Blame SOURCES/ghostscript-cve-2020-16310.patch

f706a9
diff --git a/devices/gdevdm24.c b/devices/gdevdm24.c
f706a9
index 4736f4f..2f610cd 100644
f706a9
--- a/devices/gdevdm24.c
f706a9
+++ b/devices/gdevdm24.c
f706a9
@@ -51,21 +51,39 @@ static void dot24_improve_bitmap (byte *, int);
f706a9
 static int
f706a9
 dot24_print_page (gx_device_printer *pdev, FILE *prn_stream, char *init_string, int init_len)
f706a9
 {
f706a9
-  int xres = (int)pdev->x_pixels_per_inch;
f706a9
-  int yres = (int)pdev->y_pixels_per_inch;
f706a9
-  int x_high = (xres == 360);
f706a9
-  int y_high = (yres == 360);
f706a9
-  int bits_per_column = (y_high ? 48 : 24);
f706a9
-  uint line_size = gdev_prn_raster (pdev);
f706a9
-  uint in_size = line_size * bits_per_column;
f706a9
-  byte *in = (byte *) gs_malloc (pdev->memory, in_size, 1, "dot24_print_page (in)");
f706a9
-  uint out_size = ((pdev->width + 7) & -8) * 3;
f706a9
-  byte *out = (byte *) gs_malloc (pdev->memory, out_size, 1, "dot24_print_page (out)");
f706a9
-  int y_passes = (y_high ? 2 : 1);
f706a9
-  int dots_per_space = xres / 10;	/* pica space = 1/10" */
f706a9
-  int bytes_per_space = dots_per_space * 3;
f706a9
+  int xres;
f706a9
+  int yres;
f706a9
+  int x_high;
f706a9
+  int y_high;
f706a9
+  int bits_per_column;
f706a9
+  uint line_size;
f706a9
+  uint in_size;
f706a9
+  byte *in;
f706a9
+  uint out_size;
f706a9
+  byte *out;
f706a9
+  int y_passes;
f706a9
+  int dots_per_space;
f706a9
+  int bytes_per_space;
f706a9
   int skip = 0, lnum = 0, ypass;
f706a9
 
f706a9
+  xres = (int)pdev->x_pixels_per_inch;
f706a9
+  yres = (int)pdev->y_pixels_per_inch;
f706a9
+  x_high = (xres == 360);
f706a9
+  y_high = (yres == 360);
f706a9
+  dots_per_space = xres / 10;       /* pica space = 1/10" */
f706a9
+  bytes_per_space = dots_per_space * 3;
f706a9
+  if (bytes_per_space == 0) {
f706a9
+    /* We divide by bytes_per_space later on. */
f706a9
+    return_error(gs_error_rangecheck);
f706a9
+  }
f706a9
+  bits_per_column = (y_high ? 48 : 24);
f706a9
+  line_size = gdev_prn_raster (pdev);
f706a9
+  in_size = line_size * bits_per_column;
f706a9
+  in = (byte *) gs_malloc (pdev->memory, in_size, 1, "dot24_print_page (in)");
f706a9
+  out_size = ((pdev->width + 7) & -8) * 3;
f706a9
+  out = (byte *) gs_malloc (pdev->memory, out_size, 1, "dot24_print_page (out)");
f706a9
+  y_passes = (y_high ? 2 : 1);
f706a9
+
f706a9
   /* Check allocations */
f706a9
   if (in == 0 || out == 0)
f706a9
     {