Blame SOURCES/ghostscript-cve-2020-16301.patch

28b9a6
From f54414c8b15b2c27d1dcadd92cfe84f6d15f18dc Mon Sep 17 00:00:00 2001
28b9a6
From: Julian Smith <jules@op59.net>
28b9a6
Date: Thu, 31 Oct 2019 13:12:47 +0000
28b9a6
Subject: [PATCH] Bug 701808: return error from okiibm_print_page1() if x_dpi
28b9a6
 too high.
28b9a6
28b9a6
Avoids asan error in:
28b9a6
    ./sanbin/gs -dBATCH -dNOPAUSE -dSAFER -r599 -sOutputFile=tmp -sDEVICE=okiibm ../bug-701808.pdf
28b9a6
---
28b9a6
 devices/gdevokii.c | 46 ++++++++++++++++++++++++++++++++--------------
28b9a6
 1 file changed, 32 insertions(+), 14 deletions(-)
28b9a6
28b9a6
diff --git a/devices/gdevokii.c b/devices/gdevokii.c
28b9a6
index d8929a22c..97a1c3b88 100644
28b9a6
--- a/devices/gdevokii.c
28b9a6
+++ b/devices/gdevokii.c
28b9a6
@@ -96,23 +96,41 @@ okiibm_print_page1(gx_device_printer *pdev, gp_file *prn_stream, int y_9pin_high
28b9a6
         -1, 0 /*60*/, 1 /*120*/, -1, 3 /*240*/
28b9a6
         };
28b9a6
 
28b9a6
-        int in_y_mult = (y_9pin_high ? 2 : 1);
28b9a6
-        int line_size = gdev_mem_bytes_per_scan_line((gx_device *)pdev);
28b9a6
-        /* Note that in_size is a multiple of 8. */
28b9a6
-        int in_size = line_size * (8 * in_y_mult);
28b9a6
-        byte *buf1 = (byte *)gs_malloc(pdev->memory, in_size, 1, "okiibm_print_page(buf1)");
28b9a6
-        byte *buf2 = (byte *)gs_malloc(pdev->memory, in_size, 1, "okiibm_print_page(buf2)");
28b9a6
-        byte *in = buf1;
28b9a6
-        byte *out = buf2;
28b9a6
-        int out_y_mult = 1;
28b9a6
-        int x_dpi = pdev->x_pixels_per_inch;
28b9a6
-        char start_graphics = graphics_modes_9[x_dpi / 60];
28b9a6
-        int first_pass = (start_graphics == 3 ? 1 : 0);
28b9a6
-        int last_pass = first_pass * 2;
28b9a6
-        int y_passes = (y_9pin_high ? 2 : 1);
28b9a6
+        int in_y_mult;
28b9a6
+        int line_size;
28b9a6
+        int in_size;
28b9a6
+        byte *buf1;
28b9a6
+        byte *buf2;
28b9a6
+        byte *in;
28b9a6
+        byte *out;
28b9a6
+        int out_y_mult;
28b9a6
+        int x_dpi;
28b9a6
+        char start_graphics;
28b9a6
+        int first_pass;
28b9a6
+        int last_pass;
28b9a6
+        int y_passes;
28b9a6
         int skip = 0, lnum = 0, pass, ypass;
28b9a6
         int y_step = 0;
28b9a6
 
28b9a6
+        x_dpi = pdev->x_pixels_per_inch;
28b9a6
+        if (x_dpi / 60 >= sizeof(graphics_modes_9)/sizeof(graphics_modes_9[0])) {
28b9a6
+            return_error(gs_error_rangecheck);
28b9a6
+        }
28b9a6
+        in_y_mult = (y_9pin_high ? 2 : 1);
28b9a6
+        line_size = gdev_mem_bytes_per_scan_line((gx_device *)pdev);
28b9a6
+        /* Note that in_size is a multiple of 8. */
28b9a6
+        in_size = line_size * (8 * in_y_mult);
28b9a6
+        buf1 = (byte *)gs_malloc(pdev->memory, in_size, 1, "okiibm_print_page(buf1)");
28b9a6
+        buf2 = (byte *)gs_malloc(pdev->memory, in_size, 1, "okiibm_print_page(buf2)");
28b9a6
+        in = buf1;
28b9a6
+        out = buf2;
28b9a6
+        out_y_mult = 1;
28b9a6
+        start_graphics = graphics_modes_9[x_dpi / 60];
28b9a6
+        first_pass = (start_graphics == 3 ? 1 : 0);
28b9a6
+        last_pass = first_pass * 2;
28b9a6
+        y_passes = (y_9pin_high ? 2 : 1);
28b9a6
+        y_step = 0;
28b9a6
+
28b9a6
         /* Check allocations */
28b9a6
         if ( buf1 == 0 || buf2 == 0 )
28b9a6
         {	if ( buf1 )
28b9a6
-- 
28b9a6
2.35.3
28b9a6