From b7b1e528cd956859e215b0b1aa2ce32653c4774f Mon Sep 17 00:00:00 2001
From: CentOS Sources <bugs@centos.org>
Date: Mar 05 2015 13:26:03 +0000
Subject: import ghostscript-9.07-18.el7


---

diff --git a/SOURCES/ghostscript-crash.patch b/SOURCES/ghostscript-crash.patch
new file mode 100644
index 0000000..4cd24e8
--- /dev/null
+++ b/SOURCES/ghostscript-crash.patch
@@ -0,0 +1,21 @@
+diff -up ghostscript-9.10/psi/ialloc.c.crash ghostscript-9.10/psi/ialloc.c
+--- ghostscript-9.10/psi/ialloc.c.crash	2013-08-30 11:37:28.000000000 +0100
++++ ghostscript-9.10/psi/ialloc.c	2014-06-04 10:47:58.294526685 +0100
+@@ -160,6 +160,7 @@ gs_alloc_ref_array(gs_ref_memory_t * mem
+                    uint num_refs, client_name_t cname)
+ {
+     ref *obj;
++    int i;
+ 
+     /* If we're allocating a run of refs already, */
+     /* and we aren't about to overflow the maximum run length, use it. */
+@@ -224,6 +225,9 @@ gs_alloc_ref_array(gs_ref_memory_t * mem
+             cp->where = (ref_packed *)obj;
+         }
+     }
++    for (i = 0; i < num_refs; i++) {
++        make_null(&(obj[i]));
++    }
+     make_array(parr, attrs | mem->space, num_refs, obj);
+     return 0;
+ }
diff --git a/SOURCES/ghostscript-trio-g.patch b/SOURCES/ghostscript-trio-g.patch
new file mode 100644
index 0000000..c808441
--- /dev/null
+++ b/SOURCES/ghostscript-trio-g.patch
@@ -0,0 +1,25 @@
+diff -up ghostscript-9.07/trio/trio.c~ ghostscript-9.07/trio/trio.c
+--- ghostscript-9.07/trio/trio.c~	2014-05-14 16:44:46.390090859 +0100
++++ ghostscript-9.07/trio/trio.c	2014-05-14 17:52:24.247609272 +0100
+@@ -3172,6 +3172,9 @@ TRIO_ARGS6((self, number, flags, width,
+   if (integerNumber > epsilon)
+     {
+       integerDigits += (int)TrioLogarithm(integerNumber, base);
++      /* Deal with the dangers of casting long double to int */
++      if (integerNumber - TrioPower (base, integerDigits) >= 0)
++	integerDigits++;
+     }
+ 
+   fractionDigits = precision;
+@@ -3255,6 +3258,11 @@ TRIO_ARGS6((self, number, flags, width,
+ 	      integerDigits = (integerNumber > epsilon)
+ 		? 1 + (int)TrioLogarithm(integerNumber, base)
+ 		: 1;
++
++	      /* Deal with the dangers of casting long double to int */
++	      if (integerNumber - TrioPower (base, integerDigits) >= 0)
++		integerDigits++;
++
+ 	      if (flags & FLAGS_FLOAT_G)
+ 		{
+ 		  if (flags & FLAGS_ALTERNATIVE)
diff --git a/SPECS/ghostscript.spec b/SPECS/ghostscript.spec
index b1cfda4..18d4bdd 100644
--- a/SPECS/ghostscript.spec
+++ b/SPECS/ghostscript.spec
@@ -5,7 +5,7 @@ Summary: A PostScript interpreter and renderer
 Name: ghostscript
 Version: %{gs_ver}
 
-Release: 16%{?dist}
+Release: 18%{?dist}
 
 # Included CMap data is Redistributable, no modification permitted,
 # see http://bugzilla.redhat.com/487510
@@ -37,6 +37,8 @@ Patch13: ghostscript-wrf-snprintf.patch
 Patch14: ghostscript-cups-colord.patch
 Patch15: ghostscript-zfapi-crash.patch
 Patch16: ghostscript-gstoraster-costs.patch
+Patch17: ghostscript-trio-g.patch
+Patch18: ghostscript-crash.patch
 
 Requires: urw-fonts >= 1.1, ghostscript-fonts
 Requires: poppler-data
@@ -167,6 +169,12 @@ rm -rf expat freetype icclib jasper jpeg lcms lcms2 libpng openjpeg zlib cups/li
 # Tweak filter costs for gstoraster (part of bug #998977).
 %patch16 -p1 -b .gstoraster-costs
 
+# Fix insufficient integer digits in trio's rendering of "%g" (bug #1096158).
+%patch17 -p1 -b .trio-g
+
+# Prevent memory handling crash (bug #1105519).
+%patch18 -p1 -b .crash
+
 # Remove pdfopt man pages which were mistakenly left in (bug #963882).
 rm man/{de/,}pdfopt.1
 
@@ -366,6 +374,13 @@ rm -rf $RPM_BUILD_ROOT
 %{_libdir}/libgs.so
 
 %changelog
+* Wed Sep 24 2014 Tim Waugh <twaugh@redhat.com> 9.07-18
+- Applied patch from upstream to fix memory handling issue that could
+  lead to crashes (bug #1105519).
+
+* Fri Sep  5 2014 Tim Waugh <twaugh@redhat.com> 9.07-17
+- Fix insufficient integer digits in trio's rendering of "%g" (bug #1096158).
+
 * Fri Jan 24 2014 Daniel Mach <dmach@redhat.com> - 9.07-16
 - Mass rebuild 2014-01-24