diff options
author | Ray Johnston <ray.johnston@artifex.com> | 2017-11-21 12:48:54 -0800 |
---|---|---|
committer | Ray Johnston <ray.johnston@artifex.com> | 2017-11-21 21:27:19 -0800 |
commit | 362ec9daadb9992b0def3520cd1dc6fa52edd1c4 (patch) | |
tree | 7bb4ab11f97cf95f934ad187839feee51465677e | |
parent | 68fa913b5bc06a4250115f52835cadc5493aab12 (diff) |
Fix bug 697459 Buffer overflow in fill_threshold_buffer
There was an overflow check for ht_buffer size, but none for the larger
threshold_buffer. Note that this file didn't fail on Windows because the
combination of the ht_buffer and the size of the (miscalculated due to
overflow) threshold_buffer would have exceeded the 2Gb limit.
-rw-r--r-- | base/gxht_thresh.c | 13 | ||||
-rw-r--r-- | base/gxipixel.c | 2 |
2 files changed, 11 insertions, 4 deletions
diff --git a/base/gxht_thresh.c b/base/gxht_thresh.c index 3fb840213..726861685 100644 --- a/base/gxht_thresh.c +++ b/base/gxht_thresh.c | |||
@@ -711,7 +711,9 @@ gxht_thresh_image_init(gx_image_enum *penum) | |||
711 | space */ | 711 | space */ |
712 | max_height = (int) ceil(fixed2float(any_abs(penum->dst_height)) / | 712 | max_height = (int) ceil(fixed2float(any_abs(penum->dst_height)) / |
713 | (float) penum->Height); | 713 | (float) penum->Height); |
714 | if ((max_height > 0) && (penum->ht_stride * spp_out > max_int / max_height)) | 714 | if (max_height <= 0) |
715 | return -1; /* shouldn't happen, but check so we don't div by zero */ | ||
716 | if (penum->ht_stride * spp_out > max_int / max_height) | ||
715 | return -1; /* overflow */ | 717 | return -1; /* overflow */ |
716 | 718 | ||
717 | penum->ht_buffer = | 719 | penum->ht_buffer = |
@@ -734,6 +736,11 @@ gxht_thresh_image_init(gx_image_enum *penum) | |||
734 | Also allow a 15 sample over run during the execution. */ | 736 | Also allow a 15 sample over run during the execution. */ |
735 | temp = (int) ceil((float) ((dev_width + 15.0) + 15.0)/16.0); | 737 | temp = (int) ceil((float) ((dev_width + 15.0) + 15.0)/16.0); |
736 | penum->line_size = bitmap_raster(temp * 16 * 8); /* The stride */ | 738 | penum->line_size = bitmap_raster(temp * 16 * 8); /* The stride */ |
739 | if (penum->line_size > max_int / max_height) { | ||
740 | gs_free_object(penum->memory, penum->ht_buffer, "gxht_thresh"); | ||
741 | penum->ht_buffer = NULL; | ||
742 | return -1; /* thresh_buffer size overflow */ | ||
743 | } | ||
737 | penum->line = gs_alloc_bytes(penum->memory, penum->line_size * spp_out, | 744 | penum->line = gs_alloc_bytes(penum->memory, penum->line_size * spp_out, |
738 | "gxht_thresh"); | 745 | "gxht_thresh"); |
739 | penum->thresh_buffer = gs_alloc_bytes(penum->memory, | 746 | penum->thresh_buffer = gs_alloc_bytes(penum->memory, |
@@ -754,7 +761,7 @@ gxht_thresh_image_init(gx_image_enum *penum) | |||
754 | } | 761 | } |
755 | 762 | ||
756 | static void | 763 | static void |
757 | fill_threshhold_buffer(byte *dest_strip, byte *src_strip, int src_width, | 764 | fill_threshold_buffer(byte *dest_strip, byte *src_strip, int src_width, |
758 | int left_offset, int left_width, int num_tiles, | 765 | int left_offset, int left_width, int num_tiles, |
759 | int right_width) | 766 | int right_width) |
760 | { | 767 | { |
@@ -908,7 +915,7 @@ gxht_thresh_planes(gx_image_enum *penum, fixed xrun, | |||
908 | to update with stride */ | 915 | to update with stride */ |
909 | position = contone_stride * k; | 916 | position = contone_stride * k; |
910 | /* Tile into the 128 bit aligned threshold strip */ | 917 | /* Tile into the 128 bit aligned threshold strip */ |
911 | fill_threshhold_buffer(&(thresh_align[position]), | 918 | fill_threshold_buffer(&(thresh_align[position]), |
912 | thresh_tile, thresh_width, dx, left_width, | 919 | thresh_tile, thresh_width, dx, left_width, |
913 | num_full_tiles, right_tile_width); | 920 | num_full_tiles, right_tile_width); |
914 | } | 921 | } |
diff --git a/base/gxipixel.c b/base/gxipixel.c index edd40c52d..cb4f02a09 100644 --- a/base/gxipixel.c +++ b/base/gxipixel.c | |||
@@ -758,7 +758,7 @@ gx_image_enum_begin(gx_device * dev, const gs_gstate * pgs, | |||
758 | penum->memory = mem; | 758 | penum->memory = mem; |
759 | penum->buffer = buffer; | 759 | penum->buffer = buffer; |
760 | penum->buffer_size = bsize; | 760 | penum->buffer_size = bsize; |
761 | penum->line = 0; | 761 | penum->line = NULL; |
762 | penum->icc_link = NULL; | 762 | penum->icc_link = NULL; |
763 | penum->color_cache = NULL; | 763 | penum->color_cache = NULL; |
764 | penum->ht_buffer = NULL; | 764 | penum->ht_buffer = NULL; |