Blame SOURCES/ghostscript-cve-2020-16310.patch

8d372f
diff --git a/devices/gdevdm24.c b/devices/gdevdm24.c
8d372f
index 4736f4f..2f610cd 100644
8d372f
--- a/devices/gdevdm24.c
8d372f
+++ b/devices/gdevdm24.c
8d372f
@@ -51,21 +51,39 @@ static void dot24_improve_bitmap (byte *, int);
8d372f
 static int
8d372f
 dot24_print_page (gx_device_printer *pdev, FILE *prn_stream, char *init_string, int init_len)
8d372f
 {
8d372f
-  int xres = (int)pdev->x_pixels_per_inch;
8d372f
-  int yres = (int)pdev->y_pixels_per_inch;
8d372f
-  int x_high = (xres == 360);
8d372f
-  int y_high = (yres == 360);
8d372f
-  int bits_per_column = (y_high ? 48 : 24);
8d372f
-  uint line_size = gdev_prn_raster (pdev);
8d372f
-  uint in_size = line_size * bits_per_column;
8d372f
-  byte *in = (byte *) gs_malloc (pdev->memory, in_size, 1, "dot24_print_page (in)");
8d372f
-  uint out_size = ((pdev->width + 7) & -8) * 3;
8d372f
-  byte *out = (byte *) gs_malloc (pdev->memory, out_size, 1, "dot24_print_page (out)");
8d372f
-  int y_passes = (y_high ? 2 : 1);
8d372f
-  int dots_per_space = xres / 10;	/* pica space = 1/10" */
8d372f
-  int bytes_per_space = dots_per_space * 3;
8d372f
+  int xres;
8d372f
+  int yres;
8d372f
+  int x_high;
8d372f
+  int y_high;
8d372f
+  int bits_per_column;
8d372f
+  uint line_size;
8d372f
+  uint in_size;
8d372f
+  byte *in;
8d372f
+  uint out_size;
8d372f
+  byte *out;
8d372f
+  int y_passes;
8d372f
+  int dots_per_space;
8d372f
+  int bytes_per_space;
8d372f
   int skip = 0, lnum = 0, ypass;
8d372f
 
8d372f
+  xres = (int)pdev->x_pixels_per_inch;
8d372f
+  yres = (int)pdev->y_pixels_per_inch;
8d372f
+  x_high = (xres == 360);
8d372f
+  y_high = (yres == 360);
8d372f
+  dots_per_space = xres / 10;       /* pica space = 1/10" */
8d372f
+  bytes_per_space = dots_per_space * 3;
8d372f
+  if (bytes_per_space == 0) {
8d372f
+    /* We divide by bytes_per_space later on. */
8d372f
+    return_error(gs_error_rangecheck);
8d372f
+  }
8d372f
+  bits_per_column = (y_high ? 48 : 24);
8d372f
+  line_size = gdev_prn_raster (pdev);
8d372f
+  in_size = line_size * bits_per_column;
8d372f
+  in = (byte *) gs_malloc (pdev->memory, in_size, 1, "dot24_print_page (in)");
8d372f
+  out_size = ((pdev->width + 7) & -8) * 3;
8d372f
+  out = (byte *) gs_malloc (pdev->memory, out_size, 1, "dot24_print_page (out)");
8d372f
+  y_passes = (y_high ? 2 : 1);
8d372f
+
8d372f
   /* Check allocations */
8d372f
   if (in == 0 || out == 0)
8d372f
     {