Blame SOURCES/ghostscript-cve-2020-16307.patch

6fb37a
diff --git a/devices/vector/gdevtxtw.c b/devices/vector/gdevtxtw.c
6fb37a
index b958027..7f02608 100644
6fb37a
--- a/devices/vector/gdevtxtw.c
6fb37a
+++ b/devices/vector/gdevtxtw.c
6fb37a
@@ -1693,97 +1693,100 @@ static int get_unicode(textw_text_enum_t *penum, gs_font *font, gs_glyph glyph,
6fb37a
 
6fb37a
     length = font->procs.decode_glyph((gs_font *)font, glyph, ch, NULL, 0);
6fb37a
     if (length == 0) {
6fb37a
-        code = font->procs.glyph_name(font, glyph, &gnstr);
6fb37a
-        if (code >= 0 && gnstr.size == 7) {
6fb37a
-            if (!memcmp(gnstr.data, "uni", 3)) {
6fb37a
-                static const char *hexdigits = "0123456789ABCDEF";
6fb37a
-                char *d0 = strchr(hexdigits, gnstr.data[3]);
6fb37a
-                char *d1 = strchr(hexdigits, gnstr.data[4]);
6fb37a
-                char *d2 = strchr(hexdigits, gnstr.data[5]);
6fb37a
-                char *d3 = strchr(hexdigits, gnstr.data[6]);
6fb37a
-
6fb37a
-                if (d0 != NULL && d1 != NULL && d2 != NULL && d3 != NULL) {
6fb37a
-                    *Buffer++ = ((d0 - hexdigits) << 12) + ((d1 - hexdigits) << 8) + ((d2 - hexdigits) << 4) + (d3 - hexdigits);
6fb37a
-                    return 1;
6fb37a
-                }
6fb37a
-            }
6fb37a
-        }
6fb37a
-        if (length == 0) {
6fb37a
-            single_glyph_list_t *sentry = (single_glyph_list_t *)&SingleGlyphList;
6fb37a
-            double_glyph_list_t *dentry = (double_glyph_list_t *)&DoubleGlyphList;
6fb37a
-            treble_glyph_list_t *tentry = (treble_glyph_list_t *)&TrebleGlyphList;
6fb37a
-            quad_glyph_list_t *qentry = (quad_glyph_list_t *)&QuadGlyphList;
6fb37a
-
6fb37a
-            /* Search glyph to single Unicode value table */
6fb37a
-            while (sentry->Glyph != 0) {
6fb37a
-                if (sentry->Glyph[0] < gnstr.data[0]) {
6fb37a
-                    sentry++;
6fb37a
-                    continue;
6fb37a
-                }
6fb37a
-                if (sentry->Glyph[0] > gnstr.data[0]){
6fb37a
-                    break;
6fb37a
-                }
6fb37a
-                if (strlen(sentry->Glyph) == gnstr.size) {
6fb37a
-                    if(memcmp(gnstr.data, sentry->Glyph, gnstr.size) == 0) {
6fb37a
-                        *Buffer = sentry->Unicode;
6fb37a
+        if (glyph != GS_NO_GLYPH) {
6fb37a
+            code = font->procs.glyph_name(font, glyph, &gnstr);
6fb37a
+            if (code >= 0 && gnstr.size == 7) {
6fb37a
+                if (!memcmp(gnstr.data, "uni", 3)) {
6fb37a
+                    static const char *hexdigits = "0123456789ABCDEF";
6fb37a
+                    char *d0 = strchr(hexdigits, gnstr.data[3]);
6fb37a
+                    char *d1 = strchr(hexdigits, gnstr.data[4]);
6fb37a
+                    char *d2 = strchr(hexdigits, gnstr.data[5]);
6fb37a
+                    char *d3 = strchr(hexdigits, gnstr.data[6]);
6fb37a
+
6fb37a
+                    if (d0 != NULL && d1 != NULL && d2 != NULL && d3 != NULL) {
6fb37a
+                        *Buffer++ = ((d0 - hexdigits) << 12) + ((d1 - hexdigits) << 8) + ((d2 - hexdigits) << 4) + (d3 - hexdigits);
6fb37a
                         return 1;
6fb37a
                     }
6fb37a
                 }
6fb37a
-                sentry++;
6fb37a
             }
6fb37a
 
6fb37a
-            /* Search glyph to double Unicode value table */
6fb37a
-            while (dentry->Glyph != 0) {
6fb37a
-                if (dentry->Glyph[0] < gnstr.data[0]) {
6fb37a
-                    dentry++;
6fb37a
-                    continue;
6fb37a
-                }
6fb37a
-                if (dentry->Glyph[0] > gnstr.data[0]){
6fb37a
-                    break;
6fb37a
-                }
6fb37a
-                if (strlen(dentry->Glyph) == gnstr.size) {
6fb37a
-                    if(memcmp(gnstr.data, dentry->Glyph, gnstr.size) == 0) {
6fb37a
-                        memcpy(Buffer, dentry->Unicode, 2);
6fb37a
-                        return 2;
6fb37a
+            if (length == 0) {
6fb37a
+                single_glyph_list_t *sentry = (single_glyph_list_t *)&SingleGlyphList;
6fb37a
+                double_glyph_list_t *dentry = (double_glyph_list_t *)&DoubleGlyphList;
6fb37a
+                treble_glyph_list_t *tentry = (treble_glyph_list_t *)&TrebleGlyphList;
6fb37a
+                quad_glyph_list_t *qentry = (quad_glyph_list_t *)&QuadGlyphList;
6fb37a
+
6fb37a
+                /* Search glyph to single Unicode value table */
6fb37a
+                while (sentry->Glyph != 0) {
6fb37a
+                    if (sentry->Glyph[0] < gnstr.data[0]) {
6fb37a
+                        sentry++;
6fb37a
+                        continue;
6fb37a
+                    }
6fb37a
+                    if (sentry->Glyph[0] > gnstr.data[0]){
6fb37a
+                        break;
6fb37a
+                    }
6fb37a
+                    if (strlen(sentry->Glyph) == gnstr.size) {
6fb37a
+                        if(memcmp(gnstr.data, sentry->Glyph, gnstr.size) == 0) {
6fb37a
+                            *Buffer = sentry->Unicode;
6fb37a
+                            return 1;
6fb37a
+                        }
6fb37a
                     }
6fb37a
+                    sentry++;
6fb37a
                 }
6fb37a
-                dentry++;
6fb37a
-            }
6fb37a
 
6fb37a
-            /* Search glyph to triple Unicode value table */
6fb37a
-            while (tentry->Glyph != 0) {
6fb37a
-                if (tentry->Glyph[0] < gnstr.data[0]) {
6fb37a
-                    tentry++;
6fb37a
-                    continue;
6fb37a
-                }
6fb37a
-                if (tentry->Glyph[0] > gnstr.data[0]){
6fb37a
-                    break;
6fb37a
-                }
6fb37a
-                if (strlen(tentry->Glyph) == gnstr.size) {
6fb37a
-                    if(memcmp(gnstr.data, tentry->Glyph, gnstr.size) == 0) {
6fb37a
-                        memcpy(Buffer, tentry->Unicode, 3);
6fb37a
-                        return 3;
6fb37a
+                /* Search glyph to double Unicode value table */
6fb37a
+                while (dentry->Glyph != 0) {
6fb37a
+                    if (dentry->Glyph[0] < gnstr.data[0]) {
6fb37a
+                        dentry++;
6fb37a
+                        continue;
6fb37a
                     }
6fb37a
+                    if (dentry->Glyph[0] > gnstr.data[0]){
6fb37a
+                        break;
6fb37a
+                    }
6fb37a
+                    if (strlen(dentry->Glyph) == gnstr.size) {
6fb37a
+                        if(memcmp(gnstr.data, dentry->Glyph, gnstr.size) == 0) {
6fb37a
+                            memcpy(Buffer, dentry->Unicode, 2);
6fb37a
+                            return 2;
6fb37a
+                        }
6fb37a
+                    }
6fb37a
+                    dentry++;
6fb37a
                 }
6fb37a
-                tentry++;
6fb37a
-            }
6fb37a
 
6fb37a
-            /* Search glyph to quadruple Unicode value table */
6fb37a
-            while (qentry->Glyph != 0) {
6fb37a
-                if (qentry->Glyph[0] < gnstr.data[0]) {
6fb37a
-                    qentry++;
6fb37a
-                    continue;
6fb37a
-                }
6fb37a
-                if (qentry->Glyph[0] > gnstr.data[0]){
6fb37a
-                    break;
6fb37a
+                /* Search glyph to triple Unicode value table */
6fb37a
+                while (tentry->Glyph != 0) {
6fb37a
+                    if (tentry->Glyph[0] < gnstr.data[0]) {
6fb37a
+                        tentry++;
6fb37a
+                        continue;
6fb37a
+                    }
6fb37a
+                    if (tentry->Glyph[0] > gnstr.data[0]){
6fb37a
+                        break;
6fb37a
+                    }
6fb37a
+                    if (strlen(tentry->Glyph) == gnstr.size) {
6fb37a
+                        if(memcmp(gnstr.data, tentry->Glyph, gnstr.size) == 0) {
6fb37a
+                            memcpy(Buffer, tentry->Unicode, 3);
6fb37a
+                            return 3;
6fb37a
+                        }
6fb37a
+                    }
6fb37a
+                    tentry++;
6fb37a
                 }
6fb37a
-                if (strlen(qentry->Glyph) == gnstr.size) {
6fb37a
-                    if(memcmp(gnstr.data, qentry->Glyph, gnstr.size) == 0) {
6fb37a
-                        memcpy(Buffer, qentry->Unicode, 4);
6fb37a
-                        return 4;
6fb37a
+
6fb37a
+                /* Search glyph to quadruple Unicode value table */
6fb37a
+                while (qentry->Glyph != 0) {
6fb37a
+                    if (qentry->Glyph[0] < gnstr.data[0]) {
6fb37a
+                        qentry++;
6fb37a
+                        continue;
6fb37a
+                    }
6fb37a
+                    if (qentry->Glyph[0] > gnstr.data[0]){
6fb37a
+                        break;
6fb37a
                     }
6fb37a
+                    if (strlen(qentry->Glyph) == gnstr.size) {
6fb37a
+                        if(memcmp(gnstr.data, qentry->Glyph, gnstr.size) == 0) {
6fb37a
+                            memcpy(Buffer, qentry->Unicode, 4);
6fb37a
+                            return 4;
6fb37a
+                        }
6fb37a
+                    }
6fb37a
+                    qentry++;
6fb37a
                 }
6fb37a
-                qentry++;
6fb37a
             }
6fb37a
         }
6fb37a
         *Buffer = fallback;
6fb37a
@@ -1890,8 +1893,8 @@ txtwrite_process_cmap_text(gs_text_enum_t *pte)
6fb37a
                 pte->returned.total_width.x += dpt.x;
6fb37a
                 pte->returned.total_width.y += dpt.y;
6fb37a
 
6fb37a
-                penum->TextBufferIndex += get_unicode(penum, (gs_font *)pte->orig_font, glyph, chr, &penum->TextBuffer[penum->TextBufferIndex]);
6fb37a
                 penum->Widths[penum->TextBufferIndex] += dpt.x;
6fb37a
+                penum->TextBufferIndex += get_unicode(penum, (gs_font *)pte->orig_font, glyph, chr, &penum->TextBuffer[penum->TextBufferIndex]);
6fb37a
                 break;
6fb37a
             case 2:		/* end of string */
6fb37a
                 return 0;
6fb37a
diff --git a/psi/zbfont.c b/psi/zbfont.c
6fb37a
index 262fea9..abc03aa 100644
6fb37a
--- a/psi/zbfont.c
6fb37a
+++ b/psi/zbfont.c
6fb37a
@@ -272,7 +272,7 @@ gs_font_map_glyph_to_unicode(gs_font *font, gs_glyph glyph, int ch, ushort *u, u
6fb37a
          * can't be a default value for FontInfo.GlyphNames2Unicode .
6fb37a
          */
6fb37a
     }
6fb37a
-    if (glyph <= GS_MIN_CID_GLYPH) {
6fb37a
+    if (glyph <= GS_MIN_CID_GLYPH && glyph != GS_NO_GLYPH) {
6fb37a
         UnicodeDecoding = zfont_get_to_unicode_map(font->dir);
6fb37a
         if (UnicodeDecoding != NULL && r_type(UnicodeDecoding) == t_dictionary)
6fb37a
             return gs_font_map_glyph_by_dict(font->memory, UnicodeDecoding, glyph, u, length);