summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorRobin Watts <Robin.Watts@artifex.com>2021-03-19 16:14:33 +0000
committerRobin Watts <Robin.Watts@artifex.com>2021-03-19 16:28:24 +0000
commit2e88e6618d248e42c377d7d2fd758fbaf4b7c68b (patch)
tree0e818181cb1e6a42226346db4e0191fbee45753a
parent9b9605f48d2616e506d8744d72f72427ceac55f6 (diff)
downloadghostpdl-2e88e6618d248e42c377d7d2fd758fbaf4b7c68b.tar.gz
Fix crash in display device (seen with apitest.c).
When calculating the size for the display, we setup a fake gx_device_memory to call the calculation routine with. Because we hadn't initialised the graphics_type_tag sometimes it would incorrectly assume there was 1 more plane than there should be. In calculating the required size, it would therefore add in bitmap_raster(plane[i].depth * width) more bytes for that plane. If plane[i].depth was negative, this would cause the amount of memory we allocate to shrink, and accordingly, we'd allocate too little memory. The fix is to ensure that the fake device is always zero'd to start with.
-rw-r--r--devices/gdevdsp.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/devices/gdevdsp.c b/devices/gdevdsp.c
index 944ae0836..10cfd85e1 100644
--- a/devices/gdevdsp.c
+++ b/devices/gdevdsp.c
@@ -1646,7 +1646,7 @@ display_size_buf_device(gx_device_buf_space_t *space, gx_device *target,
int height, bool for_band)
{
gx_device_display *ddev = (gx_device_display *)target;
- gx_device_memory mdev;
+ gx_device_memory mdev = { 0 };
int code;
int planar = ddev->nFormat & (DISPLAY_PLANAR | DISPLAY_PLANAR_INTERLEAVED);
int interleaved = (ddev->nFormat & DISPLAY_PLANAR_INTERLEAVED);