diff options
author | Julian Smith <jules@op59.net> | 2019-10-29 16:49:13 +0000 |
---|---|---|
committer | Julian Smith <jules@op59.net> | 2019-10-29 17:40:36 +0000 |
commit | 89f58f1aa95b3482cadf6977da49457194ee5358 (patch) | |
tree | 62adcd0a067216342dfc9bbd714505045d2360d7 | |
parent | 863ada11f9a942a622a581312e2be022d9e2a6f7 (diff) |
Bug 701794: check for x_dpi out of range in epsc_print_page().
Avoids out-of-bounds of local arrays graphics_modes_9 and graphics_modes_24.
Larger diff than would like, because can't return error from within
declarations in old-style C.
Fixes:
./sanbin/gs -r680 -sOutputFile=tmp -sDEVICE=epsonc ../bug-701794.pdf
-rw-r--r-- | devices/gdevepsc.c | 54 |
1 files changed, 39 insertions, 15 deletions
diff --git a/devices/gdevepsc.c b/devices/gdevepsc.c index 192128a43..2f04914a0 100644 --- a/devices/gdevepsc.c +++ b/devices/gdevepsc.c @@ -174,27 +174,51 @@ epsc_print_page(gx_device_printer * pdev, gp_file * prn_stream) int y_mult = (y_24pin ? 3 : 1); int line_size = (pdev->width + 7) >> 3; /* always mono */ int in_size = line_size * (8 * y_mult); - byte *in = - (byte *) gs_malloc(pdev->memory, in_size + 1, 1, - "epsc_print_page(in)"); int out_size = ((pdev->width + 7) & -8) * y_mult; - byte *out = - (byte *) gs_malloc(pdev->memory, out_size + 1, 1, - "epsc_print_page(out)"); + byte *in; + byte *out; int x_dpi = (int)pdev->x_pixels_per_inch; - char start_graphics = (char) - ((y_24pin ? graphics_modes_24 : graphics_modes_9)[x_dpi / 60]); - int first_pass = (start_graphics & DD ? 1 : 0); - int last_pass = first_pass * 2; - int dots_per_space = x_dpi / 10; /* pica space = 1/10" */ - int bytes_per_space = dots_per_space * y_mult; + + char start_graphics; + int first_pass; + int last_pass; + int dots_per_space; + int bytes_per_space; int skip = 0, lnum = 0, pass; -/* declare color buffer and related vars */ byte *color_in; int color_line_size, color_in_size; - int spare_bits = (pdev->width % 8); /* left over bits to go to margin */ - int whole_bits = pdev->width - spare_bits; + int spare_bits; + int whole_bits; + + int max_dpi = 60 * ( + (y_24pin) ? + sizeof(graphics_modes_24) / sizeof(graphics_modes_24[0]) + : + sizeof(graphics_modes_9) / sizeof(graphics_modes_9[0]) + ) + - 1; + if (x_dpi > max_dpi) { + return_error(gs_error_rangecheck); + } + + in = + (byte *) gs_malloc(pdev->memory, in_size + 1, 1, + "epsc_print_page(in)"); + out = + (byte *) gs_malloc(pdev->memory, out_size + 1, 1, + "epsc_print_page(out)"); + + start_graphics = (char) + ((y_24pin ? graphics_modes_24 : graphics_modes_9)[x_dpi / 60]); + first_pass = (start_graphics & DD ? 1 : 0); + last_pass = first_pass * 2; + dots_per_space = x_dpi / 10; /* pica space = 1/10" */ + bytes_per_space = dots_per_space * y_mult; + + /* declare color buffer and related vars */ + spare_bits = (pdev->width % 8); /* left over bits to go to margin */ + whole_bits = pdev->width - spare_bits; /* Check allocations */ if (in == 0 || out == 0) { |