Blame SOURCES/ghostscript-cve-2020-16301.patch

10c95e
From f54414c8b15b2c27d1dcadd92cfe84f6d15f18dc Mon Sep 17 00:00:00 2001
10c95e
From: Julian Smith <jules@op59.net>
10c95e
Date: Thu, 31 Oct 2019 13:12:47 +0000
10c95e
Subject: [PATCH] Bug 701808: return error from okiibm_print_page1() if x_dpi
10c95e
 too high.
10c95e
10c95e
Avoids asan error in:
10c95e
    ./sanbin/gs -dBATCH -dNOPAUSE -dSAFER -r599 -sOutputFile=tmp -sDEVICE=okiibm ../bug-701808.pdf
10c95e
---
10c95e
 devices/gdevokii.c | 46 ++++++++++++++++++++++++++++++++--------------
10c95e
 1 file changed, 32 insertions(+), 14 deletions(-)
10c95e
10c95e
diff --git a/devices/gdevokii.c b/devices/gdevokii.c
10c95e
index d8929a22c..97a1c3b88 100644
10c95e
--- a/devices/gdevokii.c
10c95e
+++ b/devices/gdevokii.c
10c95e
@@ -96,23 +96,41 @@ okiibm_print_page1(gx_device_printer *pdev, gp_file *prn_stream, int y_9pin_high
10c95e
         -1, 0 /*60*/, 1 /*120*/, -1, 3 /*240*/
10c95e
         };
10c95e
 
10c95e
-        int in_y_mult = (y_9pin_high ? 2 : 1);
10c95e
-        int line_size = gdev_mem_bytes_per_scan_line((gx_device *)pdev);
10c95e
-        /* Note that in_size is a multiple of 8. */
10c95e
-        int in_size = line_size * (8 * in_y_mult);
10c95e
-        byte *buf1 = (byte *)gs_malloc(pdev->memory, in_size, 1, "okiibm_print_page(buf1)");
10c95e
-        byte *buf2 = (byte *)gs_malloc(pdev->memory, in_size, 1, "okiibm_print_page(buf2)");
10c95e
-        byte *in = buf1;
10c95e
-        byte *out = buf2;
10c95e
-        int out_y_mult = 1;
10c95e
-        int x_dpi = pdev->x_pixels_per_inch;
10c95e
-        char start_graphics = graphics_modes_9[x_dpi / 60];
10c95e
-        int first_pass = (start_graphics == 3 ? 1 : 0);
10c95e
-        int last_pass = first_pass * 2;
10c95e
-        int y_passes = (y_9pin_high ? 2 : 1);
10c95e
+        int in_y_mult;
10c95e
+        int line_size;
10c95e
+        int in_size;
10c95e
+        byte *buf1;
10c95e
+        byte *buf2;
10c95e
+        byte *in;
10c95e
+        byte *out;
10c95e
+        int out_y_mult;
10c95e
+        int x_dpi;
10c95e
+        char start_graphics;
10c95e
+        int first_pass;
10c95e
+        int last_pass;
10c95e
+        int y_passes;
10c95e
         int skip = 0, lnum = 0, pass, ypass;
10c95e
         int y_step = 0;
10c95e
 
10c95e
+        x_dpi = pdev->x_pixels_per_inch;
10c95e
+        if (x_dpi / 60 >= sizeof(graphics_modes_9)/sizeof(graphics_modes_9[0])) {
10c95e
+            return_error(gs_error_rangecheck);
10c95e
+        }
10c95e
+        in_y_mult = (y_9pin_high ? 2 : 1);
10c95e
+        line_size = gdev_mem_bytes_per_scan_line((gx_device *)pdev);
10c95e
+        /* Note that in_size is a multiple of 8. */
10c95e
+        in_size = line_size * (8 * in_y_mult);
10c95e
+        buf1 = (byte *)gs_malloc(pdev->memory, in_size, 1, "okiibm_print_page(buf1)");
10c95e
+        buf2 = (byte *)gs_malloc(pdev->memory, in_size, 1, "okiibm_print_page(buf2)");
10c95e
+        in = buf1;
10c95e
+        out = buf2;
10c95e
+        out_y_mult = 1;
10c95e
+        start_graphics = graphics_modes_9[x_dpi / 60];
10c95e
+        first_pass = (start_graphics == 3 ? 1 : 0);
10c95e
+        last_pass = first_pass * 2;
10c95e
+        y_passes = (y_9pin_high ? 2 : 1);
10c95e
+        y_step = 0;
10c95e
+
10c95e
         /* Check allocations */
10c95e
         if ( buf1 == 0 || buf2 == 0 )
10c95e
         {	if ( buf1 )
10c95e
-- 
10c95e
2.35.3
10c95e