From 8d65c0854c049e4c0c8e08006b595ad40a59e696 Mon Sep 17 00:00:00 2001

From: Robin Watts <robin.watts@artifex.com>

Date: Thu, 28 Mar 2013 21:12:18 +0000

Subject: [PATCH] Another memory squeeze fix.

Avoid SEGV in gsicc_alloc_link_entry and callers.

---

 base/gsicc_cache.c     | 17 +++++++++++------

 base/gsicc_manage.c    |  6 ++++--

 base/gsicc_nocm.c      |  3 +++

 base/gsicc_replacecm.c |  3 +++

 4 files changed, 21 insertions(+), 8 deletions(-)

diff --git a/base/gsicc_cache.c b/base/gsicc_cache.c

index 616db4c..65b2dd0 100644

--- a/base/gsicc_cache.c

+++ b/base/gsicc_cache.c

@@ -659,12 +659,14 @@ gsicc_alloc_link_entry(gsicc_link_cache_t *icc_link_cache,

     /* insert an empty link that we will reserve so we */

     /* can unlock while building the link contents     */

     (*ret_link) = gsicc_alloc_link(cache_mem->stable_memory, hash);

-    (*ret_link)->icc_link_cache = icc_link_cache;

-    (*ret_link)->next = icc_link_cache->head;

-    icc_link_cache->head = *ret_link;

-    icc_link_cache->num_links++;

-    /* now that we own this link we can release 

-       the lock since it is not valid */

+    if (*ret_link) {

+        (*ret_link)->icc_link_cache = icc_link_cache;

+        (*ret_link)->next = icc_link_cache->head;

+        icc_link_cache->head = *ret_link;

+        icc_link_cache->num_links++;

+        /* now that we own this link we can release

+          the lock since it is not valid */

+    }

     gx_monitor_leave(icc_link_cache->lock);

     return false;

 }

@@ -794,6 +796,9 @@ gsicc_get_link_profile(const gs_imager_state *pis, gx_device *dev,

     if (gsicc_alloc_link_entry(icc_link_cache, &link, hash, include_softproof,

                                include_devicelink)) 

         return link;

+    if (link == NULL)

+        return NULL;

+

     /* Now compute the link contents */

     cms_input_profile = gs_input_profile->profile_handle;

     if (cms_input_profile == NULL) {

diff --git a/base/gsicc_manage.c b/base/gsicc_manage.c

index e0e7d93..210be59 100644

--- a/base/gsicc_manage.c

+++ b/base/gsicc_manage.c

@@ -1521,8 +1521,8 @@ gsicc_set_device_profile(gx_device * pdev, gs_memory_t * mem,

             icc_profile =

                 gsicc_profile_new(str, mem, file_name, strlen(file_name));

             code = sfclose(str);

-        }

-        if (str != NULL && icc_profile != NULL) {

+            if (icc_profile == NULL)

+                return_error(gs_error_VMerror);

             if (pro_enum < gsPROOFPROFILE) {

                 if_debug1m(gs_debug_flag_icc, mem,

                            "[icc] Setting device profile %d\n", pro_enum);

@@ -1542,6 +1542,8 @@ gsicc_set_device_profile(gx_device * pdev, gs_memory_t * mem,

                 gsicc_get_profile_handle_buffer(icc_profile->buffer,

                                                 icc_profile->buffer_size,

                                                 mem);

+            if (icc_profile->profile_handle == NULL)

+                return_error(gs_error_unknownerror);

             /* Compute the hash code of the profile. Everything in the

                ICC manager will have it's hash code precomputed */

             gsicc_get_icc_buff_hash(icc_profile->buffer,

diff --git a/base/gsicc_nocm.c b/base/gsicc_nocm.c

index 8b2a353..bcc3138 100644

--- a/base/gsicc_nocm.c

+++ b/base/gsicc_nocm.c

@@ -372,6 +372,9 @@ gsicc_nocm_get_link(const gs_imager_state *pis, gx_device *dev,

     if (gsicc_alloc_link_entry(pis->icc_link_cache, &result, hash, false, false)) 

         return result;

+    if (result == NULL)

+        return NULL;

+

     /* Now compute the link contents */

     result->procs.map_buffer = gsicc_nocm_transform_color_buffer;

     result->procs.map_color = gsicc_nocm_transform_color;

diff --git a/base/gsicc_replacecm.c b/base/gsicc_replacecm.c

index 1a7c9e6..d1ab5ea 100644

--- a/base/gsicc_replacecm.c

+++ b/base/gsicc_replacecm.c

@@ -330,6 +330,9 @@ gsicc_rcm_get_link(const gs_imager_state *pis, gx_device *dev,

     if (gsicc_alloc_link_entry(pis->icc_link_cache, &result, hash, false, false)) 

         return result;

+    if (result == NULL)

+        return result;

+

     /* Now compute the link contents */

     result->procs.map_buffer = gsicc_rcm_transform_color_buffer;

     result->procs.map_color = gsicc_rcm_transform_color;

-- 

2.5.5