From a8b6d9b56b2e17990aa2cce23022e9196e487154 Mon Sep 17 00:00:00 2001

From: Chris Liddell <chris.liddell@artifex.com>

Date: Thu, 27 Apr 2017 13:03:33 +0100

Subject: [PATCH 1/4] Bug 697799: have .eqproc check its parameters

The Ghostscript custom operator .eqproc was not check the number or type of

the parameters it was given.

---

 psi/zmisc3.c | 6 ++++++

 1 file changed, 6 insertions(+)

diff --git a/psi/zmisc3.c b/psi/zmisc3.c

index 54b3042..0d357f1 100644

--- a/psi/zmisc3.c

+++ b/psi/zmisc3.c

@@ -56,6 +56,12 @@ zeqproc(i_ctx_t *i_ctx_p)

     ref2_t stack[MAX_DEPTH + 1];

     ref2_t *top = stack;

+    if (ref_stack_count(&o_stack) < 2)

+        return_error(e_stackunderflow);

+    if (!r_is_array(op - 1) || !r_is_array(op)) {

+        return_error(e_typecheck);

+    }

+

     make_array(&stack[0].proc1, 0, 1, op - 1);

     make_array(&stack[0].proc2, 0, 1, op);

     for (;;) {

-- 

2.9.3

From d316ce788996a2cb2a1a6210bebb1000b8744a20 Mon Sep 17 00:00:00 2001

From: Chris Liddell <chris.liddell@artifex.com>

Date: Thu, 27 Apr 2017 13:21:31 +0100

Subject: [PATCH 2/4] Bug 697799: have .rsdparams check its parameters

The Ghostscript internal operator .rsdparams wasn't checking the number or

type of the operands it was being passed. Do so.

---

 psi/zfrsd.c | 22 +++++++++++++++-------

 1 file changed, 15 insertions(+), 7 deletions(-)

diff --git a/psi/zfrsd.c b/psi/zfrsd.c

index fb4bce9..2629afa 100644

--- a/psi/zfrsd.c

+++ b/psi/zfrsd.c

@@ -49,13 +49,20 @@ zrsdparams(i_ctx_t *i_ctx_p)

     ref *pFilter;

     ref *pDecodeParms;

     int Intent = 0;

-    bool AsyncRead;

+    bool AsyncRead = false;

     ref empty_array, filter1_array, parms1_array;

     uint i;

-    int code;

+    int code = 0;

+

+    if (ref_stack_count(&o_stack) < 1)

+        return_error(e_stackunderflow);

+    if (!r_has_type(op, t_dictionary) && !r_has_type(op, t_null)) {

+        return_error(e_typecheck);

+    }

     make_empty_array(&empty_array, a_readonly);

-    if (dict_find_string(op, "Filter", &pFilter) > 0) {

+    if (r_has_type(op, t_dictionary)

+        && dict_find_string(op, "Filter", &pFilter) > 0) {

         if (!r_is_array(pFilter)) {

             if (!r_has_type(pFilter, t_name))

                 return_error(e_typecheck);

@@ -94,12 +101,13 @@ zrsdparams(i_ctx_t *i_ctx_p)

                 return_error(e_typecheck);

         }

     }

-    code = dict_int_param(op, "Intent", 0, 3, 0, &Intent);

+    if (r_has_type(op, t_dictionary))

+        code = dict_int_param(op, "Intent", 0, 3, 0, &Intent);

     if (code < 0 && code != e_rangecheck) /* out-of-range int is ok, use 0 */

         return code;

-    if ((code = dict_bool_param(op, "AsyncRead", false, &AsyncRead)) < 0

-        )

-        return code;

+    if (r_has_type(op, t_dictionary))

+        if ((code = dict_bool_param(op, "AsyncRead", false, &AsyncRead)) < 0)

+            return code;

     push(1);

     op[-1] = *pFilter;

     if (pDecodeParms)

-- 

2.9.3

From 3e1daaa70bd5ed08d7627494e7497457ad3fec99 Mon Sep 17 00:00:00 2001

From: Chris Liddell <chris.liddell@artifex.com>

Date: Wed, 3 May 2017 12:05:45 +0100

Subject: [PATCH 3/4] Bug 697846: revision to commit 4f83478c88 (.eqproc)

When using the "DELAYBIND" feature, it turns out that .eqproc can be called with

parameters that are not both procedures. In this case, it turns out, the

expectation is for the operator to return 'false', rather than throw an error.

---

 psi/zmisc3.c | 15 +++++++++++++--

 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/psi/zmisc3.c b/psi/zmisc3.c

index 0d357f1..9042908 100644

--- a/psi/zmisc3.c

+++ b/psi/zmisc3.c

@@ -38,6 +38,15 @@ zcliprestore(i_ctx_t *i_ctx_p)

     return gs_cliprestore(igs);

 }

+static inline bool

+eqproc_check_type(ref *r)

+{

+    return r_has_type(r, t_array)

+           || r_has_type(r, t_mixedarray)

+           || r_has_type(r, t_shortarray)

+           || r_has_type(r, t_oparray);

+}

+

 /* <proc1> <proc2> .eqproc <bool> */

 /*

  * Test whether two procedures are equal to depth 10.

@@ -58,8 +67,10 @@ zeqproc(i_ctx_t *i_ctx_p)

     if (ref_stack_count(&o_stack) < 2)

         return_error(e_stackunderflow);

-    if (!r_is_array(op - 1) || !r_is_array(op)) {

-        return_error(e_typecheck);

+    if (!eqproc_check_type(op -1) || !eqproc_check_type(op)) {

+        make_false(op - 1);

+        pop(1);

+        return 0;

     }

     make_array(&stack[0].proc1, 0, 1, op - 1);

-- 

2.9.3

From 46c6f168d42e1d3d7d5a514a69cdba572466c638 Mon Sep 17 00:00:00 2001

From: Chris Liddell <chris.liddell@artifex.com>

Date: Thu, 11 May 2017 14:07:48 +0100

Subject: [PATCH 4/4] Bug 697892: fix check for op stack underflow.

In the original fix, I used the wrong method to check for stack underflow, this

is using the correct method.

---

 psi/zfrsd.c  | 3 +--

 psi/zmisc3.c | 1 +

 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/psi/zfrsd.c b/psi/zfrsd.c

index 2629afa..fd9872e 100644

--- a/psi/zfrsd.c

+++ b/psi/zfrsd.c

@@ -54,8 +54,7 @@ zrsdparams(i_ctx_t *i_ctx_p)

     uint i;

     int code = 0;

-    if (ref_stack_count(&o_stack) < 1)

-        return_error(e_stackunderflow);

+    check_op(1);

     if (!r_has_type(op, t_dictionary) && !r_has_type(op, t_null)) {

         return_error(e_typecheck);

     }

diff --git a/psi/zmisc3.c b/psi/zmisc3.c

index 9042908..5d73d94 100644

--- a/psi/zmisc3.c

+++ b/psi/zmisc3.c

@@ -67,6 +67,7 @@ zeqproc(i_ctx_t *i_ctx_p)

     if (ref_stack_count(&o_stack) < 2)

         return_error(e_stackunderflow);

+    check_op(2);

     if (!eqproc_check_type(op -1) || !eqproc_check_type(op)) {

         make_false(op - 1);

         pop(1);

-- 

2.9.3