Blame SOURCES/ghostscript-cve-2020-16307.patch

f706a9
diff --git a/devices/vector/gdevtxtw.c b/devices/vector/gdevtxtw.c
f706a9
index b958027..7f02608 100644
f706a9
--- a/devices/vector/gdevtxtw.c
f706a9
+++ b/devices/vector/gdevtxtw.c
f706a9
@@ -1693,97 +1693,100 @@ static int get_unicode(textw_text_enum_t *penum, gs_font *font, gs_glyph glyph,
f706a9
 
f706a9
     length = font->procs.decode_glyph((gs_font *)font, glyph, ch, NULL, 0);
f706a9
     if (length == 0) {
f706a9
-        code = font->procs.glyph_name(font, glyph, &gnstr);
f706a9
-        if (code >= 0 && gnstr.size == 7) {
f706a9
-            if (!memcmp(gnstr.data, "uni", 3)) {
f706a9
-                static const char *hexdigits = "0123456789ABCDEF";
f706a9
-                char *d0 = strchr(hexdigits, gnstr.data[3]);
f706a9
-                char *d1 = strchr(hexdigits, gnstr.data[4]);
f706a9
-                char *d2 = strchr(hexdigits, gnstr.data[5]);
f706a9
-                char *d3 = strchr(hexdigits, gnstr.data[6]);
f706a9
-
f706a9
-                if (d0 != NULL && d1 != NULL && d2 != NULL && d3 != NULL) {
f706a9
-                    *Buffer++ = ((d0 - hexdigits) << 12) + ((d1 - hexdigits) << 8) + ((d2 - hexdigits) << 4) + (d3 - hexdigits);
f706a9
-                    return 1;
f706a9
-                }
f706a9
-            }
f706a9
-        }
f706a9
-        if (length == 0) {
f706a9
-            single_glyph_list_t *sentry = (single_glyph_list_t *)&SingleGlyphList;
f706a9
-            double_glyph_list_t *dentry = (double_glyph_list_t *)&DoubleGlyphList;
f706a9
-            treble_glyph_list_t *tentry = (treble_glyph_list_t *)&TrebleGlyphList;
f706a9
-            quad_glyph_list_t *qentry = (quad_glyph_list_t *)&QuadGlyphList;
f706a9
-
f706a9
-            /* Search glyph to single Unicode value table */
f706a9
-            while (sentry->Glyph != 0) {
f706a9
-                if (sentry->Glyph[0] < gnstr.data[0]) {
f706a9
-                    sentry++;
f706a9
-                    continue;
f706a9
-                }
f706a9
-                if (sentry->Glyph[0] > gnstr.data[0]){
f706a9
-                    break;
f706a9
-                }
f706a9
-                if (strlen(sentry->Glyph) == gnstr.size) {
f706a9
-                    if(memcmp(gnstr.data, sentry->Glyph, gnstr.size) == 0) {
f706a9
-                        *Buffer = sentry->Unicode;
f706a9
+        if (glyph != GS_NO_GLYPH) {
f706a9
+            code = font->procs.glyph_name(font, glyph, &gnstr);
f706a9
+            if (code >= 0 && gnstr.size == 7) {
f706a9
+                if (!memcmp(gnstr.data, "uni", 3)) {
f706a9
+                    static const char *hexdigits = "0123456789ABCDEF";
f706a9
+                    char *d0 = strchr(hexdigits, gnstr.data[3]);
f706a9
+                    char *d1 = strchr(hexdigits, gnstr.data[4]);
f706a9
+                    char *d2 = strchr(hexdigits, gnstr.data[5]);
f706a9
+                    char *d3 = strchr(hexdigits, gnstr.data[6]);
f706a9
+
f706a9
+                    if (d0 != NULL && d1 != NULL && d2 != NULL && d3 != NULL) {
f706a9
+                        *Buffer++ = ((d0 - hexdigits) << 12) + ((d1 - hexdigits) << 8) + ((d2 - hexdigits) << 4) + (d3 - hexdigits);
f706a9
                         return 1;
f706a9
                     }
f706a9
                 }
f706a9
-                sentry++;
f706a9
             }
f706a9
 
f706a9
-            /* Search glyph to double Unicode value table */
f706a9
-            while (dentry->Glyph != 0) {
f706a9
-                if (dentry->Glyph[0] < gnstr.data[0]) {
f706a9
-                    dentry++;
f706a9
-                    continue;
f706a9
-                }
f706a9
-                if (dentry->Glyph[0] > gnstr.data[0]){
f706a9
-                    break;
f706a9
-                }
f706a9
-                if (strlen(dentry->Glyph) == gnstr.size) {
f706a9
-                    if(memcmp(gnstr.data, dentry->Glyph, gnstr.size) == 0) {
f706a9
-                        memcpy(Buffer, dentry->Unicode, 2);
f706a9
-                        return 2;
f706a9
+            if (length == 0) {
f706a9
+                single_glyph_list_t *sentry = (single_glyph_list_t *)&SingleGlyphList;
f706a9
+                double_glyph_list_t *dentry = (double_glyph_list_t *)&DoubleGlyphList;
f706a9
+                treble_glyph_list_t *tentry = (treble_glyph_list_t *)&TrebleGlyphList;
f706a9
+                quad_glyph_list_t *qentry = (quad_glyph_list_t *)&QuadGlyphList;
f706a9
+
f706a9
+                /* Search glyph to single Unicode value table */
f706a9
+                while (sentry->Glyph != 0) {
f706a9
+                    if (sentry->Glyph[0] < gnstr.data[0]) {
f706a9
+                        sentry++;
f706a9
+                        continue;
f706a9
+                    }
f706a9
+                    if (sentry->Glyph[0] > gnstr.data[0]){
f706a9
+                        break;
f706a9
+                    }
f706a9
+                    if (strlen(sentry->Glyph) == gnstr.size) {
f706a9
+                        if(memcmp(gnstr.data, sentry->Glyph, gnstr.size) == 0) {
f706a9
+                            *Buffer = sentry->Unicode;
f706a9
+                            return 1;
f706a9
+                        }
f706a9
                     }
f706a9
+                    sentry++;
f706a9
                 }
f706a9
-                dentry++;
f706a9
-            }
f706a9
 
f706a9
-            /* Search glyph to triple Unicode value table */
f706a9
-            while (tentry->Glyph != 0) {
f706a9
-                if (tentry->Glyph[0] < gnstr.data[0]) {
f706a9
-                    tentry++;
f706a9
-                    continue;
f706a9
-                }
f706a9
-                if (tentry->Glyph[0] > gnstr.data[0]){
f706a9
-                    break;
f706a9
-                }
f706a9
-                if (strlen(tentry->Glyph) == gnstr.size) {
f706a9
-                    if(memcmp(gnstr.data, tentry->Glyph, gnstr.size) == 0) {
f706a9
-                        memcpy(Buffer, tentry->Unicode, 3);
f706a9
-                        return 3;
f706a9
+                /* Search glyph to double Unicode value table */
f706a9
+                while (dentry->Glyph != 0) {
f706a9
+                    if (dentry->Glyph[0] < gnstr.data[0]) {
f706a9
+                        dentry++;
f706a9
+                        continue;
f706a9
                     }
f706a9
+                    if (dentry->Glyph[0] > gnstr.data[0]){
f706a9
+                        break;
f706a9
+                    }
f706a9
+                    if (strlen(dentry->Glyph) == gnstr.size) {
f706a9
+                        if(memcmp(gnstr.data, dentry->Glyph, gnstr.size) == 0) {
f706a9
+                            memcpy(Buffer, dentry->Unicode, 2);
f706a9
+                            return 2;
f706a9
+                        }
f706a9
+                    }
f706a9
+                    dentry++;
f706a9
                 }
f706a9
-                tentry++;
f706a9
-            }
f706a9
 
f706a9
-            /* Search glyph to quadruple Unicode value table */
f706a9
-            while (qentry->Glyph != 0) {
f706a9
-                if (qentry->Glyph[0] < gnstr.data[0]) {
f706a9
-                    qentry++;
f706a9
-                    continue;
f706a9
-                }
f706a9
-                if (qentry->Glyph[0] > gnstr.data[0]){
f706a9
-                    break;
f706a9
+                /* Search glyph to triple Unicode value table */
f706a9
+                while (tentry->Glyph != 0) {
f706a9
+                    if (tentry->Glyph[0] < gnstr.data[0]) {
f706a9
+                        tentry++;
f706a9
+                        continue;
f706a9
+                    }
f706a9
+                    if (tentry->Glyph[0] > gnstr.data[0]){
f706a9
+                        break;
f706a9
+                    }
f706a9
+                    if (strlen(tentry->Glyph) == gnstr.size) {
f706a9
+                        if(memcmp(gnstr.data, tentry->Glyph, gnstr.size) == 0) {
f706a9
+                            memcpy(Buffer, tentry->Unicode, 3);
f706a9
+                            return 3;
f706a9
+                        }
f706a9
+                    }
f706a9
+                    tentry++;
f706a9
                 }
f706a9
-                if (strlen(qentry->Glyph) == gnstr.size) {
f706a9
-                    if(memcmp(gnstr.data, qentry->Glyph, gnstr.size) == 0) {
f706a9
-                        memcpy(Buffer, qentry->Unicode, 4);
f706a9
-                        return 4;
f706a9
+
f706a9
+                /* Search glyph to quadruple Unicode value table */
f706a9
+                while (qentry->Glyph != 0) {
f706a9
+                    if (qentry->Glyph[0] < gnstr.data[0]) {
f706a9
+                        qentry++;
f706a9
+                        continue;
f706a9
+                    }
f706a9
+                    if (qentry->Glyph[0] > gnstr.data[0]){
f706a9
+                        break;
f706a9
                     }
f706a9
+                    if (strlen(qentry->Glyph) == gnstr.size) {
f706a9
+                        if(memcmp(gnstr.data, qentry->Glyph, gnstr.size) == 0) {
f706a9
+                            memcpy(Buffer, qentry->Unicode, 4);
f706a9
+                            return 4;
f706a9
+                        }
f706a9
+                    }
f706a9
+                    qentry++;
f706a9
                 }
f706a9
-                qentry++;
f706a9
             }
f706a9
         }
f706a9
         *Buffer = fallback;
f706a9
@@ -1890,8 +1893,8 @@ txtwrite_process_cmap_text(gs_text_enum_t *pte)
f706a9
                 pte->returned.total_width.x += dpt.x;
f706a9
                 pte->returned.total_width.y += dpt.y;
f706a9
 
f706a9
-                penum->TextBufferIndex += get_unicode(penum, (gs_font *)pte->orig_font, glyph, chr, &penum->TextBuffer[penum->TextBufferIndex]);
f706a9
                 penum->Widths[penum->TextBufferIndex] += dpt.x;
f706a9
+                penum->TextBufferIndex += get_unicode(penum, (gs_font *)pte->orig_font, glyph, chr, &penum->TextBuffer[penum->TextBufferIndex]);
f706a9
                 break;
f706a9
             case 2:		/* end of string */
f706a9
                 return 0;
f706a9
diff --git a/psi/zbfont.c b/psi/zbfont.c
f706a9
index 262fea9..abc03aa 100644
f706a9
--- a/psi/zbfont.c
f706a9
+++ b/psi/zbfont.c
f706a9
@@ -272,7 +272,7 @@ gs_font_map_glyph_to_unicode(gs_font *font, gs_glyph glyph, int ch, ushort *u, u
f706a9
          * can't be a default value for FontInfo.GlyphNames2Unicode .
f706a9
          */
f706a9
     }
f706a9
-    if (glyph <= GS_MIN_CID_GLYPH) {
f706a9
+    if (glyph <= GS_MIN_CID_GLYPH && glyph != GS_NO_GLYPH) {
f706a9
         UnicodeDecoding = zfont_get_to_unicode_map(font->dir);
f706a9
         if (UnicodeDecoding != NULL && r_type(UnicodeDecoding) == t_dictionary)
f706a9
             return gs_font_map_glyph_by_dict(font->memory, UnicodeDecoding, glyph, u, length);