diff options
| author | Robin Watts <Robin.Watts@artifex.com> | 2022-01-13 23:49:05 +0000 |
|---|---|---|
| committer | Robin Watts <Robin.Watts@artifex.com> | 2022-01-14 11:57:20 +0000 |
| commit | 9438bd99eb9d2d5ad5496e749840ca86f197ea2e (patch) | |
| tree | 0b36368a18515f3965d492b62ad85fd8c675177c | |
| parent | 519a582891e0d2f6ab2e12134a9e0f35cde8019c (diff) | |
| download | ghostpdl-9438bd99eb9d2d5ad5496e749840ca86f197ea2e.tar.gz | |
OSS-Fuzz 43253.pdf: clist bug
Thanks to Ken for basically doing all the investigation on this.
In the clist code cmd_write_buffer can return 1 to 'warn' of an
approaching low memory problem. The call to this from cmd_put_range_op
was failing to detect this, due to checking for "!= 0" on return
rather than the more usual "< 0".
Simply fixing this solves the bug.
| -rw-r--r-- | base/gxclutil.c | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/base/gxclutil.c b/base/gxclutil.c index 03083ae5e..24e3bb61b 100644 --- a/base/gxclutil.c +++ b/base/gxclutil.c @@ -1,4 +1,4 @@ -/* Copyright (C) 2001-2021 Artifex Software, Inc. +/* Copyright (C) 2001-2022 Artifex Software, Inc. All Rights Reserved. This software is provided AS-IS with no warranty, either express or @@ -457,7 +457,9 @@ cmd_put_range_op(gx_device_clist_writer * cldev, int band_min, int band_max, band_min != cldev->band_range_min || band_max != cldev->band_range_max) ) { - if ((cldev->error_code = cmd_write_buffer(cldev, cmd_opv_end_run)) != 0) { + /* error_code can come back as +ve as a warning that memory + * is getting tight. Don't fail on that. */ + if ((cldev->error_code = cmd_write_buffer(cldev, cmd_opv_end_run)) < 0) { return NULL; } cldev->band_range_min = band_min; @@ -1154,4 +1156,4 @@ Then we repeat gathering the data for the next band: and so on. -*/
\ No newline at end of file +*/ |