Blame SOURCES/ghostscript-cve-2020-16310.patch

6fb37a
diff --git a/devices/gdevdm24.c b/devices/gdevdm24.c
6fb37a
index 4736f4f..2f610cd 100644
6fb37a
--- a/devices/gdevdm24.c
6fb37a
+++ b/devices/gdevdm24.c
6fb37a
@@ -51,21 +51,39 @@ static void dot24_improve_bitmap (byte *, int);
6fb37a
 static int
6fb37a
 dot24_print_page (gx_device_printer *pdev, FILE *prn_stream, char *init_string, int init_len)
6fb37a
 {
6fb37a
-  int xres = (int)pdev->x_pixels_per_inch;
6fb37a
-  int yres = (int)pdev->y_pixels_per_inch;
6fb37a
-  int x_high = (xres == 360);
6fb37a
-  int y_high = (yres == 360);
6fb37a
-  int bits_per_column = (y_high ? 48 : 24);
6fb37a
-  uint line_size = gdev_prn_raster (pdev);
6fb37a
-  uint in_size = line_size * bits_per_column;
6fb37a
-  byte *in = (byte *) gs_malloc (pdev->memory, in_size, 1, "dot24_print_page (in)");
6fb37a
-  uint out_size = ((pdev->width + 7) & -8) * 3;
6fb37a
-  byte *out = (byte *) gs_malloc (pdev->memory, out_size, 1, "dot24_print_page (out)");
6fb37a
-  int y_passes = (y_high ? 2 : 1);
6fb37a
-  int dots_per_space = xres / 10;	/* pica space = 1/10" */
6fb37a
-  int bytes_per_space = dots_per_space * 3;
6fb37a
+  int xres;
6fb37a
+  int yres;
6fb37a
+  int x_high;
6fb37a
+  int y_high;
6fb37a
+  int bits_per_column;
6fb37a
+  uint line_size;
6fb37a
+  uint in_size;
6fb37a
+  byte *in;
6fb37a
+  uint out_size;
6fb37a
+  byte *out;
6fb37a
+  int y_passes;
6fb37a
+  int dots_per_space;
6fb37a
+  int bytes_per_space;
6fb37a
   int skip = 0, lnum = 0, ypass;
6fb37a
 
6fb37a
+  xres = (int)pdev->x_pixels_per_inch;
6fb37a
+  yres = (int)pdev->y_pixels_per_inch;
6fb37a
+  x_high = (xres == 360);
6fb37a
+  y_high = (yres == 360);
6fb37a
+  dots_per_space = xres / 10;       /* pica space = 1/10" */
6fb37a
+  bytes_per_space = dots_per_space * 3;
6fb37a
+  if (bytes_per_space == 0) {
6fb37a
+    /* We divide by bytes_per_space later on. */
6fb37a
+    return_error(gs_error_rangecheck);
6fb37a
+  }
6fb37a
+  bits_per_column = (y_high ? 48 : 24);
6fb37a
+  line_size = gdev_prn_raster (pdev);
6fb37a
+  in_size = line_size * bits_per_column;
6fb37a
+  in = (byte *) gs_malloc (pdev->memory, in_size, 1, "dot24_print_page (in)");
6fb37a
+  out_size = ((pdev->width + 7) & -8) * 3;
6fb37a
+  out = (byte *) gs_malloc (pdev->memory, out_size, 1, "dot24_print_page (out)");
6fb37a
+  y_passes = (y_high ? 2 : 1);
6fb37a
+
6fb37a
   /* Check allocations */
6fb37a
   if (in == 0 || out == 0)
6fb37a
     {