int(plist, "Papertype", &papertype, 0, 4, code)) < 0)
|
||||
+ return code;
|
||||
+ if ((code = cdj_put_param_int(plist, "Duplex", &duplex, 0, 2, code)) < 0)
|
||||
+ return code;
|
||||
+ if ((code = cdj_put_param_float(plist, "MasterGamma", &mastergamma, 0.1, 9.0, code)) < 0)
|
||||
+ return code;
|
||||
+ if ((code = cdj_put_param_float(plist, "GammaValC", &gammavalc, 0.0, 9.0, code)) < 0)
|
||||
+ return code;
|
||||
+ if ((code = cdj_put_param_float(plist, "GammaValM", &gammavalm, 0.0, 9.0, code)) < 0)
|
||||
+ return code;
|
||||
+ if ((code = cdj_put_param_float(plist, "GammaValY", &gammavaly, 0.0, 9.0, code)) < 0)
|
||||
+ return code;
|
||||
+ if ((code = cdj_put_param_float(plist, "GammaValK", &gammavalk, 0.0, 9.0, code)) < 0)
|
||||
+ return code;
|
||||
+ if ((code = cdj_put_param_float(plist, "BlackCorrect", &blackcorrect, 0.0, 9.0, code)) < 0)
|
||||
return code;
|
||||
|
||||
code = cdj_put_param_bpp(pdev, plist, bpp, bpp, 0);
|
||||
@@ -676,6 +704,12 @@ cdj970_put_params(gx_device * pdev, gs_param_list * plist)
|
||||
return code;
|
||||
|
||||
cdj970->quality = quality;
|
||||
+ if (cdj970->quality != quality) {
|
||||
+ if (pdev->is_open)
|
||||
+ gs_closedevice(pdev); /* quality can change resolution, force re-open */
|
||||
+ cdj970->quality = quality;
|
||||
+ }
|
||||
+
|
||||
cdj970->papertype = papertype;
|
||||
cdj970->duplex = duplex;
|
||||
cdj970->mastergamma = mastergamma;
|
||||
@@ -685,7 +719,7 @@ cdj970_put_params(gx_device * pdev, gs_param_list * plist)
|
||||
cdj970->gammavalk = gammavalk;
|
||||
cdj970->blackcorrect = blackcorrect;
|
||||
|
||||
- return 0;
|
||||
+ return code;
|
||||
}
|
||||
|
||||
/**********************************************************************************/
|
||||
@@ -784,47 +818,6 @@ cdj970_terminate_page(gx_device_printer * pdev, FILE * prn_stream)
|
||||
fputs("\033*rC\f\033&l-2H", prn_stream); /* End Graphics, Reset */
|
||||
}
|
||||
|
||||
-/* cdj970_one_time_initialisation:
|
||||
-----------------------------------------------------------------------------------*/
|
||||
-static void
|
||||
-cdj970_one_time_initialisation(gx_device_printer * pdev)
|
||||
-{
|
||||
- /* Change the margins if necessary. */
|
||||
- static const float dj_a4[4] = {
|
||||
- DESKJET_MARGINS_A4
|
||||
- };
|
||||
-
|
||||
- static const float dj_letter[4] = {
|
||||
- DESKJET_MARGINS_LETTER
|
||||
- };
|
||||
- const float *m = (float *)0;
|
||||
-
|
||||
- /* quality setup */
|
||||
- if (cdj970->quality == DRAFT) {
|
||||
- gx_device_set_resolution((gx_device *) pdev, 300.0, 300.0);
|
||||
- cdj970->xscal = 0;
|
||||
- cdj970->yscal = 0;
|
||||
- cdj970->intensities = 2;
|
||||
- } else if (cdj970->quality == NORMAL) {
|
||||
- gx_device_set_resolution((gx_device *) pdev, 600.0, 600.0);
|
||||
- cdj970->xscal = 1;
|
||||
- cdj970->yscal = 1;
|
||||
- /* intensities = 4 from initialization */
|
||||
- } else { /* quality == PRESENTATION */
|
||||
- gx_device_set_resolution((gx_device *) pdev, 600.0, 600.0);
|
||||
- cdj970->xscal = 0;
|
||||
- cdj970->yscal = 0;
|
||||
- /* intensities = 4 from initialization */
|
||||
- }
|
||||
-
|
||||
- m = (gdev_pcl_paper_size((gx_device *) pdev) ==
|
||||
- PAPER_SIZE_A4 ? dj_a4 : dj_letter);
|
||||
-
|
||||
- gx_device_set_margins((gx_device *) pdev, m, true);
|
||||
-
|
||||
- cdj970_write_header((gx_device *) pdev, pdev->file);
|
||||
-}
|
||||
-
|
||||
/* cdj970_print_page: Here comes the hp970 output routine
|
||||
----------------------------------------------------------------------------------*/
|
||||
static int
|
||||
@@ -837,7 +830,7 @@ cdj970_print_page(gx_device_printer * pdev, FILE * prn_stream)
|
||||
Gamma gamma;
|
||||
|
||||
if (cdj970->PageCtr == 0 && cdj970->ptype == DJ970C) {
|
||||
- cdj970_one_time_initialisation(pdev);
|
||||
+ cdj970_write_header((gx_device *)pdev, prn_stream);
|
||||
}
|
||||
|
||||
/* make a local writable copy of the Gamma tables */
|
||||
@@ -2280,6 +2273,11 @@ cdj_set_bpp(gx_device * pdev, int bpp, int ccomps)
|
||||
ci->dither_colors = (bpp >= 8 ? 5 : bpp > 1 ? 2 : 0);
|
||||
}
|
||||
|
||||
+ if (ci->depth != ((bpp > 1) && (bpp < 8) ? 8 : bpp)) {
|
||||
+ if (pdev->is_open)
|
||||
+ gs_closedevice(pdev); /* depth changed, make sure we re-open */
|
||||
+ }
|
||||
+
|
||||
ci->depth = ((bpp > 1) && (bpp < 8) ? 8 : bpp);
|
||||
|
||||
return (0);
|
||||
@@ -2598,16 +2596,15 @@ cdj_put_param_bpp(gx_device * pdev,
|
||||
gs_param_list * plist,
|
||||
int new_bpp, int real_bpp, int ccomps)
|
||||
{
|
||||
- if (new_bpp == 0 && ccomps == 0)
|
||||
- return gdev_prn_put_params(pdev, plist);
|
||||
- else {
|
||||
- gx_device_color_info save_info;
|
||||
- int save_bpp;
|
||||
- int code;
|
||||
-
|
||||
- save_info = pdev->color_info;
|
||||
- save_bpp = save_info.depth;
|
||||
+ int code = 0;
|
||||
+ int save_bpp;
|
||||
+ gx_device_color_info save_info;
|
||||
+ save_info = pdev->color_info;
|
||||
+ save_bpp = save_info.depth;
|
||||
|
||||
+ if (new_bpp == 0 && ccomps == 0) {
|
||||
+ code = gdev_prn_put_params(pdev, plist);
|
||||
+ } else {
|
||||
if (save_bpp == 8 && save_ccomps == 3 && !cprn_device->cmyk)
|
||||
save_bpp = 3;
|
||||
|
||||
@@ -2631,12 +2628,22 @@ cdj_put_param_bpp(gx_device * pdev,
|
||||
if ((cdj970->color_info.depth != save_bpp
|
||||
|| (ccomps != 0 && ccomps != save_ccomps))
|
||||
&& pdev->is_open)
|
||||
- return (gs_closedevice(pdev));
|
||||
+ gs_closedevice(pdev);
|
||||
+ }
|
||||
+
|
||||
+ /* check for valid resolutions */
|
||||
+ if (pdev->HWResolution[0] != pdev->HWResolution[1] ||
|
||||
+ (pdev->HWResolution[0] != 300.0 && pdev->HWResolution[0] != 600.0) ) {
|
||||
+ param_signal_error(plist, "HWResolution", gs_error_rangecheck);
|
||||
+ emprintf1(pdev->memory, "\ncdj970: Invalid resolution: '%f'. Only 300 or 600 supported.\n\n",
|
||||
+ pdev->HWResolution[0]);
|
||||
+ cdj_set_bpp(pdev, save_bpp, save_ccomps);
|
||||
+ return gs_error_rangecheck;
|
||||
+ }
|
||||
+ return code;
|
||||
|
||||
- return (0);
|
||||
|
||||
#undef save_ccomps
|
||||
- }
|
||||
}
|
||||
|
||||
/* cdj970_write_header:
|
13
ghostscript-cve-2020-16293.patch
Normal file
13
ghostscript-cve-2020-16293.patch
Normal file
@ -0,0 +1,13 @@
|
||||
diff --git a/base/gxblend.c b/base/gxblend.c
|
||||
index 7c3d55b..55215d6 100644
|
||||
--- a/base/gxblend.c
|
||||
+++ b/base/gxblend.c
|
||||
@@ -2174,7 +2174,7 @@ pdf14_compose_group(pdf14_buf *tos, pdf14_buf *nos, pdf14_buf *maskbuf,
|
||||
overprint == 0) {
|
||||
/* Additive vs Subtractive makes no difference in normal blend mode with no spots */
|
||||
if (tos_isolated) {
|
||||
- if (has_mask || maskbuf) {/* 7% */
|
||||
+ if (has_mask && maskbuf) {/* 7% */
|
||||
/* AirPrint test case hits this */
|
||||
if (maskbuf && maskbuf->rect.p.x <= x0 && maskbuf->rect.p.y <= y0 &&
|
||||
maskbuf->rect.q.x >= x1 && maskbuf->rect.q.y >= y1)
|
13
ghostscript-cve-2020-16295.patch
Normal file
13
ghostscript-cve-2020-16295.patch
Normal file
@ -0,0 +1,13 @@
|
||||
diff --git a/devices/gdevclj.c b/devices/gdevclj.c
|
||||
index bed13bc..fe17ece 100644
|
||||
--- a/devices/gdevclj.c
|
||||
+++ b/devices/gdevclj.c
|
||||
@@ -254,7 +254,7 @@ clj_media_size(float mediasize[2], gs_param_list *plist)
|
||||
gs_param_int_array hwsize;
|
||||
int have_pagesize = 0;
|
||||
|
||||
- if ( (param_read_float_array(plist, "HWResolution", &fres) == 0) &&
|
||||
+ if ( param_read_float_array(plist, "HWResolution", &fres) != 0 ||
|
||||
!is_supported_resolution(fres.data) )
|
||||
return_error(gs_error_rangecheck);
|
||||
|
58
ghostscript-cve-2020-16299.patch
Normal file
58
ghostscript-cve-2020-16299.patch
Normal file
@ -0,0 +1,58 @@
|
||||
diff --git a/contrib/japanese/gdev10v.c b/contrib/japanese/gdev10v.c
|
||||
index 5c8b7fb..53da0ec 100644
|
||||
--- a/contrib/japanese/gdev10v.c
|
||||
+++ b/contrib/japanese/gdev10v.c
|
||||
@@ -73,8 +73,20 @@ gx_device_procs prn_bj10v_procs =
|
||||
prn_matrix_procs(gdev_prn_open, bj10v_get_initial_matrix,
|
||||
gdev_prn_output_page, gdev_prn_close);
|
||||
#endif
|
||||
+
|
||||
+static int
|
||||
+bj10v_open(gx_device * pdev)
|
||||
+{
|
||||
+ if (pdev->HWResolution[0] < 180 ||
|
||||
+ pdev->HWResolution[1] < 180)
|
||||
+ {
|
||||
+ emprintf(pdev->memory, "device requires a resolution of at least 180dpi\n");
|
||||
+ return_error(gs_error_rangecheck);
|
||||
+ }
|
||||
+ return gdev_prn_open(pdev);
|
||||
+}
|
||||
gx_device_procs prn_bj10v_procs =
|
||||
- prn_procs(gdev_prn_open, gdev_prn_output_page, gdev_prn_close);
|
||||
+ prn_procs(bj10v_open, gdev_prn_output_page, gdev_prn_close);
|
||||
|
||||
gx_device_printer gs_bj10v_device =
|
||||
prn_device(prn_bj10v_procs, "bj10v",
|
||||
diff --git a/contrib/japanese/gdevalps.c b/contrib/japanese/gdevalps.c
|
||||
index f29aeb1..d4de619 100644
|
||||
--- a/contrib/japanese/gdevalps.c
|
||||
+++ b/contrib/japanese/gdevalps.c
|
||||
@@ -155,13 +155,20 @@ static const char end_md[] = {
|
||||
static int
|
||||
md_open(gx_device *pdev)
|
||||
{
|
||||
- static const float md_margins[4] =
|
||||
- { MD_SIDE_MARGIN, MD_BOTTOM_MARGIN,
|
||||
- MD_SIDE_MARGIN, MD_TOP_MARGIN
|
||||
- };
|
||||
-
|
||||
- gx_device_set_margins(pdev, md_margins, true);
|
||||
- return gdev_prn_open(pdev);
|
||||
+ static const float md_margins[4] =
|
||||
+ {
|
||||
+ MD_SIDE_MARGIN, MD_BOTTOM_MARGIN,
|
||||
+ MD_SIDE_MARGIN, MD_TOP_MARGIN
|
||||
+ };
|
||||
+
|
||||
+ if (pdev->HWResolution[0] != 600)
|
||||
+ {
|
||||
+ emprintf(pdev->memory, "device must have an X resolution of 600dpi\n");
|
||||
+ return_error(gs_error_rangecheck);
|
||||
+ }
|
||||
+
|
||||
+ gx_device_set_margins(pdev, md_margins, true);
|
||||
+ return gdev_prn_open(pdev);
|
||||
}
|
||||
|
||||
/* MD5000 monochrome mode entrance. */
|
228
ghostscript-cve-2020-16302.patch
Normal file
228
ghostscript-cve-2020-16302.patch
Normal file
@ -0,0 +1,228 @@
|
||||
diff --git a/devices/gdev3852.c b/devices/gdev3852.c
|
||||
index 2bee8ec..9d99068 100644
|
||||
--- a/devices/gdev3852.c
|
||||
+++ b/devices/gdev3852.c
|
||||
@@ -62,116 +62,117 @@ jetp3852_print_page(gx_device_printer *pdev, FILE *prn_stream)
|
||||
#define DATA_SIZE (LINE_SIZE * 8)
|
||||
|
||||
unsigned int cnt_2prn;
|
||||
- unsigned int count,tempcnt;
|
||||
- unsigned char vtp,cntc1,cntc2;
|
||||
- int line_size_color_plane;
|
||||
-
|
||||
- byte data[DATA_SIZE];
|
||||
- byte plane_data[LINE_SIZE * 3];
|
||||
-
|
||||
- /* Set initial condition for printer */
|
||||
- fputs("\033@",prn_stream);
|
||||
-
|
||||
- /* Send each scan line in turn */
|
||||
- { int lnum;
|
||||
- int line_size = gdev_mem_bytes_per_scan_line((gx_device *)pdev);
|
||||
- int num_blank_lines = 0;
|
||||
-
|
||||
- if (line_size > DATA_SIZE) {
|
||||
- emprintf2(pdev->memory, "invalid resolution and/or width gives line_size = %d, max. is %d\n",
|
||||
- line_size, DATA_SIZE);
|
||||
- return_error(gs_error_rangecheck);
|
||||
- }
|
||||
-
|
||||
- for ( lnum = 0; lnum < pdev->height; lnum++ )
|
||||
- { byte *end_data = data + line_size;
|
||||
- gdev_prn_copy_scan_lines(pdev, lnum,
|
||||
- (byte *)data, line_size);
|
||||
- /* Remove trailing 0s. */
|
||||
- while ( end_data > data && end_data[-1] == 0 )
|
||||
- end_data--;
|
||||
- if ( end_data == data )
|
||||
- { /* Blank line */
|
||||
- num_blank_lines++;
|
||||
- }
|
||||
- else
|
||||
- { int i;
|
||||
- byte *odp;
|
||||
- byte *row;
|
||||
-
|
||||
- /* Pad with 0s to fill out the last */
|
||||
- /* block of 8 bytes. */
|
||||
- memset(end_data, 0, 7);
|
||||
-
|
||||
- /* Transpose the data to get pixel planes. */
|
||||
- for ( i = 0, odp = plane_data; i < DATA_SIZE;
|
||||
- i += 8, odp++
|
||||
- )
|
||||
- { /* The following is for 16-bit machines */
|
||||
+ unsigned int count,tempcnt;
|
||||
+ unsigned char vtp,cntc1,cntc2;
|
||||
+ int line_size_color_plane;
|
||||
+
|
||||
+ byte data[DATA_SIZE];
|
||||
+ byte plane_data[LINE_SIZE * 3];
|
||||
+
|
||||
+ /* Initialise data to zeros, otherwise later on, uninitialised bytes in
|
||||
+ dp[] can be greater than 7, which breaks spr8[dp[]]. */
|
||||
+ memset(data, 0x00, DATA_SIZE);
|
||||
+
|
||||
+
|
||||
+ /* Set initial condition for printer */
|
||||
+ fputs("\033@",prn_stream);
|
||||
+
|
||||
+ /* Send each scan line in turn */
|
||||
+ { int lnum;
|
||||
+ int line_size = gdev_mem_bytes_per_scan_line((gx_device *)pdev);
|
||||
+ int num_blank_lines = 0;
|
||||
+
|
||||
+ if (line_size > DATA_SIZE) {
|
||||
+ emprintf2(pdev->memory, "invalid resolution and/or width gives line_size = %d, max. is %d\n",
|
||||
+ line_size, DATA_SIZE);
|
||||
+ return_error(gs_error_rangecheck);
|
||||
+ }
|
||||
+
|
||||
+ for ( lnum = 0; lnum < pdev->height; lnum++ )
|
||||
+ { byte *end_data = data + line_size;
|
||||
+ gdev_prn_copy_scan_lines(pdev, lnum,
|
||||
+ (byte *)data, line_size);
|
||||
+ /* Remove trailing 0s. */
|
||||
+ while ( end_data > data && end_data[-1] == 0 )
|
||||
+ end_data--;
|
||||
+ if ( end_data == data )
|
||||
+ { /* Blank line */
|
||||
+ num_blank_lines++;
|
||||
+ }
|
||||
+ else
|
||||
+ { int i;
|
||||
+ byte *odp;
|
||||
+ byte *row;
|
||||
+
|
||||
+ /* Transpose the data to get pixel planes. */
|
||||
+ for ( i = 0, odp = plane_data; i < DATA_SIZE;
|
||||
+ i += 8, odp++
|
||||
+ )
|
||||
+ { /* The following is for 16-bit machines */
|
||||
#define spread3(c)\
|
||||
{ 0, c, c*0x100, c*0x101, c*0x10000L, c*0x10001L, c*0x10100L, c*0x10101L }
|
||||
- static ulong spr40[8] = spread3(0x40);
|
||||
- static ulong spr8[8] = spread3(8);
|
||||
- static ulong spr2[8] = spread3(2);
|
||||
- register byte *dp = data + i;
|
||||
- register ulong pword =
|
||||
- (spr40[dp[0]] << 1) +
|
||||
- (spr40[dp[1]]) +
|
||||
- (spr40[dp[2]] >> 1) +
|
||||
- (spr8[dp[3]] << 1) +
|
||||
- (spr8[dp[4]]) +
|
||||
- (spr8[dp[5]] >> 1) +
|
||||
- (spr2[dp[6]]) +
|
||||
- (spr2[dp[7]] >> 1);
|
||||
- odp[0] = (byte)(pword >> 16);
|
||||
- odp[LINE_SIZE] = (byte)(pword >> 8);
|
||||
- odp[LINE_SIZE*2] = (byte)(pword);
|
||||
- }
|
||||
- /* Skip blank lines if any */
|
||||
- if ( num_blank_lines > 0 )
|
||||
- {
|
||||
- /* Do "dot skips" */
|
||||
- while(num_blank_lines > 255)
|
||||
- {
|
||||
- fputs("\033e\377",prn_stream);
|
||||
- num_blank_lines -= 255;
|
||||
- }
|
||||
- vtp = num_blank_lines;
|
||||
- fprintf(prn_stream,"\033e%c",vtp);
|
||||
- num_blank_lines = 0;
|
||||
- }
|
||||
-
|
||||
- /* Transfer raster graphics in the order R, G, B. */
|
||||
- /* Apparently it is stored in B, G, R */
|
||||
- /* Calculate the amount of data to send by what */
|
||||
- /* Ghostscript tells us the scan line_size in (bytes) */
|
||||
-
|
||||
- count = line_size / 3;
|
||||
- line_size_color_plane = count / 3;
|
||||
- cnt_2prn = line_size_color_plane * 3 + 5;
|
||||
- tempcnt = cnt_2prn;
|
||||
- cntc1 = (tempcnt & 0xFF00) >> 8;
|
||||
- cntc2 = (tempcnt & 0x00FF);
|
||||
- fprintf(prn_stream, "\033[O%c%c\200\037",cntc2,cntc1);
|
||||
- fputc('\000',prn_stream);
|
||||
+ static ulong spr40[8] = spread3(0x40);
|
||||
+ static ulong spr8[8] = spread3(8);
|
||||
+ static ulong spr2[8] = spread3(2);
|
||||
+ register byte *dp = data + i;
|
||||
+ register ulong pword =
|
||||
+ (spr40[dp[0]] << 1) +
|
||||
+ (spr40[dp[1]]) +
|
||||
+ (spr40[dp[2]] >> 1) +
|
||||
+ (spr8[dp[3]] << 1) +
|
||||
+ (spr8[dp[4]]) +
|
||||
+ (spr8[dp[5]] >> 1) +
|
||||
+ (spr2[dp[6]]) +
|
||||
+ (spr2[dp[7]] >> 1);
|
||||
+ odp[0] = (byte)(pword >> 16);
|
||||
+ odp[LINE_SIZE] = (byte)(pword >> 8);
|
||||
+ odp[LINE_SIZE*2] = (byte)(pword);
|
||||
+ }
|
||||
+ /* Skip blank lines if any */
|
||||
+ if ( num_blank_lines > 0 )
|
||||
+ {
|
||||
+ /* Do "dot skips" */
|
||||
+ while(num_blank_lines > 255)
|
||||
+ {
|
||||
+ fputs("\033e\377",prn_stream);
|
||||
+ num_blank_lines -= 255;
|
||||
+ }
|
||||
+ vtp = num_blank_lines;
|
||||
+ fprintf(prn_stream,"\033e%c",vtp);
|
||||
+ num_blank_lines = 0;
|
||||
+ }
|
||||
+
|
||||
+ /* Transfer raster graphics in the order R, G, B. */
|
||||
+ /* Apparently it is stored in B, G, R */
|
||||
+ /* Calculate the amount of data to send by what */
|
||||
+ /* Ghostscript tells us the scan line_size in (bytes) */
|
||||
+
|
||||
+ count = line_size / 3;
|
||||
+ line_size_color_plane = count / 3;
|
||||
+ cnt_2prn = line_size_color_plane * 3 + 5;
|
||||
+ tempcnt = cnt_2prn;
|
||||
+ cntc1 = (tempcnt & 0xFF00) >> 8;
|
||||
+ cntc2 = (tempcnt & 0x00FF);
|
||||
+ fprintf(prn_stream, "\033[O%c%c\200\037",cntc2,cntc1);
|
||||
+ fputc('\000',prn_stream);
|
||||
fputs("\124\124",prn_stream);
|
||||
|
||||
- for ( row = plane_data + LINE_SIZE * 2, i = 0;
|
||||
- i < 3; row -= LINE_SIZE, i++ )
|
||||
- { int jj;
|
||||
- byte ctemp;
|
||||
- odp = row;
|
||||
- /* Complement bytes */
|
||||
- for (jj=0; jj< line_size_color_plane; jj++)
|
||||
- { ctemp = *odp;
|
||||
- *odp++ = ~ctemp;
|
||||
- }
|
||||
- fwrite(row, sizeof(byte),
|
||||
- line_size_color_plane, prn_stream);
|
||||
- }
|
||||
- }
|
||||
- }
|
||||
- }
|
||||
+ for ( row = plane_data + LINE_SIZE * 2, i = 0;
|
||||
+ i < 3; row -= LINE_SIZE, i++ )
|
||||
+ { int jj;
|
||||
+ byte ctemp;
|
||||
+ odp = row;
|
||||
+ /* Complement bytes */
|
||||
+ for (jj=0; jj< line_size_color_plane; jj++)
|
||||
+ { ctemp = *odp;
|
||||
+ *odp++ = ~ctemp;
|
||||
+ }
|
||||
+ fwrite(row, sizeof(byte),
|
||||
+ line_size_color_plane, prn_stream);
|
||||
+ }
|
||||
+ }
|
||||
+ }
|
||||
+ }
|
||||
|
||||
/* eject page */
|
||||
fputs("\014", prn_stream);
|
77
ghostscript-cve-2020-16304.patch
Normal file
77
ghostscript-cve-2020-16304.patch
Normal file
@ -0,0 +1,77 @@
|
||||
diff --git a/base/gxicolor.c b/base/gxicolor.c
|
||||
index 34cfaa4..585bd81 100644
|
||||
--- a/base/gxicolor.c
|
||||
+++ b/base/gxicolor.c
|
||||
@@ -644,16 +644,16 @@ image_render_color_thresh(gx_image_enum *penum_orig, const byte *buffer, int dat
|
||||
*(devc_contone_gray+1) = *psrc_temp;
|
||||
}
|
||||
} else {
|
||||
- /* Mono case, forward */
|
||||
- psrc_temp = psrc_cm;
|
||||
- for (k=0; k<src_size; k++) {
|
||||
- dda_next(dda_ht);
|
||||
- xn = fixed2int_var_rounded(dda_current(dda_ht));
|
||||
- while (xr < xn) {
|
||||
- *devc_contone_gray++ = *psrc_temp;
|
||||
- xr++;
|
||||
- } /* at loop exit xn will be >= xr */
|
||||
- psrc_temp++;
|
||||
+ /* Mono case, forward */
|
||||
+ psrc_temp = psrc_cm;
|
||||
+ for (k=0; k<src_size; k++) {
|
||||
+ dda_next(dda_ht);
|
||||
+ xn = fixed2int_var_rounded(dda_current(dda_ht));
|
||||
+ while (xr < xn) {
|
||||
+ *devc_contone_gray++ = *psrc_temp;
|
||||
+ xr++;
|
||||
+ } /* at loop exit xn will be >= xr */
|
||||
+ psrc_temp++;
|
||||
}
|
||||
}
|
||||
} else {
|
||||
@@ -668,7 +668,7 @@ image_render_color_thresh(gx_image_enum *penum_orig, const byte *buffer, int dat
|
||||
xr--;
|
||||
} /* at loop exit xn will be >= xr */
|
||||
psrc_temp++;
|
||||
- }
|
||||
+ }
|
||||
}
|
||||
break;
|
||||
/* Monochrome landscape */
|
||||
@@ -811,10 +811,9 @@ image_render_color_thresh(gx_image_enum *penum_orig, const byte *buffer, int dat
|
||||
dda_next(dda_ht);
|
||||
xn = fixed2int_var_rounded(dda_current(dda_ht));
|
||||
while (xr > xn) {
|
||||
- for (j = 0; j < spp_out; j++) {
|
||||
+ for (j = 0; j < spp_out; j++)
|
||||
*(devc_contone[j] + position) = (psrc_plane[j])[i];
|
||||
- position -= LAND_BITS;
|
||||
- }
|
||||
+ position -= LAND_BITS;
|
||||
xr--;
|
||||
} /* at loop exit xn will be <= xr */
|
||||
i++;
|
||||
@@ -825,9 +824,8 @@ image_render_color_thresh(gx_image_enum *penum_orig, const byte *buffer, int dat
|
||||
and 2x scaling which we will run into in 300 and
|
||||
600dpi devices and content */
|
||||
/* Apply initial offset */
|
||||
- for (k = 0; k < spp_out; k++) {
|
||||
+ for (k = 0; k < spp_out; k++)
|
||||
devc_contone[k] = devc_contone[k] + position;
|
||||
- }
|
||||
if (src_size == dest_height) {
|
||||
for (k = 0; k < data_length; k++) {
|
||||
/* Is it better to unwind this? We know it is 4 */
|
||||
@@ -853,10 +851,9 @@ image_render_color_thresh(gx_image_enum *penum_orig, const byte *buffer, int dat
|
||||
dda_next(dda_ht);
|
||||
xn = fixed2int_var_rounded(dda_current(dda_ht));
|
||||
while (xr > xn) {
|
||||
- for (j = 0; j < spp_out; j++) {
|
||||
+ for (j = 0; j < spp_out; j++)
|
||||
*(devc_contone[j] + position) = (psrc_plane[j])[i];
|
||||
- position -= LAND_BITS;
|
||||
- }
|
||||
+ position -= LAND_BITS;
|
||||
xr--;
|
||||
} /* at loop exit xn will be <= xr */
|
||||
i++;
|
20
ghostscript-cve-2020-16306.patch
Normal file
20
ghostscript-cve-2020-16306.patch
Normal file
@ -0,0 +1,20 @@
|
||||
diff --git a/devices/gdevtsep.c b/devices/gdevtsep.c
|
||||
index 6a50a4a..471fcb5 100644
|
||||
--- a/devices/gdevtsep.c
|
||||
+++ b/devices/gdevtsep.c
|
||||
@@ -2332,6 +2332,7 @@ tiffsep_print_page(gx_device_printer * pdev, FILE * file)
|
||||
"\nUse of the %%d format is required to output more than one page to tiffsep.\n"
|
||||
"See doc/Devices.htm#TIFF for details.\n\n");
|
||||
code = gs_note_error(gs_error_ioerror);
|
||||
+ goto done;
|
||||
}
|
||||
/* Write the page directory for the CMYK equivalent file. */
|
||||
if (!tfdev->comp_file) {
|
||||
@@ -2685,6 +2686,7 @@ tiffsep1_print_page(gx_device_printer * pdev, FILE * file)
|
||||
"\nUse of the %%d format is required to output more than one page to tiffsep1.\n"
|
||||
"See doc/Devices.htm#TIFF for details.\n\n");
|
||||
code = gs_note_error(gs_error_ioerror);
|
||||
+ goto done;
|
||||
}
|
||||
/* If the output file is on disk and the name contains a page #, */
|
||||
/* then delete the previous file. */
|
205
ghostscript-cve-2020-16307.patch
Normal file
205
ghostscript-cve-2020-16307.patch
Normal file
@ -0,0 +1,205 @@
|
||||
diff --git a/devices/vector/gdevtxtw.c b/devices/vector/gdevtxtw.c
|
||||
index b958027..7f02608 100644
|
||||
--- a/devices/vector/gdevtxtw.c
|
||||
+++ b/devices/vector/gdevtxtw.c
|
||||
@@ -1693,97 +1693,100 @@ static int get_unicode(textw_text_enum_t *penum, gs_font *font, gs_glyph glyph,
|
||||
|
||||
length = font->procs.decode_glyph((gs_font *)font, glyph, ch, NULL, 0);
|
||||
if (length == 0) {
|
||||
- code = font->procs.glyph_name(font, glyph, &gnstr);
|
||||
- if (code >= 0 && gnstr.size == 7) {
|
||||
- if (!memcmp(gnstr.data, "uni", 3)) {
|
||||
- static const char *hexdigits = "0123456789ABCDEF";
|
||||
- char *d0 = strchr(hexdigits, gnstr.data[3]);
|
||||
- char *d1 = strchr(hexdigits, gnstr.data[4]);
|
||||
- char *d2 = strchr(hexdigits, gnstr.data[5]);
|
||||
- char *d3 = strchr(hexdigits, gnstr.data[6]);
|
||||
-
|
||||
- if (d0 != NULL && d1 != NULL && d2 != NULL && d3 != NULL) {
|
||||
- *Buffer++ = ((d0 - hexdigits) << 12) + ((d1 - hexdigits) << 8) + ((d2 - hexdigits) << 4) + (d3 - hexdigits);
|
||||
- return 1;
|
||||
- }
|
||||
- }
|
||||
- }
|
||||
- if (length == 0) {
|
||||
- single_glyph_list_t *sentry = (single_glyph_list_t *)&SingleGlyphList;
|
||||
- double_glyph_list_t *dentry = (double_glyph_list_t *)&DoubleGlyphList;
|
||||
- treble_glyph_list_t *tentry = (treble_glyph_list_t *)&TrebleGlyphList;
|
||||
- quad_glyph_list_t *qentry = (quad_glyph_list_t *)&QuadGlyphList;
|
||||
-
|
||||
- /* Search glyph to single Unicode value table */
|
||||
- while (sentry->Glyph != 0) {
|
||||
- if (sentry->Glyph[0] < gnstr.data[0]) {
|
||||
- sentry++;
|
||||
- continue;
|
||||
- }
|
||||
- if (sentry->Glyph[0] > gnstr.data[0]){
|
||||
- break;
|
||||
- }
|
||||
- if (strlen(sentry->Glyph) == gnstr.size) {
|
||||
- if(memcmp(gnstr.data, sentry->Glyph, gnstr.size) == 0) {
|
||||
- *Buffer = sentry->Unicode;
|
||||
+ if (glyph != GS_NO_GLYPH) {
|
||||
+ code = font->procs.glyph_name(font, glyph, &gnstr);
|
||||
+ if (code >= 0 && gnstr.size == 7) {
|
||||
+ if (!memcmp(gnstr.data, "uni", 3)) {
|
||||
+ static const char *hexdigits = "0123456789ABCDEF";
|
||||
+ char *d0 = strchr(hexdigits, gnstr.data[3]);
|
||||
+ char *d1 = strchr(hexdigits, gnstr.data[4]);
|
||||
+ char *d2 = strchr(hexdigits, gnstr.data[5]);
|
||||
+ char *d3 = strchr(hexdigits, gnstr.data[6]);
|
||||
+
|
||||
+ if (d0 != NULL && d1 != NULL && d2 != NULL && d3 != NULL) {
|
||||
+ *Buffer++ = ((d0 - hexdigits) << 12) + ((d1 - hexdigits) << 8) + ((d2 - hexdigits) << 4) + (d3 - hexdigits);
|
||||
return 1;
|
||||
}
|
||||
}
|
||||
- sentry++;
|
||||
}
|
||||
|
||||
- /* Search glyph to double Unicode value table */
|
||||
- while (dentry->Glyph != 0) {
|
||||
- if (dentry->Glyph[0] < gnstr.data[0]) {
|
||||
- dentry++;
|
||||
- continue;
|
||||
- }
|
||||
- if (dentry->Glyph[0] > gnstr.data[0]){
|
||||
- break;
|
||||
- }
|
||||
- if (strlen(dentry->Glyph) == gnstr.size) {
|
||||
- if(memcmp(gnstr.data, dentry->Glyph, gnstr.size) == 0) {
|
||||
- memcpy(Buffer, dentry->Unicode, 2);
|
||||
- return 2;
|
||||
+ if (length == 0) {
|
||||
+ single_glyph_list_t *sentry = (single_glyph_list_t *)&SingleGlyphList;
|
||||
+ double_glyph_list_t *dentry = (double_glyph_list_t *)&DoubleGlyphList;
|
||||
+ treble_glyph_list_t *tentry = (treble_glyph_list_t *)&TrebleGlyphList;
|
||||
+ quad_glyph_list_t *qentry = (quad_glyph_list_t *)&QuadGlyphList;
|
||||
+
|
||||
+ /* Search glyph to single Unicode value table */
|
||||
+ while (sentry->Glyph != 0) {
|
||||
+ if (sentry->Glyph[0] < gnstr.data[0]) {
|
||||
+ sentry++;
|
||||
+ continue;
|
||||
+ }
|
||||
+ if (sentry->Glyph[0] > gnstr.data[0]){
|
||||
+ break;
|
||||
+ }
|
||||
+ if (strlen(sentry->Glyph) == gnstr.size) {
|
||||
+ if(memcmp(gnstr.data, sentry->Glyph, gnstr.size) == 0) {
|
||||
+ *Buffer = sentry->Unicode;
|
||||
+ return 1;
|
||||
+ }
|
||||
}
|
||||
+ sentry++;
|
||||
}
|
||||
- dentry++;
|
||||
- }
|
||||
|
||||
- /* Search glyph to triple Unicode value table */
|
||||
- while (tentry->Glyph != 0) {
|
||||
- if (tentry->Glyph[0] < gnstr.data[0]) {
|
||||
- tentry++;
|
||||
- continue;
|
||||
- }
|
||||
- if (tentry->Glyph[0] > gnstr.data[0]){
|
||||
- break;
|
||||
- }
|
||||
- if (strlen(tentry->Glyph) == gnstr.size) {
|
||||
- if(memcmp(gnstr.data, tentry->Glyph, gnstr.size) == 0) {
|
||||
- memcpy(Buffer, tentry->Unicode, 3);
|
||||
- return 3;
|
||||
+ /* Search glyph to double Unicode value table */
|
||||
+ while (dentry->Glyph != 0) {
|
||||
+ if (dentry->Glyph[0] < gnstr.data[0]) {
|
||||
+ dentry++;
|
||||
+ continue;
|
||||
}
|
||||
+ if (dentry->Glyph[0] > gnstr.data[0]){
|
||||
+ break;
|
||||
+ }
|
||||
+ if (strlen(dentry->Glyph) == gnstr.size) {
|
||||
+ if(memcmp(gnstr.data, dentry->Glyph, gnstr.size) == 0) {
|
||||
+ memcpy(Buffer, dentry->Unicode, 2);
|
||||
+ return 2;
|
||||
+ }
|
||||
+ }
|
||||
+ dentry++;
|
||||
}
|
||||
- tentry++;
|
||||
- }
|
||||
|
||||
- /* Search glyph to quadruple Unicode value table */
|
||||
- while (qentry->Glyph != 0) {
|
||||
- if (qentry->Glyph[0] < gnstr.data[0]) {
|
||||
- qentry++;
|
||||
- continue;
|
||||
- }
|
||||
- if (qentry->Glyph[0] > gnstr.data[0]){
|
||||
- break;
|
||||
+ /* Search glyph to triple Unicode value table */
|
||||
+ while (tentry->Glyph != 0) {
|
||||
+ if (tentry->Glyph[0] < gnstr.data[0]) {
|
||||
+ tentry++;
|
||||
+ continue;
|
||||
+ }
|
||||
+ if (tentry->Glyph[0] > gnstr.data[0]){
|
||||
+ break;
|
||||
+ }
|
||||
+ if (strlen(tentry->Glyph) == gnstr.size) {
|
||||
+ if(memcmp(gnstr.data, tentry->Glyph, gnstr.size) == 0) {
|
||||
+ memcpy(Buffer, tentry->Unicode, 3);
|
||||
+ return 3;
|
||||
+ }
|
||||
+ }
|
||||
+ tentry++;
|
||||
}
|
||||
- if (strlen(qentry->Glyph) == gnstr.size) {
|
||||
- if(memcmp(gnstr.data, qentry->Glyph, gnstr.size) == 0) {
|
||||
- memcpy(Buffer, qentry->Unicode, 4);
|
||||
- return 4;
|
||||
+
|
||||
+ /* Search glyph to quadruple Unicode value table */
|
||||
+ while (qentry->Glyph != 0) {
|
||||
+ if (qentry->Glyph[0] < gnstr.data[0]) {
|
||||
+ qentry++;
|
||||
+ continue;
|
||||
+ }
|
||||
+ if (qentry->Glyph[0] > gnstr.data[0]){
|
||||
+ break;
|
||||
}
|
||||
+ if (strlen(qentry->Glyph) == gnstr.size) {
|
||||
+ if(memcmp(gnstr.data, qentry->Glyph, gnstr.size) == 0) {
|
||||
+ memcpy(Buffer, qentry->Unicode, 4);
|
||||
+ return 4;
|
||||
+ }
|
||||
+ }
|
||||
+ qentry++;
|
||||
}
|
||||
- qentry++;
|
||||
}
|
||||
}
|
||||
*Buffer = fallback;
|
||||
@@ -1890,8 +1893,8 @@ txtwrite_process_cmap_text(gs_text_enum_t *pte)
|
||||
pte->returned.total_width.x += dpt.x;
|
||||
pte->returned.total_width.y += dpt.y;
|
||||
|
||||
- penum->TextBufferIndex += get_unicode(penum, (gs_font *)pte->orig_font, glyph, chr, &penum->TextBuffer[penum->TextBufferIndex]);
|
||||
penum->Widths[penum->TextBufferIndex] += dpt.x;
|
||||
+ penum->TextBufferIndex += get_unicode(penum, (gs_font *)pte->orig_font, glyph, chr, &penum->TextBuffer[penum->TextBufferIndex]);
|
||||
break;
|
||||
case 2: /* end of string */
|
||||
return 0;
|
||||
diff --git a/psi/zbfont.c b/psi/zbfont.c
|
||||
index 262fea9..abc03aa 100644
|
||||
--- a/psi/zbfont.c
|
||||
+++ b/psi/zbfont.c
|
||||
@@ -272,7 +272,7 @@ gs_font_map_glyph_to_unicode(gs_font *font, gs_glyph glyph, int ch, ushort *u, u
|
||||
* can't be a default value for FontInfo.GlyphNames2Unicode .
|
||||
*/
|
||||
}
|
||||
- if (glyph <= GS_MIN_CID_GLYPH) {
|
||||
+ if (glyph <= GS_MIN_CID_GLYPH && glyph != GS_NO_GLYPH) {
|
||||
UnicodeDecoding = zfont_get_to_unicode_map(font->dir);
|
||||
if (UnicodeDecoding != NULL && r_type(UnicodeDecoding) == t_dictionary)
|
||||
return gs_font_map_glyph_by_dict(font->memory, UnicodeDecoding, glyph, u, length);
|
57
ghostscript-cve-2020-16310.patch
Normal file
57
ghostscript-cve-2020-16310.patch
Normal file
@ -0,0 +1,57 @@
|
||||
diff --git a/devices/gdevdm24.c b/devices/gdevdm24.c
|
||||
index 4736f4f..2f610cd 100644
|
||||
--- a/devices/gdevdm24.c
|
||||
+++ b/devices/gdevdm24.c
|
||||
@@ -51,21 +51,39 @@ static void dot24_improve_bitmap (byte *, int);
|
||||
static int
|
||||
dot24_print_page (gx_device_printer *pdev, FILE *prn_stream, char *init_string, int init_len)
|
||||
{
|
||||
- int xres = (int)pdev->x_pixels_per_inch;
|
||||
- int yres = (int)pdev->y_pixels_per_inch;
|
||||
- int x_high = (xres == 360);
|
||||
- int y_high = (yres == 360);
|
||||
- int bits_per_column = (y_high ? 48 : 24);
|
||||
- uint line_size = gdev_prn_raster (pdev);
|
||||
- uint in_size = line_size * bits_per_column;
|
||||
- byte *in = (byte *) gs_malloc (pdev->memory, in_size, 1, "dot24_print_page (in)");
|
||||
- uint out_size = ((pdev->width + 7) & -8) * 3;
|
||||
- byte *out = (byte *) gs_malloc (pdev->memory, out_size, 1, "dot24_print_page (out)");
|
||||
- int y_passes = (y_high ? 2 : 1);
|
||||
- int dots_per_space = xres / 10; /* pica space = 1/10" */
|
||||
- int bytes_per_space = dots_per_space * 3;
|
||||
+ int xres;
|
||||
+ int yres;
|
||||
+ int x_high;
|
||||
+ int y_high;
|
||||
+ int bits_per_column;
|
||||
+ uint line_size;
|
||||
+ uint in_size;
|
||||
+ byte *in;
|
||||
+ uint out_size;
|
||||
+ byte *out;
|
||||
+ int y_passes;
|
||||
+ int dots_per_space;
|
||||
+ int bytes_per_space;
|
||||
int skip = 0, lnum = 0, ypass;
|
||||
|
||||
+ xres = (int)pdev->x_pixels_per_inch;
|
||||
+ yres = (int)pdev->y_pixels_per_inch;
|
||||
+ x_high = (xres == 360);
|
||||
+ y_high = (yres == 360);
|
||||
+ dots_per_space = xres / 10; /* pica space = 1/10" */
|
||||
+ bytes_per_space = dots_per_space * 3;
|
||||
+ if (bytes_per_space == 0) {
|
||||
+ /* We divide by bytes_per_space later on. */
|
||||
+ return_error(gs_error_rangecheck);
|
||||
+ }
|
||||
+ bits_per_column = (y_high ? 48 : 24);
|
||||
+ line_size = gdev_prn_raster (pdev);
|
||||
+ in_size = line_size * bits_per_column;
|
||||
+ in = (byte *) gs_malloc (pdev->memory, in_size, 1, "dot24_print_page (in)");
|
||||
+ out_size = ((pdev->width + 7) & -8) * 3;
|
||||
+ out = (byte *) gs_malloc (pdev->memory, out_size, 1, "dot24_print_page (out)");
|
||||
+ y_passes = (y_high ? 2 : 1);
|
||||
+
|
||||
/* Check allocations */
|
||||
if (in == 0 || out == 0)
|
||||
{
|
1847
ghostscript.spec
Normal file
1847
ghostscript.spec
Normal file
File diff suppressed because it is too large
Load Diff
Loading…
Reference in New Issue
Block a user