Blame SOURCES/ghostscript-cve-2020-16302.patch

6fb37a
diff --git a/devices/gdev3852.c b/devices/gdev3852.c
6fb37a
index 2bee8ec..9d99068 100644
6fb37a
--- a/devices/gdev3852.c
6fb37a
+++ b/devices/gdev3852.c
6fb37a
@@ -62,116 +62,117 @@ jetp3852_print_page(gx_device_printer *pdev, FILE *prn_stream)
6fb37a
 #define DATA_SIZE (LINE_SIZE * 8)
6fb37a
 
6fb37a
    unsigned int cnt_2prn;
6fb37a
-        unsigned int count,tempcnt;
6fb37a
-        unsigned char vtp,cntc1,cntc2;
6fb37a
-        int line_size_color_plane;
6fb37a
-
6fb37a
-        byte data[DATA_SIZE];
6fb37a
-        byte plane_data[LINE_SIZE * 3];
6fb37a
-
6fb37a
-        /* Set initial condition for printer */
6fb37a
-        fputs("\033@",prn_stream);
6fb37a
-
6fb37a
-        /* Send each scan line in turn */
6fb37a
-           {	int lnum;
6fb37a
-                int line_size = gdev_mem_bytes_per_scan_line((gx_device *)pdev);
6fb37a
-                int num_blank_lines = 0;
6fb37a
-
6fb37a
-                if (line_size > DATA_SIZE) {
6fb37a
-                  emprintf2(pdev->memory, "invalid resolution and/or width gives line_size = %d, max. is %d\n",
6fb37a
-                            line_size, DATA_SIZE);
6fb37a
-                  return_error(gs_error_rangecheck);
6fb37a
-               }
6fb37a
-                
6fb37a
-                for ( lnum = 0; lnum < pdev->height; lnum++ )
6fb37a
-                   {	byte *end_data = data + line_size;
6fb37a
-                        gdev_prn_copy_scan_lines(pdev, lnum,
6fb37a
-                                                 (byte *)data, line_size);
6fb37a
-                        /* Remove trailing 0s. */
6fb37a
-                        while ( end_data > data && end_data[-1] == 0 )
6fb37a
-                                end_data--;
6fb37a
-                        if ( end_data == data )
6fb37a
-                           {	/* Blank line */
6fb37a
-                                num_blank_lines++;
6fb37a
-                           }
6fb37a
-                        else
6fb37a
-                           {	int i;
6fb37a
-                                byte *odp;
6fb37a
-                                byte *row;
6fb37a
-
6fb37a
-                                /* Pad with 0s to fill out the last */
6fb37a
-                                /* block of 8 bytes. */
6fb37a
-                                memset(end_data, 0, 7);
6fb37a
-
6fb37a
-                                /* Transpose the data to get pixel planes. */
6fb37a
-                                for ( i = 0, odp = plane_data; i < DATA_SIZE;
6fb37a
-                                      i += 8, odp++
6fb37a
-                                    )
6fb37a
-                                 { /* The following is for 16-bit machines */
6fb37a
+   unsigned int count,tempcnt;
6fb37a
+   unsigned char vtp,cntc1,cntc2;
6fb37a
+   int line_size_color_plane;
6fb37a
+
6fb37a
+   byte data[DATA_SIZE];
6fb37a
+   byte plane_data[LINE_SIZE * 3];
6fb37a
+
6fb37a
+   /* Initialise data to zeros, otherwise later on, uninitialised bytes in
6fb37a
+   dp[] can be greater than 7, which breaks spr8[dp[]]. */
6fb37a
+   memset(data, 0x00, DATA_SIZE);
6fb37a
+
6fb37a
+
6fb37a
+   /* Set initial condition for printer */
6fb37a
+   fputs("\033@",prn_stream);
6fb37a
+
6fb37a
+   /* Send each scan line in turn */
6fb37a
+   {	int lnum;
6fb37a
+        int line_size = gdev_mem_bytes_per_scan_line((gx_device *)pdev);
6fb37a
+        int num_blank_lines = 0;
6fb37a
+
6fb37a
+        if (line_size > DATA_SIZE) {
6fb37a
+          emprintf2(pdev->memory, "invalid resolution and/or width gives line_size = %d, max. is %d\n",
6fb37a
+                    line_size, DATA_SIZE);
6fb37a
+          return_error(gs_error_rangecheck);
6fb37a
+       }
6fb37a
+
6fb37a
+        for ( lnum = 0; lnum < pdev->height; lnum++ )
6fb37a
+           {	byte *end_data = data + line_size;
6fb37a
+                gdev_prn_copy_scan_lines(pdev, lnum,
6fb37a
+                                         (byte *)data, line_size);
6fb37a
+                /* Remove trailing 0s. */
6fb37a
+                while ( end_data > data && end_data[-1] == 0 )
6fb37a
+                        end_data--;
6fb37a
+                if ( end_data == data )
6fb37a
+                   {	/* Blank line */
6fb37a
+                        num_blank_lines++;
6fb37a
+                   }
6fb37a
+                else
6fb37a
+                   {	int i;
6fb37a
+                        byte *odp;
6fb37a
+                        byte *row;
6fb37a
+
6fb37a
+                        /* Transpose the data to get pixel planes. */
6fb37a
+                        for ( i = 0, odp = plane_data; i < DATA_SIZE;
6fb37a
+                              i += 8, odp++
6fb37a
+                            )
6fb37a
+                        { /* The following is for 16-bit machines */
6fb37a
 #define spread3(c)\
6fb37a
  { 0, c, c*0x100, c*0x101, c*0x10000L, c*0x10001L, c*0x10100L, c*0x10101L }
6fb37a
-                                   static ulong spr40[8] = spread3(0x40);
6fb37a
-                                   static ulong spr8[8] = spread3(8);
6fb37a
-                                   static ulong spr2[8] = spread3(2);
6fb37a
-                                   register byte *dp = data + i;
6fb37a
-                                   register ulong pword =
6fb37a
-                                     (spr40[dp[0]] << 1) +
6fb37a
-                                     (spr40[dp[1]]) +
6fb37a
-                                     (spr40[dp[2]] >> 1) +
6fb37a
-                                     (spr8[dp[3]] << 1) +
6fb37a
-                                     (spr8[dp[4]]) +
6fb37a
-                                     (spr8[dp[5]] >> 1) +
6fb37a
-                                     (spr2[dp[6]]) +
6fb37a
-                                     (spr2[dp[7]] >> 1);
6fb37a
-                                   odp[0] = (byte)(pword >> 16);
6fb37a
-                                   odp[LINE_SIZE] = (byte)(pword >> 8);
6fb37a
-                                   odp[LINE_SIZE*2] = (byte)(pword);
6fb37a
-                                 }
6fb37a
-                                /* Skip blank lines if any */
6fb37a
-                                if ( num_blank_lines > 0 )
6fb37a
-                                   {
6fb37a
-                                        /* Do "dot skips" */
6fb37a
-                                        while(num_blank_lines > 255)
6fb37a
-                                          {
6fb37a
-                                          fputs("\033e\377",prn_stream);
6fb37a
-                                          num_blank_lines -= 255;
6fb37a
-                                          }
6fb37a
-                                        vtp = num_blank_lines;
6fb37a
-                                        fprintf(prn_stream,"\033e%c",vtp);
6fb37a
-                                        num_blank_lines = 0;
6fb37a
-                                   }
6fb37a
-
6fb37a
-                                /* Transfer raster graphics in the order R, G, B. */
6fb37a
-                                /* Apparently it is stored in B, G, R */
6fb37a
-                                /* Calculate the amount of data to send by what */
6fb37a
-                                /* Ghostscript tells us the scan line_size in (bytes) */
6fb37a
-
6fb37a
-                                count = line_size / 3;
6fb37a
-                                line_size_color_plane = count / 3;
6fb37a
-                           cnt_2prn = line_size_color_plane * 3 + 5;
6fb37a
-                                tempcnt = cnt_2prn;
6fb37a
-                                cntc1 = (tempcnt & 0xFF00) >> 8;
6fb37a
-                                cntc2 = (tempcnt & 0x00FF);
6fb37a
-                                fprintf(prn_stream, "\033[O%c%c\200\037",cntc2,cntc1);
6fb37a
-                                fputc('\000',prn_stream);
6fb37a
+                           static ulong spr40[8] = spread3(0x40);
6fb37a
+                           static ulong spr8[8] = spread3(8);
6fb37a
+                           static ulong spr2[8] = spread3(2);
6fb37a
+                           register byte *dp = data + i;
6fb37a
+                           register ulong pword =
6fb37a
+                             (spr40[dp[0]] << 1) +
6fb37a
+                             (spr40[dp[1]]) +
6fb37a
+                             (spr40[dp[2]] >> 1) +
6fb37a
+                             (spr8[dp[3]] << 1) +
6fb37a
+                             (spr8[dp[4]]) +
6fb37a
+                             (spr8[dp[5]] >> 1) +
6fb37a
+                             (spr2[dp[6]]) +
6fb37a
+                             (spr2[dp[7]] >> 1);
6fb37a
+                           odp[0] = (byte)(pword >> 16);
6fb37a
+                           odp[LINE_SIZE] = (byte)(pword >> 8);
6fb37a
+                           odp[LINE_SIZE*2] = (byte)(pword);
6fb37a
+                        }
6fb37a
+                        /* Skip blank lines if any */
6fb37a
+                        if ( num_blank_lines > 0 )
6fb37a
+                           {
6fb37a
+                                /* Do "dot skips" */
6fb37a
+                                while(num_blank_lines > 255)
6fb37a
+                                  {
6fb37a
+                                  fputs("\033e\377",prn_stream);
6fb37a
+                                  num_blank_lines -= 255;
6fb37a
+                                  }
6fb37a
+                                vtp = num_blank_lines;
6fb37a
+                                fprintf(prn_stream,"\033e%c",vtp);
6fb37a
+                                num_blank_lines = 0;
6fb37a
+                           }
6fb37a
+
6fb37a
+                        /* Transfer raster graphics in the order R, G, B. */
6fb37a
+                        /* Apparently it is stored in B, G, R */
6fb37a
+                        /* Calculate the amount of data to send by what */
6fb37a
+                        /* Ghostscript tells us the scan line_size in (bytes) */
6fb37a
+
6fb37a
+                        count = line_size / 3;
6fb37a
+                        line_size_color_plane = count / 3;
6fb37a
+                        cnt_2prn = line_size_color_plane * 3 + 5;
6fb37a
+                        tempcnt = cnt_2prn;
6fb37a
+                        cntc1 = (tempcnt & 0xFF00) >> 8;
6fb37a
+                        cntc2 = (tempcnt & 0x00FF);
6fb37a
+                        fprintf(prn_stream, "\033[O%c%c\200\037",cntc2,cntc1);
6fb37a
+                        fputc('\000',prn_stream);
6fb37a
                         fputs("\124\124",prn_stream);
6fb37a
 
6fb37a
-                                for ( row = plane_data + LINE_SIZE * 2, i = 0;
6fb37a
-                                      i < 3; row -= LINE_SIZE, i++ )
6fb37a
-                                {	int jj;
6fb37a
-                                   byte ctemp;
6fb37a
-                                   odp = row;
6fb37a
-                                        /* Complement bytes */
6fb37a
-                                        for (jj=0; jj< line_size_color_plane; jj++)
6fb37a
-                                          { ctemp = *odp;
6fb37a
-                                            *odp++ = ~ctemp;
6fb37a
-                                                 }
6fb37a
-                                        fwrite(row, sizeof(byte),
6fb37a
-                                            line_size_color_plane, prn_stream);
6fb37a
-                                        }
6fb37a
-                           }
6fb37a
-                   }
6fb37a
-           }
6fb37a
+                        for ( row = plane_data + LINE_SIZE * 2, i = 0;
6fb37a
+                              i < 3; row -= LINE_SIZE, i++ )
6fb37a
+                        {  int jj;
6fb37a
+                           byte ctemp;
6fb37a
+                           odp = row;
6fb37a
+                              /* Complement bytes */
6fb37a
+                              for (jj=0; jj< line_size_color_plane; jj++)
6fb37a
+                              { ctemp = *odp;
6fb37a
+                                *odp++ = ~ctemp;
6fb37a
+                              }
6fb37a
+                           fwrite(row, sizeof(byte),
6fb37a
+                           line_size_color_plane, prn_stream);
6fb37a
+                        }
6fb37a
+                  }
6fb37a
+            }
6fb37a
+   }
6fb37a
 
6fb37a
         /* eject page */
6fb37a
         fputs("\014", prn_stream);