diff options
| author | Chris Liddell <chris.liddell@artifex.com> | 2013-06-17 15:46:52 +0100 |
|---|---|---|
| committer | Chris Liddell <chris.liddell@artifex.com> | 2013-06-17 15:49:12 +0100 |
| commit | bd08091d295effb51de2cc7e739870e7b2628e38 (patch) | |
| tree | bf3bb94d3d74c134c5bdd9f7e47216b0115ccd9b | |
| parent | 489811e366495db7374f2cf3c71bd4a9bdf77360 (diff) | |
| download | ghostpdl-bd08091d295effb51de2cc7e739870e7b2628e38.tar.gz | |
Bug 694319: "finalize" a font stream before return an error.
pdfwrite and pswrite could, in the event of an error during font writing, leave
the "stream" for the font in a) an invalid state, and b) in place for the
continued writing of the output file.
This caused memory corruption, seg fault etc.
No cluster differences.
| -rw-r--r-- | gs/devices/vector/gdevpdtb.c | 18 |
1 files changed, 13 insertions, 5 deletions
diff --git a/gs/devices/vector/gdevpdtb.c b/gs/devices/vector/gdevpdtb.c index 69d2c0b57..e7456c536 100644 --- a/gs/devices/vector/gdevpdtb.c +++ b/gs/devices/vector/gdevpdtb.c @@ -562,7 +562,7 @@ pdf_write_embedded_font(gx_device_pdf *pdev, pdf_base_font_t *pbfont, font_type gs_const_string fnstr; pdf_data_writer_t writer; byte digest[6] = {0,0,0,0,0,0}; - int code; + int code, code1 = 0; int options=0; if (pbfont->written) @@ -640,14 +640,18 @@ pdf_write_embedded_font(gx_device_pdf *pdev, pdf_base_font_t *pbfont, font_type WRITE_TYPE1_EEXEC_PAD | WRITE_TYPE1_ASCIIHEX, NULL, 0, &fnstr, lengths); if (lengths[0] > 0) { - if (code < 0) - return code; + if (code < 0) { + code1 = code; + goto finish; + } code = cos_dict_put_c_key_int((cos_dict_t *)writer.pres->object, "/Length1", lengths[0]); } if (lengths[1] > 0) { - if (code < 0) - return code; + if (code < 0) { + code1 = code; + goto finish; + } code = cos_dict_put_c_key_int((cos_dict_t *)writer.pres->object, "/Length2", lengths[1]); if (code < 0) @@ -671,6 +675,7 @@ pdf_write_embedded_font(gx_device_pdf *pdev, pdf_base_font_t *pbfont, font_type TYPE2_OPTIONS | (pdev->CompatibilityLevel < 1.3 ? WRITE_TYPE2_AR3 : 0), NULL, 0, &fnstr, FontBBox); + code1 = code; } goto finish; @@ -739,6 +744,9 @@ pdf_write_embedded_font(gx_device_pdf *pdev, pdf_base_font_t *pbfont, font_type code = gs_note_error(gs_error_rangecheck); } + if (code >=0 && code1 < 0) { + code = code1; + } pbfont->written = true; return code; } |