ghostscript/ghostscript-cve-2020-16301.patch

76 lines
2.8 KiB
Diff

From f54414c8b15b2c27d1dcadd92cfe84f6d15f18dc Mon Sep 17 00:00:00 2001
From: Julian Smith <jules@op59.net>
Date: Thu, 31 Oct 2019 13:12:47 +0000
Subject: [PATCH] Bug 701808: return error from okiibm_print_page1() if x_dpi
too high.
Avoids asan error in:
./sanbin/gs -dBATCH -dNOPAUSE -dSAFER -r599 -sOutputFile=tmp -sDEVICE=okiibm ../bug-701808.pdf
---
devices/gdevokii.c | 46 ++++++++++++++++++++++++++++++++--------------
1 file changed, 32 insertions(+), 14 deletions(-)
diff --git a/devices/gdevokii.c b/devices/gdevokii.c
index d8929a22c..97a1c3b88 100644
--- a/devices/gdevokii.c
+++ b/devices/gdevokii.c
@@ -96,23 +96,41 @@ okiibm_print_page1(gx_device_printer *pdev, gp_file *prn_stream, int y_9pin_high
-1, 0 /*60*/, 1 /*120*/, -1, 3 /*240*/
};
- int in_y_mult = (y_9pin_high ? 2 : 1);
- int line_size = gdev_mem_bytes_per_scan_line((gx_device *)pdev);
- /* Note that in_size is a multiple of 8. */
- int in_size = line_size * (8 * in_y_mult);
- byte *buf1 = (byte *)gs_malloc(pdev->memory, in_size, 1, "okiibm_print_page(buf1)");
- byte *buf2 = (byte *)gs_malloc(pdev->memory, in_size, 1, "okiibm_print_page(buf2)");
- byte *in = buf1;
- byte *out = buf2;
- int out_y_mult = 1;
- int x_dpi = pdev->x_pixels_per_inch;
- char start_graphics = graphics_modes_9[x_dpi / 60];
- int first_pass = (start_graphics == 3 ? 1 : 0);
- int last_pass = first_pass * 2;
- int y_passes = (y_9pin_high ? 2 : 1);
+ int in_y_mult;
+ int line_size;
+ int in_size;
+ byte *buf1;
+ byte *buf2;
+ byte *in;
+ byte *out;
+ int out_y_mult;
+ int x_dpi;
+ char start_graphics;
+ int first_pass;
+ int last_pass;
+ int y_passes;
int skip = 0, lnum = 0, pass, ypass;
int y_step = 0;
+ x_dpi = pdev->x_pixels_per_inch;
+ if (x_dpi / 60 >= sizeof(graphics_modes_9)/sizeof(graphics_modes_9[0])) {
+ return_error(gs_error_rangecheck);
+ }
+ in_y_mult = (y_9pin_high ? 2 : 1);
+ line_size = gdev_mem_bytes_per_scan_line((gx_device *)pdev);
+ /* Note that in_size is a multiple of 8. */
+ in_size = line_size * (8 * in_y_mult);
+ buf1 = (byte *)gs_malloc(pdev->memory, in_size, 1, "okiibm_print_page(buf1)");
+ buf2 = (byte *)gs_malloc(pdev->memory, in_size, 1, "okiibm_print_page(buf2)");
+ in = buf1;
+ out = buf2;
+ out_y_mult = 1;
+ start_graphics = graphics_modes_9[x_dpi / 60];
+ first_pass = (start_graphics == 3 ? 1 : 0);
+ last_pass = first_pass * 2;
+ y_passes = (y_9pin_high ? 2 : 1);
+ y_step = 0;
+
/* Check allocations */
if ( buf1 == 0 || buf2 == 0 )
{ if ( buf1 )
--
2.35.3