|
 |
f226a6 |
From 2a3129365d3bc0d4a41f107ef175920d1505d1f7 Mon Sep 17 00:00:00 2001
|
|
|
f226a6 |
From: Chris Liddell <chris.liddell@artifex.com>
|
|
|
f226a6 |
Date: Tue, 1 Jun 2021 19:57:16 +0100
|
|
|
f226a6 |
Subject: [PATCH] Bug 703902: Fix op stack management in
|
|
|
f226a6 |
sampled_data_continue()
|
|
|
f226a6 |
|
|
|
f226a6 |
Replace pop() (which does no checking, and doesn't handle stack extension
|
|
|
f226a6 |
blocks) with ref_stack_pop() which does do all that.
|
|
|
f226a6 |
|
|
|
f226a6 |
We still use pop() in one case (it's faster), but we have to later use
|
|
|
f226a6 |
ref_stack_pop() before calling sampled_data_sample() which also accesses the
|
|
|
f226a6 |
op stack.
|
|
|
f226a6 |
|
|
|
f226a6 |
Fixes:
|
|
|
f226a6 |
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34675
|
|
|
f226a6 |
---
|
|
|
f226a6 |
psi/zfsample.c | 16 ++++++++++------
|
|
|
f226a6 |
1 file changed, 10 insertions(+), 6 deletions(-)
|
|
|
f226a6 |
|
|
|
f226a6 |
diff --git a/psi/zfsample.c b/psi/zfsample.c
|
|
|
f226a6 |
index 0e8e4bc8d..00cd0cfdd 100644
|
|
|
f226a6 |
--- a/psi/zfsample.c
|
|
|
f226a6 |
+++ b/psi/zfsample.c
|
|
|
f226a6 |
@@ -533,15 +533,19 @@ sampled_data_continue(i_ctx_t *i_ctx_p)
|
|
|
f226a6 |
for (j = 0; j < bps; j++)
|
|
|
f226a6 |
data_ptr[bps * i + j] = (byte)(cv >> ((bps - 1 - j) * 8)); /* MSB first */
|
|
|
f226a6 |
}
|
|
|
f226a6 |
- pop(num_out); /* Move op to base of result values */
|
|
|
f226a6 |
|
|
|
f226a6 |
- /* Check if we are done collecting data. */
|
|
|
f226a6 |
+ pop(num_out); /* Move op to base of result values */
|
|
|
f226a6 |
|
|
|
f226a6 |
+ /* From here on, we have to use ref_stack_pop() rather than pop()
|
|
|
f226a6 |
+ so that it handles stack extension blocks properly, before calling
|
|
|
f226a6 |
+ sampled_data_sample() which also uses the op stack.
|
|
|
f226a6 |
+ */
|
|
|
f226a6 |
+ /* Check if we are done collecting data. */
|
|
|
f226a6 |
if (increment_cube_indexes(params, penum->indexes)) {
|
|
|
f226a6 |
if (stack_depth_adjust == 0)
|
|
|
f226a6 |
- pop(O_STACK_PAD); /* Remove spare stack space */
|
|
|
f226a6 |
+ ref_stack_pop(&o_stack, O_STACK_PAD); /* Remove spare stack space */
|
|
|
f226a6 |
else
|
|
|
f226a6 |
- pop(stack_depth_adjust - num_out);
|
|
|
f226a6 |
+ ref_stack_pop(&o_stack, stack_depth_adjust - num_out);
|
|
|
f226a6 |
/* Execute the closing procedure, if given */
|
|
|
f226a6 |
code = 0;
|
|
|
f226a6 |
if (esp_finish_proc != 0)
|
|
|
f226a6 |
@@ -554,11 +558,11 @@ sampled_data_continue(i_ctx_t *i_ctx_p)
|
|
|
f226a6 |
if ((O_STACK_PAD - stack_depth_adjust) < 0) {
|
|
|
f226a6 |
stack_depth_adjust = -(O_STACK_PAD - stack_depth_adjust);
|
|
|
f226a6 |
check_op(stack_depth_adjust);
|
|
|
f226a6 |
- pop(stack_depth_adjust);
|
|
|
f226a6 |
+ ref_stack_pop(&o_stack, stack_depth_adjust);
|
|
|
f226a6 |
}
|
|
|
f226a6 |
else {
|
|
|
f226a6 |
check_ostack(O_STACK_PAD - stack_depth_adjust);
|
|
|
f226a6 |
- push(O_STACK_PAD - stack_depth_adjust);
|
|
|
f226a6 |
+ ref_stack_push(&o_stack, O_STACK_PAD - stack_depth_adjust);
|
|
|
f226a6 |
for (i=0;i
|
|
|
f226a6 |
make_null(op - i);
|
|
|
f226a6 |
}
|
|
|
f226a6 |
--
|
|
|
f226a6 |
2.35.1
|
|
|
f226a6 |
|