diff options
| author | Ken Sharp <ken.sharp@artifex.com> | 2022-08-13 16:24:11 +0100 |
|---|---|---|
| committer | Ken Sharp <ken.sharp@artifex.com> | 2022-08-13 17:18:16 +0100 |
| commit | 8386e926f8d096420b527f4934ab8644ad6fd1f3 (patch) | |
| tree | b43223a37d086b45f910d2b98e55c2ffd5a52f1c | |
| parent | 7f0653f6ced8ae25ed8672b036d34c1021a6ea6c (diff) | |
| download | ghostpdl-8386e926f8d096420b527f4934ab8644ad6fd1f3.tar.gz | |
pdfwrite - improve error handling in pdf_write_image
OSS-fuzz #50113 (more)
We save the current stream state before beginning, but if we then got
an error trying to allocate a new stream we did not restore the old
stream state before exiting, leading to the streams being in the wrong
state and an eventual crash.
| -rw-r--r-- | devices/vector/gdevpdfj.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/devices/vector/gdevpdfj.c b/devices/vector/gdevpdfj.c index 026925101..5888ac705 100644 --- a/devices/vector/gdevpdfj.c +++ b/devices/vector/gdevpdfj.c @@ -1,4 +1,4 @@ -/* Copyright (C) 2001-2021 Artifex Software, Inc. +/* Copyright (C) 2001-2022 Artifex Software, Inc. All Rights Reserved. This software is provided AS-IS with no warranty, either express or @@ -348,8 +348,10 @@ pdf_begin_write_image(gx_device_pdf * pdev, pdf_image_writer * piw, } pdev->strm = pdev->streams.strm; pdev->strm = cos_write_stream_alloc(data, pdev, "pdf_begin_write_image"); - if (pdev->strm == 0) + if (pdev->strm == 0) { + pdev->strm = save_strm; return_error(gs_error_VMerror); + } if (!mask) piw->data = data; piw->height = h; |