Blame SOURCES/ghostscript-cve-2020-16310.patch

0ab051
diff --git a/devices/gdevdm24.c b/devices/gdevdm24.c
0ab051
index 4736f4f..2f610cd 100644
0ab051
--- a/devices/gdevdm24.c
0ab051
+++ b/devices/gdevdm24.c
0ab051
@@ -51,21 +51,39 @@ static void dot24_improve_bitmap (byte *, int);
0ab051
 static int
0ab051
 dot24_print_page (gx_device_printer *pdev, FILE *prn_stream, char *init_string, int init_len)
0ab051
 {
0ab051
-  int xres = (int)pdev->x_pixels_per_inch;
0ab051
-  int yres = (int)pdev->y_pixels_per_inch;
0ab051
-  int x_high = (xres == 360);
0ab051
-  int y_high = (yres == 360);
0ab051
-  int bits_per_column = (y_high ? 48 : 24);
0ab051
-  uint line_size = gdev_prn_raster (pdev);
0ab051
-  uint in_size = line_size * bits_per_column;
0ab051
-  byte *in = (byte *) gs_malloc (pdev->memory, in_size, 1, "dot24_print_page (in)");
0ab051
-  uint out_size = ((pdev->width + 7) & -8) * 3;
0ab051
-  byte *out = (byte *) gs_malloc (pdev->memory, out_size, 1, "dot24_print_page (out)");
0ab051
-  int y_passes = (y_high ? 2 : 1);
0ab051
-  int dots_per_space = xres / 10;	/* pica space = 1/10" */
0ab051
-  int bytes_per_space = dots_per_space * 3;
0ab051
+  int xres;
0ab051
+  int yres;
0ab051
+  int x_high;
0ab051
+  int y_high;
0ab051
+  int bits_per_column;
0ab051
+  uint line_size;
0ab051
+  uint in_size;
0ab051
+  byte *in;
0ab051
+  uint out_size;
0ab051
+  byte *out;
0ab051
+  int y_passes;
0ab051
+  int dots_per_space;
0ab051
+  int bytes_per_space;
0ab051
   int skip = 0, lnum = 0, ypass;
0ab051
 
0ab051
+  xres = (int)pdev->x_pixels_per_inch;
0ab051
+  yres = (int)pdev->y_pixels_per_inch;
0ab051
+  x_high = (xres == 360);
0ab051
+  y_high = (yres == 360);
0ab051
+  dots_per_space = xres / 10;       /* pica space = 1/10" */
0ab051
+  bytes_per_space = dots_per_space * 3;
0ab051
+  if (bytes_per_space == 0) {
0ab051
+    /* We divide by bytes_per_space later on. */
0ab051
+    return_error(gs_error_rangecheck);
0ab051
+  }
0ab051
+  bits_per_column = (y_high ? 48 : 24);
0ab051
+  line_size = gdev_prn_raster (pdev);
0ab051
+  in_size = line_size * bits_per_column;
0ab051
+  in = (byte *) gs_malloc (pdev->memory, in_size, 1, "dot24_print_page (in)");
0ab051
+  out_size = ((pdev->width + 7) & -8) * 3;
0ab051
+  out = (byte *) gs_malloc (pdev->memory, out_size, 1, "dot24_print_page (out)");
0ab051
+  y_passes = (y_high ? 2 : 1);
0ab051
+
0ab051
   /* Check allocations */
0ab051
   if (in == 0 || out == 0)
0ab051
     {