rpms/ghostscript
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Applied upstream patch to fix iname.c segfault (bug #465311).

Browse Source
This commit is contained in:
Tim Waugh 2010-09-02 12:15:51 +01:00
parent c755f33188
commit f35503ceee
2 changed files with 98 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

90
ghostscript-iname-segfault.patch Normal file
View File

@ -0,0 +1,90 @@
diff -up ghostscript-8.71/psi/iname.c.iname-segfault ghostscript-8.71/psi/iname.c
--- ghostscript-8.71/psi/iname.c.iname-segfault 2008-10-21 17:26:09.000000000 +0100
+++ ghostscript-8.71/psi/iname.c 2010-09-02 12:13:02.833819490 +0100
@@ -47,8 +47,8 @@ gs_private_st_composite(st_name_table, n
/* Forward references */
static int name_alloc_sub(name_table *);
-static void name_free_sub(name_table *, uint);
-static void name_scan_sub(name_table *, uint, bool);
+static void name_free_sub(name_table *, uint, bool);
+static void name_scan_sub(name_table *, uint, bool, bool);
/* Debugging printout */
#ifdef DEBUG
@@ -99,7 +99,7 @@ names_init(ulong count, gs_ref_memory_t
if (code < 0) {
while (nt->sub_next > 0)
- name_free_sub(nt, --(nt->sub_next));
+ name_free_sub(nt, --(nt->sub_next), false);
gs_free_object(mem, nt, "name_init(nt)");
return 0;
}
@@ -413,16 +413,7 @@ names_trace_finish(name_table * nt, gc_s
if (sub != 0) {
int save_count = nt->sub_count;
- name_scan_sub(nt, i, true);
- if (save_count != nt->sub_count) {
- /* name_scan_sub has released the i-th entry. */
- continue;
- }
- if (nt->sub[i].names == 0 && gcst != 0) {
- /* Mark the just-freed sub-table as unmarked. */
- o_set_unmarked((obj_header_t *)sub - 1);
- o_set_unmarked((obj_header_t *)ssub - 1);
- }
+ name_scan_sub(nt, i, true, true && (gcst != 0));
}
}
nt->sub_next = 0;
@@ -506,7 +497,7 @@ name_alloc_sub(name_table * nt)
/* Add the newly allocated entries to the free list. */
/* Note that the free list will only be properly sorted if */
/* it was empty initially. */
- name_scan_sub(nt, sub_index, false);
+ name_scan_sub(nt, sub_index, false, false);
#ifdef DEBUG
if (gs_debug_c('n')) { /* Print the lengths of the hash chains. */
int i0;
@@ -535,8 +526,20 @@ name_alloc_sub(name_table * nt)
/* Free a sub-table. */
static void
-name_free_sub(name_table * nt, uint sub_index)
+name_free_sub(name_table * nt, uint sub_index, bool unmark)
{
+ /* If the subtable is in a previous save level, gs_free_object()
+ * may not actually free the memory, in case that happens, we need
+ * to explicitly remove the gc mark.
+ */
+ if (unmark) {
+ name_sub_table *sub = nt->sub[sub_index].names;
+ name_string_sub_table_t *ssub = nt->sub[sub_index].strings;
+
+ o_set_unmarked((obj_header_t *)sub - 1);
+ o_set_unmarked((obj_header_t *)ssub - 1);
+ }
+
gs_free_object(nt->memory, nt->sub[sub_index].strings,
"name_free_sub(string sub-table)");
gs_free_object(nt->memory, nt->sub[sub_index].names,
@@ -550,7 +553,7 @@ name_free_sub(name_table * nt, uint sub_
/* will stay sorted. If all entries are unmarked and free_empty is true, */
/* free the sub-table. */
static void
-name_scan_sub(name_table * nt, uint sub_index, bool free_empty)
+name_scan_sub(name_table * nt, uint sub_index, bool free_empty, bool unmark)
{
name_string_sub_table_t *ssub = nt->sub[sub_index].strings;
uint free = nt->free;
@@ -579,7 +582,7 @@ name_scan_sub(name_table * nt, uint sub_
nt->free = free;
else {
/* No marked entries, free the sub-table. */
- name_free_sub(nt, sub_index);
+ name_free_sub(nt, sub_index, unmark);
if (sub_index == nt->sub_count - 1) {
/* Back up over a final run of deleted sub-tables. */
do {

9
ghostscript.spec
View File

@ -5,7 +5,7 @@ Summary: A PostScript interpreter and renderer.
Name: ghostscript
Version: %{gs_ver}
Release: 11%{?dist}
Release: 12%{?dist}
# Included CMap data is Redistributable, no modification permitted,
# see http://bugzilla.redhat.com/487510
@ -24,6 +24,7 @@ Patch5: ghostscript-runlibfileifexists.patch
Patch6: ghostscript-system-jasper.patch
Patch7: ghostscript-pksmraw.patch
Patch8: ghostscript-jbig2dec-nullderef.patch
Patch9: ghostscript-iname-segfault.patch
Patch10: ghostscript-CVE-2009-4270.patch
Patch11: ghostscript-vsnprintf.patch
Patch12: ghostscript-cups-filters.patch
@ -135,6 +136,9 @@ rm -rf libpng zlib jpeg jasper
# Applied patch to fix NULL dereference in JBIG2 decoder (bug #501710).
%patch8 -p1 -b .jbig2dec-nullderef
# Applied upstream patch to fix iname.c segfault (bug #465311).
%patch9 -p1 -b .iname-segfault
# Fix debugging output from gdevcups (bug #540760).
%patch10 -p1 -b .CVE-2009-4270
@ -370,6 +374,9 @@ rm -rf $RPM_BUILD_ROOT
%{_libdir}/libgs.so
%changelog
* Thu Sep 2 2010 Tim Waugh <twaugh@redhat.com> 8.71-12
- Applied upstream patch to fix iname.c segfault (bug #465311).
* Thu Aug 26 2010 Tim Waugh <twaugh@redhat.com> 8.71-11
- Avoid epstopdf failure using upstream patch (bug #627390).
- More upstream fixes for bug #599564.