diff options
| author | Ray Johnston <ray.johnston@artifex.com> | 2019-11-11 20:14:36 -0800 |
|---|---|---|
| committer | Ray Johnston <ray.johnston@artifex.com> | 2019-11-13 08:19:05 -0800 |
| commit | f63270230f329c6e89375af18d2bf2930421174a (patch) | |
| tree | 97275cb35c3aa08663f0aff3c74fa2ae41c4a7f3 | |
| parent | 97277fcf0f70d482481ac329ce473e5687e7a935 (diff) | |
| download | ghostpdl-f63270230f329c6e89375af18d2bf2930421174a.tar.gz | |
Fix devices that ignore return codes from gdev_prn get_bits & copy_scan_lines
Discovered these when working on bug 701845 'devicen' device. Checking
uncovered a plethora of other places that used one of these functions
assuming success.
Also the gdev_prn_copy_scan_lines had places that assumed the return code
was a valid line_count, so if negative, could memset many lines in front of
an allocated buffer.
The code in a few of these usages is strange, and we don't have a way to
check them, so this may not match the original intent.
Also, while perusing all of these files, check devices for alloc's that
assume success and fix them (usually return gs_error_VMerror).
50 files changed, 472 insertions, 209 deletions
diff --git a/base/gdevdevn.c b/base/gdevdevn.c index 00932ad49..737f022fa 100644 --- a/base/gdevdevn.c +++ b/base/gdevdevn.c @@ -1395,7 +1395,9 @@ spotcmyk_print_page(gx_device_printer * pdev, gp_file * prn_stream) /* Now create the output bit image files */ for (; lnum < bottom; ++lnum) { - gdev_prn_get_bits(pdev, lnum, in, &data); + code = gdev_prn_get_bits(pdev, lnum, in, &data); + if (code < 0) + goto prn_done; /* Now put the pcm data into the output file */ if (npcmcolors) { first_bit = bpc * (ncomp - npcmcolors); diff --git a/devices/gdev3852.c b/devices/gdev3852.c index d984fa102..843883579 100644 --- a/devices/gdev3852.c +++ b/devices/gdev3852.c @@ -65,6 +65,7 @@ jetp3852_print_page(gx_device_printer *pdev, gp_file *prn_stream) unsigned int count,tempcnt; unsigned char vtp,cntc1,cntc2; int line_size_color_plane; + int code = 0; byte data[DATA_SIZE]; byte plane_data[LINE_SIZE * 3]; @@ -90,8 +91,10 @@ jetp3852_print_page(gx_device_printer *pdev, gp_file *prn_stream) for ( lnum = 0; lnum < pdev->height; lnum++ ) { byte *end_data = data + line_size; - gdev_prn_copy_scan_lines(pdev, lnum, + code = gdev_prn_copy_scan_lines(pdev, lnum, (byte *)data, line_size); + if (code < 0) + break; /* Remove trailing 0s. */ while ( end_data > data && end_data[-1] == 0 ) end_data--; @@ -173,5 +176,5 @@ jetp3852_print_page(gx_device_printer *pdev, gp_file *prn_stream) /* eject page */ gp_fputs("\014", prn_stream); - return 0; + return code;; } diff --git a/devices/gdev4081.c b/devices/gdev4081.c index fe40b2c27..bd5c52d83 100644 --- a/devices/gdev4081.c +++ b/devices/gdev4081.c @@ -38,21 +38,19 @@ r4081_print_page(gx_device_printer *pdev, gp_file *prn_stream) int line_size = gdev_mem_bytes_per_scan_line((gx_device *)pdev); int out_size = ((pdev->width + 7) & -8) ; byte *out = (byte *)gs_malloc(pdev->memory, out_size, 1, "r4081_print_page(out)"); - int lnum = 0; + int lnum = 0, code = 0; int last = pdev->height; /* Check allocations */ if ( out == 0 ) - { if ( out ) - gs_free(pdev->memory, (char *)out, out_size, 1, - "r4081_print_page(out)"); - return -1; - } + return_error(gs_error_VMerror); /* find the first line which has something to print */ while ( lnum < last ) { - gdev_prn_copy_scan_lines(pdev, lnum, (byte *)out, line_size); + code = gdev_prn_copy_scan_lines(pdev, lnum, (byte *)out, line_size); + if (code < 0) + goto xit; if ( out[0] != 0 || memcmp((char *)out, (char *)out+1, line_size-1) ) @@ -62,7 +60,9 @@ r4081_print_page(gx_device_printer *pdev, gp_file *prn_stream) /* find the last line which has something to print */ while (last > lnum) { - gdev_prn_copy_scan_lines(pdev, last-1, (byte *)out, line_size); + code = gdev_prn_copy_scan_lines(pdev, last-1, (byte *)out, line_size); + if (code < 0) + goto xit; if ( out[0] != 0 || memcmp((char *)out, (char *)out+1, line_size-1) ) @@ -77,7 +77,9 @@ r4081_print_page(gx_device_printer *pdev, gp_file *prn_stream) /* Print lines of graphics */ while ( lnum < last ) { - gdev_prn_copy_scan_lines(pdev, lnum, (byte *)out, line_size); + code = gdev_prn_copy_scan_lines(pdev, lnum, (byte *)out, line_size); + if (code < 0) + goto xit; gp_fwrite(out, sizeof(char), line_size, prn_stream); lnum ++; } @@ -85,6 +87,7 @@ r4081_print_page(gx_device_printer *pdev, gp_file *prn_stream) /* Eject the page and reinitialize the printer */ gp_fputs("\f\033\rP", prn_stream); +xit: gs_free(pdev->memory, (char *)out, out_size, 1, "r4081_print_page(out)"); - return 0; + return code; } diff --git a/devices/gdev4693.c b/devices/gdev4693.c index 7e18054f4..baa975c5c 100644 --- a/devices/gdev4693.c +++ b/devices/gdev4693.c @@ -83,7 +83,7 @@ t4693d_print_page(gx_device_printer *dev, gp_file *ps_stream) char *p; ushort data_size = line_size/prn_dev->width; int checksum; - int lnum; + int lnum, code = 0; int i; #if !ARCH_IS_BIG_ENDIAN byte swap; @@ -121,12 +121,14 @@ t4693d_print_page(gx_device_printer *dev, gp_file *ps_stream) /* write header */ if (gp_fwrite(header,1,22,ps_stream) != 22) { errprintf(dev->memory, "Could not write header (t4693d).\n"); - gs_free(dev->memory, data, line_size, 1, "t4693d_print_page"); - return_error(gs_error_ioerror); + code = gs_note_error(gs_error_ioerror); + goto xit; } for (lnum = 0; lnum < prn_dev->height; lnum++) { - gdev_prn_copy_scan_lines(prn_dev,lnum,data,line_size); + code = gdev_prn_copy_scan_lines(prn_dev,lnum,data,line_size); + if (code < 0) + goto xit; for (i = 0; i < line_size; i += data_size) { @@ -147,32 +149,33 @@ t4693d_print_page(gx_device_printer *dev, gp_file *ps_stream) break; default: errprintf(dev->memory,"Bad depth (%d) t4693d.\n",depth); - gs_free(dev->memory, data, line_size, 1, "t4693d_print_page"); - return_error(gs_error_rangecheck); + code = gs_note_error(gs_error_rangecheck); + goto xit; } if (gp_fwrite(&data[i],1,data_size,ps_stream) != data_size) { errprintf(dev->memory,"Could not write pixel (t4693d).\n"); - gs_free(dev->memory, data, line_size, 1, "t4693d_print_page"); - return_error(gs_error_ioerror); + code = gs_note_error(gs_error_ioerror); + goto xit; } } if (gp_fputc(0x02,ps_stream) != 0x02) { errprintf(dev->memory,"Could not write EOL (t4693d).\n"); - gs_free(dev->memory, data, line_size, 1, "t4693d_print_page"); - return_error(gs_error_ioerror); + code = gs_note_error(gs_error_ioerror); + goto xit; } } if (gp_fputc(0x01,ps_stream) != 0x01) { errprintf(dev->memory,"Could not write EOT (t4693d).\n"); - gs_free(dev->memory, data, line_size, 1, "t4693d_print_page"); - return_error(gs_error_ioerror); + code = gs_note_error(gs_error_ioerror); + /* fall through to xit: */ } +xit: gs_free(dev->memory, data, line_size, 1, "t4693d_print_page"); - return(0); + return(code); } diff --git a/devices/gdev8510.c b/devices/gdev8510.c index 7d235b5f1..17938f76a 100644 --- a/devices/gdev8510.c +++ b/devices/gdev8510.c @@ -68,9 +68,13 @@ m8510_print_page(gx_device_printer *pdev, gp_file *prn_stream) while ( lnum < pdev->height ) { /* get a raster */ for (i = 7; i >= 0; i--) { - gdev_prn_copy_scan_lines(pdev, lnum, &in1[i*line_size], line_size); + code = gdev_prn_copy_scan_lines(pdev, lnum, &in1[i*line_size], line_size); + if (code < 0) + goto out; lnum++; - gdev_prn_copy_scan_lines(pdev, lnum, &in2[i*line_size], line_size); + code = gdev_prn_copy_scan_lines(pdev, lnum, &in2[i*line_size], line_size); + if (code < 0) + goto out; lnum++; } diff --git a/devices/gdevatx.c b/devices/gdevatx.c index fd6838682..08c8ba5d2 100644 --- a/devices/gdevatx.c +++ b/devices/gdevatx.c @@ -202,7 +202,9 @@ atx_print_page(gx_device_printer *pdev, gp_file *f, int max_width_bytes) byte *end; int count; - gdev_prn_get_bits(pdev, lnum, buf, &row); + code = gdev_prn_get_bits(pdev, lnum, buf, &row); + if (code < 0) + goto done; /* Clear any trailing padding bits */ row[endidx] &= mask; /* Find the end of the non-blank data. */ diff --git a/devices/gdevbit.c b/devices/gdevbit.c index 98ef8d4dd..d0c7711ef 100644 --- a/devices/gdevbit.c +++ b/devices/gdevbit.c @@ -792,19 +792,22 @@ bit_print_page(gx_device_printer * pdev, gp_file * prn_stream) int bottom = ((gx_device_bit *)pdev)->LastLine >= pdev->height ? pdev->height - 1 : ((gx_device_bit *)pdev)->LastLine; int line_count = any_abs(bottom - lnum); - int i, step = lnum > bottom ? -1 : 1; + int code = 0, i, step = lnum > bottom ? -1 : 1; if (in == 0) return_error(gs_error_VMerror); if ((lnum == 0) && (bottom == 0)) line_count = pdev->height - 1; /* default when LastLine == 0, FirstLine == 0 */ for (i = 0; i <= line_count; i++, lnum += step) { - gdev_prn_get_bits(pdev, lnum, in, &data); + code = gdev_prn_get_bits(pdev, lnum, in, &data); + if (code < 0) + goto done; if (!nul) gp_fwrite(data, 1, line_size, prn_stream); } +done: gs_free_object(pdev->memory, in, "bit_print_page(in)"); - return 0; + return code; } /* For tags device go ahead and add in the size so that we can strip and create @@ -835,10 +838,11 @@ bittags_print_page(gx_device_printer * pdev, gp_file * prn_stream) line_count = pdev->height - 1; /* default when LastLine == 0, FirstLine == 0 */ for (i = 0; i <= line_count; i++, lnum += step) { if ((code = gdev_prn_get_bits(pdev, lnum, in, &data)) < 0) - return code; + goto done; if (!nul) gp_fwrite(data, 1, line_size, prn_stream); } +done: gs_free_object(pdev->memory, in, "bit_print_page(in)"); return 0; } diff --git a/devices/gdevbj10.c b/devices/gdevbj10.c index 00f8569e9..3423ebc57 100644 --- a/devices/gdevbj10.c +++ b/devices/gdevbj10.c @@ -312,7 +312,8 @@ bj10e_print_page(gx_device_printer *pdev, gp_file *prn_stream) /* Copy 1 scan line and test for all zero. */ code = gdev_prn_get_bits(pdev, lnum, in, &in_data); - if ( code < 0 ) goto xit; + if ( code < 0 ) + goto fin; /* The mem... or str... functions should be faster than */ /* the following code, but all systems seem to implement */ /* them so badly that this code is faster. */ diff --git a/devices/gdevbmp.c b/devices/gdevbmp.c index 3c6630ee7..f8ce596e2 100644 --- a/devices/gdevbmp.c +++ b/devices/gdevbmp.c @@ -162,7 +162,9 @@ bmp_print_page(gx_device_printer * pdev, gp_file * file) /* BMP files want the image in bottom-to-top order! */ for (y = pdev->height - 1; y >= 0; y--) { - gdev_prn_copy_scan_lines(pdev, y, row, raster); + code = gdev_prn_copy_scan_lines(pdev, y, row, raster); + if (code < 0) + goto done; gp_fwrite((const char *)row, bmp_raster, 1, file); } diff --git a/devices/gdevccr.c b/devices/gdevccr.c index 9fb22f351..2080d785b 100644 --- a/devices/gdevccr.c +++ b/devices/gdevccr.c @@ -145,6 +145,7 @@ ccr_print_page(gx_device_printer *pdev, gp_file *pstream) int cmy, c, m, y; byte *in; byte *data; + int code = 0; if((in = (byte *)gs_malloc(pdev->memory, line_size, 1, "gsline")) == NULL) return_error(gs_error_VMerror); @@ -156,7 +157,9 @@ ccr_print_page(gx_device_printer *pdev, gp_file *pstream) } for ( l = 0; l < lnum; l++ ) - { gdev_prn_get_bits(pdev, l, in, &data); + { code = gdev_prn_get_bits(pdev, l, in, &data); + if (code < 0) + goto xit; if(alloc_line(pdev->memory, &linebuf[l], pixnum)) { gs_free(pdev->memory, in, line_size, 1, "gsline"); @@ -191,9 +194,10 @@ write_cpass(linebuf, lnum, CPASS, pstream); CCFILEEND(pstream); /* clean up */ +xit: gs_free(pdev->memory, in, line_size, 1, "gsline"); free_rb_line( pdev->memory, linebuf, lnum, pixnum ); -return 0; +return code; } /* ------ Internal routines ------ */ diff --git a/devices/gdevcdj.c b/devices/gdevcdj.c index bfe60b5e1..50a1d62c0 100644 --- a/devices/gdevcdj.c +++ b/devices/gdevcdj.c @@ -2022,6 +2022,7 @@ hp_colour_print_page(gx_device_printer * pdev, gp_file * prn_stream, int ptype) int compression = 0; int scan = 0; int *errors[2]; + int code = 0; const char *cid_string = (const char*) 0; byte *data[4], *plane_data[4][4], *out_data; byte *out_row, *out_row_alt; @@ -2414,7 +2415,9 @@ hp_colour_print_page(gx_device_printer * pdev, gp_file * prn_stream, int ptype) word *data_words = (word *)data[scan]; register word *end_data = data_words + line_size_words; - gdev_prn_copy_scan_lines(pdev, lnum, data[scan], line_size); + code = gdev_prn_copy_scan_lines(pdev, lnum, data[scan], line_size); + if (code < 0) + goto xit; /* Mask off 1-bits beyond the line width. */ end_data[-1] &= rmask; @@ -2744,11 +2747,12 @@ hp_colour_print_page(gx_device_printer * pdev, gp_file * prn_stream, int ptype) } else gp_fputs("\033&l0H", prn_stream); +xit: /* free temporary storage */ gs_free(pdev->memory, (char *) eg.storage, eg.storage_size_words, W, "ep_print_buffer"); gs_free(pdev->memory, (char *) storage, storage_size_words, W, "hp_colour_print_page"); - return 0; + return code; } /* diff --git a/devices/gdevcfax.c b/devices/gdevcfax.c index d6fbebc47..6f6419ae7 100644 --- a/devices/gdevcfax.c +++ b/devices/gdevcfax.c @@ -149,7 +149,9 @@ cfax_stream_print_page_width(gx_device_printer * pdev, gp_file * prn_stream, if (code < 0) return_error(gs_error_limitcheck); /* Now, get the bits and encode them */ - gdev_prn_copy_scan_lines(pdev, lnum, in, in_size); + code = gdev_prn_copy_scan_lines(pdev, lnum, in, in_size); + if (code < 0) + goto done; if (col_size > in_size) { memset(in + in_size , 0, col_size - in_size); } diff --git a/devices/gdevcif.c b/devices/gdevcif.c index 217e43d83..7de92e821 100644 --- a/devices/gdevcif.c +++ b/devices/gdevcif.c @@ -50,6 +50,7 @@ cif_print_page(gx_device_printer *pdev, gp_file *prn_stream) int scanline, scanbyte; int length, start; /* length is the number of successive 1 bits, */ /* start is the set of 1 bit start position */ + int code = 0; if (in == 0) return_error(gs_error_VMerror); @@ -57,7 +58,7 @@ cif_print_page(gx_device_printer *pdev, gp_file *prn_stream) #ifdef CLUSTER fname = "clusterout"; #else - fname = pdev->fname; + fname = (char *)(pdev->fname); #endif if ((s = strchr(fname, '.')) == NULL) length = strlen(fname) + 1; @@ -72,7 +73,9 @@ cif_print_page(gx_device_printer *pdev, gp_file *prn_stream) gs_free(pdev->memory, s, length+1, 1, "cif_print_page(s)"); for (lnum = 0; lnum < pdev->height; lnum++) { - gdev_prn_copy_scan_lines(pdev, lnum, in, line_size); + code = gdev_prn_copy_scan_lines(pdev, lnum, in, line_size); + if (code < 0) + goto xit; length = 0; for (scanline = 0; scanline < line_size; scanline++) #ifdef TILE /* original, simple, inefficient algorithm */ @@ -98,6 +101,7 @@ cif_print_page(gx_device_printer *pdev, gp_file *prn_stream) #endif } gp_fprintf(prn_stream, "DF;\nC1;\nE\n"); +xit: gs_free(pdev->memory, in, line_size, 1, "cif_print_page(in)"); - return 0; + return code; } diff --git a/devices/gdevclj.c b/devices/gdevclj.c index 0081ed416..542bb8edb 100644 --- a/devices/gdevclj.c +++ b/devices/gdevclj.c @@ -428,6 +428,7 @@ clj_print_page( double fs_res = pdev->HWResolution[0] / 72.0; double ss_res = pdev->HWResolution[1] / 72.0; int imageable_width, imageable_height; + int code = 0; /* no paper size at this point is a serious error */ if (psize == 0) @@ -479,7 +480,9 @@ clj_print_page( for (i = 0; i < imageable_height; i++) { int clen[3]; - gdev_prn_copy_scan_lines(pdev, i, data, lsize); + code = gdev_prn_copy_scan_lines(pdev, i, data, lsize); + if (code < 0) + goto xit; /* The 'lsize' bytes of data have the blank margin area at the end due */ /* to the 'initial_matrix' offsets that are applied. */ @@ -503,11 +506,12 @@ clj_print_page( /* PCL will take care of blank lines at the end */ gp_fputs("\033*rC\f", prn_stream); +xit: /* free the buffers used */ gs_free_object(mem, cdata[0], "clj_print_page(cdata)"); gs_free_object(mem, data, "clj_print_page(data)"); - return 0; + return code; } /* CLJ device methods */ diff --git a/devices/gdevcljc.c b/devices/gdevcljc.c index 703f2639f..659332602 100644 --- a/devices/gdevcljc.c +++ b/devices/gdevcljc.c @@ -68,7 +68,7 @@ cljc_print_page(gx_device_printer * pdev, gp_file * prn_stream) code = gdev_prn_copy_scan_lines(pdev, i, (byte *) data, raster); if (code < 0) - break; + goto out; compressed_size = gdev_pcl_mode3compress(raster, data, prow, cdata); gp_fprintf(prn_stream, "\033*b%dW", compressed_size); gp_fwrite(cdata, sizeof(byte), compressed_size, prn_stream); diff --git a/devices/gdevdjtc.c b/devices/gdevdjtc.c index fa4681af2..5fb1a4bab 100644 --- a/devices/gdevdjtc.c +++ b/devices/gdevdjtc.c @@ -75,6 +75,7 @@ djet500c_print_page(gx_device_printer *pdev, gp_file *fprn) byte *plane3=NULL; int bitSize=0; int planeSize=0; + int code = 0; /* select the most compressed mode available & clear tmp storage */ /* put printer in known state */ @@ -122,7 +123,9 @@ djet500c_print_page(gx_device_printer *pdev, gp_file *fprn) { byte *endData; - gdev_prn_copy_scan_lines(pdev, lnum, bitData, lineSize); + code = gdev_prn_copy_scan_lines(pdev, lnum, bitData, lineSize); + if (code < 0) + goto xit; /* Identify and skip blank lines */ endData = bitData + lineSize; @@ -149,6 +152,10 @@ djet500c_print_page(gx_device_printer *pdev, gp_file *fprn) plane1=(byte*)malloc(planeSize+8); plane2=(byte*)malloc(planeSize+8); plane3=(byte*)malloc(planeSize+8); + if (plane1 == NULL || plane2 == NULL || plane3 == NULL) { + code = gs_error_VMerror; + goto xit; + } } /* Transpose the data to get pixel planes. */ for (k=i=0; k<lineLen; i+=8, k++) @@ -207,13 +214,14 @@ djet500c_print_page(gx_device_printer *pdev, gp_file *fprn) /* eject page */ gp_fputs("\033&l0H", fprn); +xit: /* release allocated memory */ if (bitData) free(bitData); if (plane1) free(plane1); if (plane2) free(plane2); if (plane3) free(plane3); - return 0; + return code; } /* diff --git a/devices/gdevdm24.c b/devices/gdevdm24.c index ae7484c8e..62b7ba895 100644 --- a/devices/gdevdm24.c +++ b/devices/gdevdm24.c @@ -64,7 +64,7 @@ dot24_print_page (gx_device_printer *pdev, gp_file *prn_stream, char *init_strin int y_passes; int dots_per_space; int bytes_per_space; - int skip = 0, lnum = 0, ypass; + int skip = 0, lnum = 0, code = 0, ypass; xres = (int)pdev->x_pixels_per_inch; yres = (int)pdev->y_pixels_per_inch; @@ -76,7 +76,7 @@ dot24_print_page (gx_device_printer *pdev, gp_file *prn_stream, char *init_strin /* We divide by bytes_per_space later on. */ return_error(gs_error_rangecheck); } - + bits_per_column = (y_high ? 48 : 24); line_size = gdev_prn_raster (pdev); in_size = line_size * bits_per_column; @@ -111,7 +111,9 @@ dot24_print_page (gx_device_printer *pdev, gp_file *prn_stream, char *init_strin int lcnt; /* Copy 1 scan line and test for all zero. */ - gdev_prn_copy_scan_lines (pdev, lnum, in, line_size); + code = gdev_prn_copy_scan_lines (pdev, lnum, in, line_size); + if (code < 0) + goto xit; if (in[0] == 0 && !memcmp ((char *) in, (char *) in + 1, line_size - 1)) { @@ -138,27 +140,40 @@ dot24_print_page (gx_device_printer *pdev, gp_file *prn_stream, char *init_strin /* Copy the rest of the scan lines. */ if (y_high) { + /* NOTE: even though fixed to not ignore return < 0 from gdev_prn_copy_scan_lines, */ + /* this code seems wrong -- it doesn't seem to match the 'else' method. */ inp = in + line_size; - for (lcnt = 1; lcnt < 24; lcnt++, inp += line_size) - if (!gdev_prn_copy_scan_lines (pdev, lnum + lcnt * 2, inp, - line_size)) + for (lcnt = 1; lcnt < 24; lcnt++, inp += line_size) { + code = gdev_prn_copy_scan_lines (pdev, lnum + lcnt * 2, inp, line_size); + if (code < 0) + goto xit; + if (code == 0) { + /* Pad with lines of zeros. */ memset (inp, 0, (24 - lcnt) * line_size); break; } + } inp = in + line_size * 24; - for (lcnt = 0; lcnt < 24; lcnt++, inp += line_size) - if (!gdev_prn_copy_scan_lines (pdev, lnum + lcnt * 2 + 1, inp, - line_size)) + for (lcnt = 0; lcnt < 24; lcnt++, inp += line_size) { + code = gdev_prn_copy_scan_lines (pdev, lnum + lcnt * 2 + 1, inp, line_size); + if (code < 0) + goto xit; + if (code == 0) { + /* Pad with lines of zeros. */ memset (inp, 0, (24 - lcnt) * line_size); break; } + } } else { - lcnt = 1 + gdev_prn_copy_scan_lines (pdev, lnum + 1, in + line_size, + code = gdev_prn_copy_scan_lines (pdev, lnum + 1, in + line_size, in_size - line_size); + if (code < 0) + goto xit; + lcnt = code + 1; /* FIXME: why +1 */ if (lcnt < 24) /* Pad with lines of zeros. */ memset (in + lcnt * line_size, 0, in_size - lcnt * line_size); @@ -242,10 +257,11 @@ dot24_print_page (gx_device_printer *pdev, gp_file *prn_stream, char *init_strin gp_fputs ("\f\033@", prn_stream); gp_fflush (prn_stream); +xit: gs_free (pdev->memory, (char *) out, out_size, 1, "dot24_print_page (out)"); gs_free (pdev->memory, (char *) in, in_size, 1, "dot24_print_page (in)"); - return 0; + return code; } /* Output a single graphics command. */ diff --git a/devices/gdevepsc.c b/devices/gdevepsc.c index 49e83f0be..f6fa2b307 100644 --- a/devices/gdevepsc.c +++ b/devices/gdevepsc.c @@ -184,7 +184,7 @@ epsc_print_page(gx_device_printer * pdev, gp_file * prn_stream) int last_pass; int dots_per_space; int bytes_per_space; - int skip = 0, lnum = 0, pass; + int skip = 0, lnum = 0, code = 0, pass; byte *color_in; int color_line_size, color_in_size; @@ -232,7 +232,7 @@ epsc_print_page(gx_device_printer * pdev, gp_file * prn_stream) if (out) gs_free(pdev->memory, (char *)out, out_size + 1, 1, "epsc_print_page(out)"); - return -1; + return_error(gs_error_VMerror); } /* Initialize the printer and reset the margins. */ @@ -248,7 +248,7 @@ epsc_print_page(gx_device_printer * pdev, gp_file * prn_stream) "epsc_print_page(in)"); gs_free(pdev->memory, (char *)out, out_size + 1, 1, "epsc_print_page(out)"); - return (-1); + return_error(gs_error_VMerror); } } else { color_in = in; @@ -263,7 +263,9 @@ epsc_print_page(gx_device_printer * pdev, gp_file * prn_stream) byte *nextmono = NULL; /* position to map next color */ /* Copy 1 scan line and test for all zero. */ - gdev_prn_copy_scan_lines(pdev, lnum, color_in, color_line_size); + code = gdev_prn_copy_scan_lines(pdev, lnum, color_in, color_line_size); + if (code < 0) + goto xit; if (color_in[0] == 0 && !memcmp((char *)color_in, (char *)color_in + 1, @@ -283,9 +285,12 @@ epsc_print_page(gx_device_printer * pdev, gp_file * prn_stream) gp_fprintf(prn_stream, "\033J%c", skip); /* Copy the rest of the scan lines. */ - lcnt = 1 + gdev_prn_copy_scan_lines(pdev, lnum + 1, + code = gdev_prn_copy_scan_lines(pdev, lnum + 1, color_in + color_line_size, color_in_size - color_line_size); + if (code < 0) + goto xit; + lcnt = code + 1; if (lcnt < 8 * y_mult) { memset((char *)(color_in + lcnt * color_line_size), 0, @@ -453,13 +458,14 @@ epsc_print_page(gx_device_printer * pdev, gp_file * prn_stream) /* Eject the page and reinitialize the printer */ gp_fputs("\f\033@", prn_stream); +xit: gs_free(pdev->memory, (char *)out, out_size + 1, 1, "epsc_print_page(out)"); gs_free(pdev->memory, (char *)in, in_size + 1, 1, "epsc_print_page(in)"); if (gx_device_has_color(pdev)) gs_free(pdev->memory, (char *)color_in, color_in_size + 1, 1, "epsc_print_page(rin)"); - return 0; + return code; } /* Output a single graphics command. */ diff --git a/devices/gdevepsn.c b/devices/gdevepsn.c index 34f0e3ae0..5c1e9ac86 100644 --- a/devices/gdevepsn.c +++ b/devices/gdevepsn.c @@ -159,8 +159,8 @@ eps_print_page(gx_device_printer *pdev, gp_file *prn_stream, int y_9pin_high, int line_size = gdev_mem_bytes_per_scan_line((gx_device *)pdev); /* Note that in_size is a multiple of 8. */ int in_size = line_size * (8 * in_y_mult); - byte *buf1; - byte *buf2; + byte *buf1 = NULL; + byte *buf2 = NULL; byte *in; byte *out; int out_y_mult = (y_24pin ? 3 : 1); @@ -170,6 +170,7 @@ eps_print_page(gx_device_printer *pdev, gp_file *prn_stream, int y_9pin_high, int bytes_per_space = dots_per_space * out_y_mult; int tab_min_pixels = x_dpi * MIN_TAB_10THS / 10; int skip = 0, lnum = 0, pass, ypass; + int code = 0; char start_graphics; int first_pass; @@ -202,12 +203,9 @@ eps_print_page(gx_device_printer *pdev, gp_file *prn_stream, int y_9pin_high, /* Check allocations */ - if ( buf1 == 0 || buf2 == 0 ) - { if ( buf1 ) - gs_free(pdev->memory, (char *)buf1, in_size, 1, "eps_print_page(buf1)"); - if ( buf2 ) - gs_free(pdev->memory, (char *)buf2, in_size, 1, "eps_print_page(buf2)"); - return_error(gs_error_VMerror); + if ( buf1 == 0 || buf2 == 0 ) { + code = gs_error_VMerror; + goto xit; } /* Initialize the printer and reset the margins. */ @@ -233,7 +231,9 @@ eps_print_page(gx_device_printer *pdev, gp_file *prn_stream, int y_9pin_high, int lcnt; /* Copy 1 scan line and test for all zero. */ - gdev_prn_get_bits(pdev, lnum, in, &in_data); + code = gdev_prn_get_bits(pdev, lnum, in, &in_data); + if (code < 0) + goto xit; if ( in_data[0] == 0 && !memcmp((char *)in_data, (char *)in_data + 1, line_size - 1) ) @@ -255,7 +255,9 @@ eps_print_page(gx_device_printer *pdev, gp_file *prn_stream, int y_9pin_high, } /* Copy the the scan lines. */ - lcnt = gdev_prn_copy_scan_lines(pdev, lnum, in, in_size); + code = lcnt = gdev_prn_copy_scan_lines(pdev, lnum, in, in_size); + if (code < 0) + goto xit; if ( lcnt < 8 * in_y_mult ) { /* Pad with lines of zeros. */ memset(in + lcnt * line_size, 0, @@ -417,9 +419,14 @@ eps_print_page(gx_device_printer *pdev, gp_file *prn_stream, int y_9pin_high, gp_fputs(end_string, prn_stream); gp_fflush(prn_stream); - gs_free(pdev->memory, (char *)buf2, in_size, 1, "eps_print_page(buf2)"); - gs_free(pdev->memory, (char *)buf1, in_size, 1, "eps_print_page(buf1)"); - return 0; +xit: + if ( buf1 ) + gs_free(pdev->memory, (char *)buf1, in_size, 1, "eps_print_page(buf1)"); + if ( buf2 ) + gs_free(pdev->memory, (char *)buf2, in_size, 1, "eps_print_page(buf2)"); + if (code < 0) + return_error(code); + return code; } /* Output a single graphics command. */ diff --git a/devices/gdevescp.c b/devices/gdevescp.c index 000431920..005fa58a8 100644 --- a/devices/gdevescp.c +++ b/devices/gdevescp.c @@ -119,7 +119,7 @@ escp2_print_page(gx_device_printer *pdev, gp_file *prn_stream) byte *out = buf2; int skip, lnum, top, bottom, left, width; - int count, i; + int code = 0, count, i; /* ** Check for valid resolution: @@ -141,12 +141,9 @@ escp2_print_page(gx_device_printer *pdev, gp_file *prn_stream) ** Check buffer allocations: */ - if ( buf1 == 0 || buf2 == 0 ) - { if ( buf1 ) - gs_free(pdev->memory, (char *)buf1, in_size, 1, "escp2_print_page(buf1)"); - if ( buf2 ) - gs_free(pdev->memory, (char *)buf2, in_size, 1, "escp2_print_page(buf2)"); - return_error(gs_error_VMerror); + if ( buf1 == 0 || buf2 == 0 ) { + code = gs_error_VMerror; + goto xit; } /* @@ -218,14 +215,18 @@ escp2_print_page(gx_device_printer *pdev, gp_file *prn_stream) ** Check buffer for 0 data. We can't do this mid-band */ - gdev_prn_get_bits(pdev, lnum, in, &in_data); + code = gdev_prn_get_bits(pdev, lnum, in, &in_data); + if (code < 0) + goto xit; while ( in_data[0] == 0 && !memcmp((char *)in_data, (char *)in_data + 1, line_size - 1) && lnum < bottom ) { lnum++; skip++; - gdev_prn_get_bits(pdev, lnum, in, &in_data); + code = gdev_prn_get_bits(pdev, lnum, in, &in_data); + if (code < 0) + goto xit; } if(lnum == bottom ) break; /* finished with this page */ @@ -241,7 +242,9 @@ escp2_print_page(gx_device_printer *pdev, gp_file *prn_stream) skip = 0; } - lcnt = gdev_prn_copy_scan_lines(pdev, lnum, in, in_size); + code = lcnt = gdev_prn_copy_scan_lines(pdev, lnum, in, in_size); + if (lcnt < 0) + goto xit; /* ** Check to see if we don't have enough data to fill an entire @@ -403,7 +406,13 @@ escp2_print_page(gx_device_printer *pdev, gp_file *prn_stream) gp_fputs("\f\033@", prn_stream); gp_fflush(prn_stream); - gs_free(pdev->memory, (char *)buf2, in_size, 1, "escp2_print_page(buf2)"); - gs_free(pdev->memory, (char *)buf1, in_size, 1, "escp2_print_page(buf1)"); - return 0; +xit: + if ( buf1 ) + gs_free(pdev->memory, (char *)buf1, in_size, 1, "escp2_print_page(buf1)"); + if ( buf2 ) + gs_free(pdev->memory, (char *)buf2, in_size, 1, "escp2_print_page(buf2)"); + if (code < 0) + return_error(code); + + return code; } diff --git a/devices/gdevgprf.c b/devices/gdevgprf.c index ff383e576..492b1c24f 100644 --- a/devices/gdevgprf.c +++ b/devices/gdevgprf.c @@ -372,6 +372,8 @@ gprf_prn_open(gx_device * pdev) pdev_gprf->icclink = gsicc_alloc_link_dev(pdev_gprf->memory, profile_struct->device_profile[0], profile_struct->postren_profile, &rendering_params); + if (pdev_gprf->icclink == NULL) + code = gs_error_VMerror; } return code; } diff --git a/devices/gdevhl7x.c b/devices/gdevhl7x.c index d2ed8f26e..1a3e59495 100644 --- a/devices/gdevhl7x.c +++ b/devices/gdevhl7x.c @@ -366,9 +366,11 @@ hl7x0_print_page(gx_device_printer *pdev, gp_file *printStream, int ptype, storage + sizeOfBuffer, /* The line buffer is after the dump buffer */ &commandsBuffer, &pageSummary); + if (result < 0) + goto xit; dumpToPrinter(&commandsBuffer,printStream); - } while (result == DumpContinue); + } while (result == DumpContinue); /* NB: at end of page, result will be DumpFinished == 0 */ /* end raster graphics and eject page */ initByteList(&formFeedCommand, @@ -377,11 +379,12 @@ hl7x0_print_page(gx_device_printer *pdev, gp_file *printStream, int ptype, sizeof(FormFeed)); /* First free byte */ dumpToPrinter(&formFeedCommand, printStream); +xit: /* free temporary storage */ freeSummary(pdev, &pageSummary); gs_free(pdev->memory, (char *)storage, storage_size_words, 1, "hl7X0_print_page"); - return 0; /* If we reach this line, it means there was no error */ + return result; /* If we reach this line, it means there was no error */ } /* @@ -463,6 +466,8 @@ static int dumpPage(gx_device_printer * pSource, short lineNB; short usefulLength; short tmpLength; + int code = 0; + /* Initializations */ /* Make room for size of commands buffer */ pSaveCommandStart = currentPosition(pCommandList); @@ -472,10 +477,12 @@ static int dumpPage(gx_device_printer * pSource, for (lineNB = pSummary->nbLinesSent /*ERROR? + nbBlankLines */ ; lineNB < pSummary->pageHeight ; lineNB ++ ) { /* Fetch the line and put it into the buffer */ - gdev_prn_copy_scan_lines(pSource, + code = gdev_prn_copy_scan_lines(pSource, lineNB, pLineTmp, pSummary->pageWidth); + if (code < 0) + return code; usefulLength = stripTrailingBlanks(pLineTmp,pSummary->pageWidth); if (usefulLength != 0) { diff --git a/devices/gdevicov.c b/devices/gdevicov.c index 4f4d7f5cd..ad9a903ca 100644 --- a/devices/gdevicov.c +++ b/devices/gdevicov.c @@ -37,18 +37,20 @@ static int cov_write_page(gx_device_printer *pdev, gp_file *file) { - int code = 0; + int code = 0, ecode = 0; int raster = gdev_prn_raster(pdev); int height = pdev->height; byte *line = gs_alloc_bytes(pdev->memory, raster, "ink coverage plugin buffer"); int y; uint64_t c_pix = 0, m_pix = 0, y_pix = 0, k_pix = 0, total_pix = 0; + if (line == NULL) + return gs_error_VMerror; for (y = 0; y < height; y++) { byte *row, *end; - code = gdev_prn_get_bits(pdev, y, line, &row); - if (code < 0) + ecode = gdev_prn_get_bits(pdev, y, line, &row); + if (ecode < 0) break; end = row + raster; @@ -90,14 +92,14 @@ cov_write_page(gx_device_printer *pdev, gp_file *file) } } - return 0; + return (code < 0) ? ecode : 0; } /* cov_write_page2 gave ink coverage values not ratecoverage */ static int cov_write_page_ink(gx_device_printer *pdev, gp_file *file) { - int code = 0; + int code = 0, ecode = 0; int raster = gdev_prn_raster(pdev); int height = pdev->height; double dc_pix=0; @@ -109,11 +111,13 @@ static int cov_write_page_ink(gx_device_printer *pdev, gp_file *file) int y; uint64_t total_pix = 0; + if (line == NULL) + return gs_error_VMerror; for (y = 0; y < height; y++) { byte *row, *end; - code = gdev_prn_get_bits(pdev, y, line, &row); - if (code < 0) + ecode = gdev_prn_get_bits(pdev, y, line, &row); + if (ecode < 0) break; end = row + raster; @@ -159,7 +163,7 @@ static int cov_write_page_ink(gx_device_printer *pdev, gp_file *file) } } - return 0; + return (code < 0) ? ecode : 0; } static const gx_device_procs cov_procs = diff --git a/devices/gdevifno.c b/devices/gdevifno.c index 31aa51460..22d5837fd 100644 --- a/devices/gdevifno.c +++ b/devices/gdevifno.c @@ -281,6 +281,7 @@ inferno_print_page(gx_device_printer *pdev, gp_file *f) int gsbpl; ulong u; ushort us; + int code = 0; inferno_device *bdev = (inferno_device *) pdev; Rectangle r; @@ -319,7 +320,10 @@ inferno_print_page(gx_device_printer *pdev, gp_file *f) * to save all the ldepth lookups. */ for(y=0; y<pdev->height; y++) { - gdev_prn_get_bits(pdev, y, buf, &p); + + code = gdev_prn_get_bits(pdev, y, buf, &p); + if (code < 0) + goto xit; for(x=0; x<pdev->width; x++) { us = (p[2*x]<<8) | p[2*x+1]; @@ -372,12 +376,13 @@ inferno_print_page(gx_device_printer *pdev, gp_file *f) return_error(gs_error_Fatal); } } - gs_free_object(bdev->memory, buf, "inferno line buffer"); if(writeimageblock(w, nil, 0, bdev->memory) == ERROR) { return_error(gs_error_Fatal); } +xit: + gs_free_object(bdev->memory, buf, "inferno line buffer"); - return 0; + return code; } /* diff --git a/devices/gdevimgn.c b/devices/gdevimgn.c index 7340c8d4c..7c707bda6 100644 --- a/devices/gdevimgn.c +++ b/devices/gdevimgn.c @@ -379,6 +379,7 @@ imagen_print_page(gx_device_printer *pdev, gp_file *prn_stream) /* page totals */ int totalBlankSwatches; int totalGreySwatches; + int code = 0; /* ----------------------------------------- */ /* Start of routine */ @@ -406,8 +407,8 @@ imagen_print_page(gx_device_printer *pdev, gp_file *prn_stream) swatchMap = (byte *)gs_malloc(pdev->memory, BIGSIZE,swatchCount / BIGSIZE + 1, "imagen_print_page(swatchMap)" ); - if ( in == 0 || out == 0 ) - return -1; + if ( in == 0 || out == 0 || swatchMap == 0) + goto xit; /* Initialize the page */ iWrite(prn_stream,iPAGE); @@ -450,7 +451,9 @@ imagen_print_page(gx_device_printer *pdev, gp_file *prn_stream) } /* for temp */ /* get one line */ - gdev_prn_copy_scan_lines(pdev, lnum + swatchLine, in, line_size); + code = gdev_prn_copy_scan_lines(pdev, lnum + swatchLine, in, line_size); + if (code < 0) + goto xit; DebugMsg(5,"Got scan line %d ", lnum + swatchLine); DebugMsg(5,"line %d \n", swatchLine); @@ -553,6 +556,7 @@ imagen_print_page(gx_device_printer *pdev, gp_file *prn_stream) gp_fflush(prn_stream); +xit: gs_free(pdev->memory, (char *)out, TotalBytesPerSw, swatchCount+1, "imagen_print_page(out)"); gs_free(pdev->memory, (char *)swatchMap, BIGSIZE, swatchCount / BIGSIZE + 1, "imagen_print_page(swatchMap)" ); @@ -564,6 +568,6 @@ imagen_print_page(gx_device_printer *pdev, gp_file *prn_stream) DebugMsg(1,"%s\n","End of imagen_print_page"); /* ----------------------------------------- */ - return 0; + return code; } /* imagen_print_page */ diff --git a/devices/gdevjbig2.c b/devices/gdevjbig2.c index ce85aa2ca..055508192 100644 --- a/devices/gdevjbig2.c +++ b/devices/gdevjbig2.c @@ -89,7 +89,7 @@ jbig2_print_page(gx_device_printer * pdev, gp_file * prn_stream) swrite_file(&fstrm, prn_stream, fbuf, fbuf_size); s_init(&cstrm, mem); s_std_init(&cstrm, jbuf, jbuf_size, &s_filter_write_procs, - s_mode_write); + s_devices/gdevescp.cmode_write); cstrm.state = (stream_state *) & state; cstrm.procs.process = state.templat->process; cstrm.strm = &fstrm; @@ -108,7 +108,9 @@ jbig2_print_page(gx_device_printer * pdev, gp_file * prn_stream) code = gs_note_error(gs_error_ioerror); goto done; } - gdev_prn_get_bits(pdev, lnum, in, &data); + code = gdev_prn_get_bits(pdev, lnum, in, &data); + if (code < 0) + goto done; sputs(&cstrm, data, state.stride, &ignore_used); } diff --git a/devices/gdevjpx.c b/devices/gdevjpx.c index 0ba4e1a89..e38f5402a 100644 --- a/devices/gdevjpx.c +++ b/devices/gdevjpx.c @@ -209,7 +209,9 @@ jpx_print_page(gx_device_printer * pdev, gp_file * prn_stream) code = gs_note_error(gs_error_ioerror); goto done; } - gdev_prn_get_bits(pdev, lnum, in, &data); + code = gdev_prn_get_bits(pdev, lnum, in, &data); + if (code < 0) + goto done; sputs(&cstrm, data, state.stride, &ignore_used); } diff --git a/devices/gdevl31s.c b/devices/gdevl31s.c index 0871920ac..b21b18c8f 100644 --- a/devices/gdevl31s.c +++ b/devices/gdevl31s.c @@ -180,6 +180,8 @@ lj3100sw_print_page_copies(gx_device_printer *pdev, gp_file *prn_stream, int num gs_memory_t *mem = pdev->memory; byte *in = (byte *)gs_malloc(mem, line_size, 1, "lj3100sw_print_page"); byte *data; + int ecode = 0; + if (in == 0) return_error(gs_error_VMerror); if (gdev_prn_file_is_new(pdev)) { @@ -211,7 +213,10 @@ lj3100sw_print_page_copies(gx_device_printer *pdev, gp_file *prn_stream, int num int count = 0; int bit_index = 0; uint tmp = 0; - gdev_prn_get_bits(pdev, i, in, &data); + + ecode = gdev_prn_get_bits(pdev, i, in, &data); + if (ecode < 0) + goto xit; for (j = 0; j <= printer_width; j++) { int xoffset = (printer_width - paper_width) / 2; int newcolor = 0; @@ -261,8 +266,9 @@ lj3100sw_print_page_copies(gx_device_printer *pdev, gp_file *prn_stream, int num for (i = 0; i < 4 * ppdev->NumCopies; i++) lj3100sw_output_section_header(prn_stream, 54, 0, 0); +xit: gs_free(mem, (char *)in, line_size, 1, "lj3100sw_print_page"); - return 0; + return ecode; } static int diff --git a/devices/gdevlbp8.c b/devices/gdevlbp8.c index 5b99cf2b8..3136772a8 100644 --- a/devices/gdevlbp8.c +++ b/devices/gdevlbp8.c @@ -108,6 +108,7 @@ can_print_page(gx_device_printer *pdev, gp_file *prn_stream, char *out_data; int last_line_nro = 0; int line_size = gdev_mem_bytes_per_scan_line((gx_device *)pdev); + int code = 0; data = (char *)gs_alloc_bytes(pdev->memory, line_size*2, @@ -124,8 +125,10 @@ can_print_page(gx_device_printer *pdev, gp_file *prn_stream, for ( lnum = 0; lnum < pdev->height; lnum++ ) { char *end_data = data + line_size; - gdev_prn_copy_scan_lines(pdev, lnum, - (byte *)data, line_size); + code = gdev_prn_copy_scan_lines(pdev, lnum, + (byte *)data, line_size); + if (code < 0) + goto xit; /* Mask off 1-bits beyond the line width. */ end_data[-1] &= rmask; /* Remove trailing 0s. */ @@ -199,9 +202,10 @@ can_print_page(gx_device_printer *pdev, gp_file *prn_stream, if (end != NULL) (void)gp_fwrite(end, end_size, 1, prn_stream); +xit: gs_free_object(pdev->memory, data, "lbp8_line_buffer"); - return 0; + return code; } /* Print an LBP-8 page. */ diff --git a/devices/gdevlj56.c b/devices/gdevlj56.c index 4a473e0dd..6199e5be8 100644 --- a/devices/gdevlj56.c +++ b/devices/gdevlj56.c @@ -192,7 +192,7 @@ ljet5_print_page(gx_device_printer * pdev, gp_file * prn_stream) code = gdev_prn_copy_scan_lines(pdev, lnum, (byte *) line, line_size); if (code < 0) - goto fin; + goto done; px_put_us(s, lnum); PX_PUT_LIT(s, line_header); ncompr = gdev_pcl_mode2compress_padded(line, line + line_size_words, @@ -202,7 +202,6 @@ ljet5_print_page(gx_device_printer * pdev, gp_file * prn_stream) } /* Finish up. */ - fin: spputc(s, pxtEndImage); spputc(s, pxtEndPage); sflush(s); diff --git a/devices/gdevlp8k.c b/devices/gdevlp8k.c index 55af94df0..58ae0702a 100644 --- a/devices/gdevlp8k.c +++ b/devices/gdevlp8k.c @@ -193,18 +193,13 @@ lp8000_print_page(gx_device_printer *pdev, gp_file *prn_stream) byte *out = buf2; int lnum, top, bottom, left, width; - int count, left1, left2, left0; + int code = 0, count, left1, left2, left0; /* Check memory allocations */ - if ( buf1 == 0 || buf2 == 0 ) - { if ( buf1 ) - gs_free(pdev->memory, (char *)buf1, in_size, 1, "lp8000_print_page(buf1)"); - - if ( buf2 ) - gs_free(pdev->memory, (char *)buf2, in_size, 1, "lp8000_print_page(buf2)"); - - return_error(gs_error_VMerror); + if ( buf1 == 0 || buf2 == 0 ) { + code = gs_error_VMerror; + goto xit; } /* Initialize the printer */ @@ -265,19 +260,25 @@ starting X value of the printer line. ** Check buffer for 0 data. */ - gdev_prn_get_bits(pdev, lnum, in, &in_data); + code = gdev_prn_get_bits(pdev, lnum, in, &in_data); + if (code < 0) + goto xit; while ( in_data[0] == 0 && !memcmp((char *)in_data, (char *)in_data + 1, line_size - 1) && lnum < bottom ) { lnum++; - gdev_prn_get_bits(pdev, lnum, in, &in_data); + code = gdev_prn_get_bits(pdev, lnum, in, &in_data); + if (code < 0) + goto xit; } if(lnum == bottom ) break; /* finished with this page */ - (void)gdev_prn_copy_scan_lines(pdev, lnum, in, in_size); + code = gdev_prn_copy_scan_lines(pdev, lnum, in, in_size); + if (code < 0) + goto xit; inp = in + left; in_end = inp + width; @@ -397,7 +398,14 @@ Y coordinate of the printer equals (lnum - 60) gp_fflush(prn_stream); - gs_free(pdev->memory, (char *)buf2, in_size, 1, "lp8000_print_page(buf2)"); - gs_free(pdev->memory, (char *)buf1, in_size, 1, "lp8000_print_page(buf1)"); - return 0; +xit: + if ( buf1 ) + gs_free(pdev->memory, (char *)buf1, in_size, 1, "lp8000_print_page(buf1)"); + if ( buf2 ) + gs_free(pdev->memory, (char *)buf2, in_size, 1, "lp8000_print_page(buf2)"); + + if (code < 0) + return_error(code); + + return code; } diff --git a/devices/gdevlxm.c b/devices/gdevlxm.c index 4b0f26e9a..fe577c325 100644 --- a/devices/gdevlxm.c +++ b/devices/gdevlxm.c @@ -146,6 +146,7 @@ lxm5700m_print_page(gx_device_printer *pdev, gp_file *prn_stream) int lnum,minX, maxX, i, l, highestX, leastX, extent; int direction = RIGHTWARD; int lastY = 0; + int code = 0; int line_size = gdev_mem_bytes_per_scan_line((gx_device *)pdev); /* Note that in_size is a multiple of 8. */ @@ -158,12 +159,8 @@ lxm5700m_print_page(gx_device_printer *pdev, gp_file *prn_stream) /* Check allocations */ if ( buf1 == 0 || swipeBuf == 0 ) { - if ( buf1 ) -quit_ignomiously: /* and a goto into an if statement is pretty ignomious! */ - gs_free(pdev->memory, (char *)buf1, in_size, 1, "lxm_print_page(buf1)"); - if ( swipeBuf ) - gs_free(pdev->memory, (char *)swipeBuf, swipeBuf_size, 1, "lxm_print_page(swipeBuf)"); - return_error(gs_error_VMerror); + code = gs_error_VMerror; + goto xit; } { /* Initialize the printer and reset the margins. */ @@ -186,7 +183,9 @@ quit_ignomiously: /* and a goto into an if statement is pretty ignomious! */ for (l=lnum; l<pdev->height; l++) { /* Copy 1 scan line and test for all zero. */ - gdev_prn_get_bits(pdev, l, in, &in_data); + code = gdev_prn_get_bits(pdev, l, in, &in_data); + if (code < 0) + goto xit; if ( in_data[0] != 0 || memcmp((char *)in_data, (char *)in_data + 1, line_size - 1) ) { @@ -211,7 +210,9 @@ quit_ignomiously: /* and a goto into an if statement is pretty ignomious! */ } /* Copy the the scan lines. */ - lcnt = gdev_prn_copy_scan_lines(pdev, lnum, in, in_size); + code = lcnt = gdev_prn_copy_scan_lines(pdev, lnum, in, in_size); + if (code < 0) + goto xit; if ( lcnt < swipeHeight ) { /* Pad with lines of zeros. */ memset(in + lcnt * line_size, 0, @@ -251,7 +252,7 @@ quit_ignomiously: /* and a goto into an if statement is pretty ignomious! */ size_t outp_offset = outp - swipeBuf;\ size_t swipeBuf_size_new = swipeBuf_size * 2;\ byte* swipeBuf_new = gs_malloc(pdev->memory, swipeBuf_size_new, 1, "lxm_print_page(swipeBuf_new)");\ - if (!swipeBuf_new) goto quit_ignomiously;\ + if (!swipeBuf_new) { code = gs_error_VMerror; goto xit; }\ memcpy(swipeBuf_new, swipeBuf, swipeBuf_size);\ gs_free(pdev->memory, swipeBuf, swipeBuf_size, 1, "lxm_print_page(swipeBuf)");\ swipeBuf_size = swipeBuf_size_new;\ @@ -372,9 +373,14 @@ quit_ignomiously: /* and a goto into an if statement is pretty ignomious! */ } gp_fflush(prn_stream); - gs_free(pdev->memory, (char *)swipeBuf, swipeBuf_size, 1, "lxm_print_page(swipeBuf)"); - gs_free(pdev->memory, (char *)buf1, in_size, 1, "lxm_print_page(buf1)"); - return 0; +xit: + if ( buf1 ) + gs_free(pdev->memory, (char *)buf1, in_size, 1, "lxm_print_page(buf1)"); + if ( swipeBuf ) + gs_free(pdev->memory, (char *)swipeBuf, swipeBuf_size, 1, "lxm_print_page(swipeBuf)"); + if (code < 0) + return_error(code); + return code; } /* diff --git a/devices/gdevmgr.c b/devices/gdevmgr.c index 07761dac6..c6b660528 100644 --- a/devices/gdevmgr.c +++ b/devices/gdevmgr.c @@ -131,18 +131,20 @@ mgr_begin_page(gx_device_mgr *bdev, gp_file *pstream, mgr_cursor *pcur) return 0; } -/* Advance to the next row. Return 0 if more, 1 if done. */ +/* Advance to the next row. Return 0 if more, 1 if done. <0 if error */ static int mgr_next_row(mgr_cursor *pcur) -{ if ( pcur->lnum >= pcur->dev->height ) +{ int code = 0; + + if ( pcur->lnum >= pcur->dev->height ) { gs_free(((gx_device_printer *)pcur->dev)->memory, (char *)pcur->data, pcur->line_size, 1, "mgr_next_row(done)"); return 1; - } - gdev_prn_copy_scan_lines((gx_device_printer *)pcur->dev, + } + code = gdev_prn_copy_scan_lines((gx_device_printer *)pcur->dev, pcur->lnum++, pcur->data, pcur->line_size); - return 0; + return code < 0 ? code : 0; } /* ------ Individual page printing routines ------ */ @@ -219,6 +221,8 @@ mgrN_print_page(gx_device_printer *pdev, gp_file *pstream) if ( bdev->mgr_depth != 8 ) data = (byte *)gs_malloc(pdev->memory, mgr_line_size, 1, "mgrN_print_page"); + if (data == NULL) + return_error(gs_error_VMerror); while ( !(code = mgr_next_row(&cur)) ) { @@ -306,6 +310,8 @@ cmgrN_print_page(gx_device_printer *pdev, gp_file *pstream) } mgr_line_size = mgr_wide / (8 / bdev->mgr_depth); data = (byte *)gs_malloc(pdev->memory, mgr_line_size, 1, "cmgrN_print_page"); + if (data == NULL) + return_error(gs_error_VMerror); if ( bdev->mgr_depth == 8 ) { memset( table, 0, sizeof(table) ); diff --git a/devices/gdevn533.c b/devices/gdevn533.c index 5130bd38e..35720364a 100644 --- a/devices/gdevn533.c +++ b/devices/gdevn533.c @@ -163,7 +163,7 @@ nwp533_close(gx_device *dev) static int nwp533_print_page(gx_device_printer *dev, gp_file *prn_stream) { - int lnum; + int lnum, code = 0; int line_size = gdev_mem_bytes_per_scan_line(dev); byte *in; int printer_file; @@ -174,6 +174,8 @@ nwp533_print_page(gx_device_printer *dev, gp_file *prn_stream) line_size += 4 - (line_size % 4); } in = (byte *) gs_malloc(dev->memory, line_size, 1, "nwp533_output_page(in)"); + if (in == NULL) + return_error(gs_error_VMerror); restart: if(ioctl(printer_file, LBIOCSTOP, 0) < 0) { @@ -186,7 +188,9 @@ nwp533_print_page(gx_device_printer *dev, gp_file *prn_stream) for ( lnum = 0; lnum < dev->height; lnum++) { - gdev_prn_copy_scan_lines(prn_dev, lnum, in, line_size); + code = gdev_prn_copy_scan_lines(prn_dev, lnum, in, line_size); + if (code < 0) + goto xit; if(write(printer_file, in, line_size) != line_size) { perror("Writting to output"); @@ -201,7 +205,8 @@ nwp533_print_page(gx_device_printer *dev, gp_file *prn_stream) perror("Starting print"); return_error(gs_error_ioerror); } +xit: gs_free(dev->memory, in, line_size, 1, "nwp533_output_page(in)"); - return 0; + return code; } diff --git a/devices/gdevokii.c b/devices/gdevokii.c index 97a1c3b88..3350f6d9d 100644 --- a/devices/gdevokii.c +++ b/devices/gdevokii.c @@ -111,6 +111,7 @@ okiibm_print_page1(gx_device_printer *pdev, gp_file *prn_stream, int y_9pin_high int y_passes; int skip = 0, lnum = 0, pass, ypass; int y_step = 0; + int code = 0; x_dpi = pdev->x_pixels_per_inch; if (x_dpi / 60 >= sizeof(graphics_modes_9)/sizeof(graphics_modes_9[0])) { @@ -132,12 +133,9 @@ okiibm_print_page1(gx_device_printer *pdev, gp_file *prn_stream, int y_9pin_high y_step = 0; /* Check allocations */ - if ( buf1 == 0 || buf2 == 0 ) - { if ( buf1 ) - gs_free(pdev->memory, (char *)buf1, in_size, 1, "okiibm_print_page(buf1)"); - if ( buf2 ) - gs_free(pdev->memory, (char *)buf2, in_size, 1, "okiibm_print_page(buf2)"); - return_error(gs_error_VMerror); + if ( buf1 == 0 || buf2 == 0 ) { + code = gs_error_VMerror; + goto xit; } /* Initialize the printer. */ @@ -153,7 +151,9 @@ okiibm_print_page1(gx_device_printer *pdev, gp_file *prn_stream, int y_9pin_high int lcnt; /* Copy 1 scan line and test for all zero. */ - gdev_prn_get_bits(pdev, lnum, in, &in_data); + code = gdev_prn_get_bits(pdev, lnum, in, &in_data); + if (code < 0) + goto xit; if ( in_data[0] == 0 && !memcmp((char *)in_data, (char *)in_data + 1, line_size - 1) ) @@ -264,8 +264,13 @@ okiibm_print_page1(gx_device_printer *pdev, gp_file *prn_stream, int y_9pin_high gp_fwrite(end_string, 1, end_length, prn_stream); gp_fflush(prn_stream); - gs_free(pdev->memory, (char *)buf2, in_size, 1, "okiibm_print_page(buf2)"); - gs_free(pdev->memory, (char *)buf1, in_size, 1, "okiibm_print_page(buf1)"); +xit: + if ( buf1 ) + gs_free(pdev->memory, (char *)buf1, in_size, 1, "okiibm_print_page(buf1)"); + if ( buf2 ) + gs_free(pdev->memory, (char *)buf2, in_size, 1, "okiibm_print_page(buf2)"); + if (code < 0) + return_error(code); return 0; } diff --git a/devices/gdevpbm.c b/devices/gdevpbm.c index 647349ed3..412d01094 100644 --- a/devices/gdevpbm.c +++ b/devices/gdevpbm.c @@ -1054,6 +1054,8 @@ pnmcmyk_print_page(gx_device_printer *pdev, gp_file *pstream) !strncmp(pdev->fname, "/dev/null", min(strlen(pdev->fname), 9)); int (*row_proc) (gx_device_printer *, byte *, int, gp_file *); + if (data == NULL) + return_error(gs_error_VMerror); if (!output_is_nul) { if (gp_fprintf(pstream, "P5\n") < 0) { /* PGM raw */ code = gs_note_error(gs_error_ioerror); diff --git a/devices/gdevpdfimg.c b/devices/gdevpdfimg.c index bbeefc84e..998574c8b 100644 --- a/devices/gdevpdfimg.c +++ b/devices/gdevpdfimg.c @@ -271,6 +271,10 @@ static int gdev_pdf_image_begin_page(gx_device_pdf_image *pdf_dev, profile_struct->device_profile[0], profile_struct->postren_profile, &rendering_params); } + if (pdf_dev->icclink == NULL) { + gs_free_object(pdf_dev->memory->non_gc_memory, page, "pdfimage create new page"); + return_error(gs_error_VMerror); + } /* If it is identity, release it now and set link to NULL */ if (pdf_dev->icclink->is_identity) { pdf_dev->icclink->procs.free_link(pdf_dev->icclink); @@ -281,8 +285,10 @@ static int gdev_pdf_image_begin_page(gx_device_pdf_image *pdf_dev, /* Set up the stream and insert the file header */ pdf_dev->strm = s_alloc(pdf_dev->memory->non_gc_memory, "pdfimage_open_temp_stream(strm)"); - if (pdf_dev->strm == 0) + if (pdf_dev->strm == 0) { + gs_free_object(pdf_dev->memory->non_gc_memory, page, "pdfimage create new page"); return_error(gs_error_VMerror); + } pdf_dev->strm_buf = gs_alloc_bytes(pdf_dev->memory->non_gc_memory, pdf_dev->width * (pdf_dev->color_info.depth / 8), "pdfimage_open_temp_stream(strm_buf)"); if (pdf_dev->strm_buf == 0) { @@ -290,6 +296,7 @@ static int gdev_pdf_image_begin_page(gx_device_pdf_image *pdf_dev, gs_free_object(pdf_dev->memory->non_gc_memory, pdf_dev->strm, "pdfimage_open_temp_stream(strm)"); pdf_dev->strm = 0; + gs_free_object(pdf_dev->memory->non_gc_memory, page, "pdfimage create new page"); return_error(gs_error_VMerror); } swrite_file(pdf_dev->strm, pdf_dev->file, pdf_dev->strm_buf, pdf_dev->width * (pdf_dev->color_info.depth / 8)); @@ -1276,6 +1283,10 @@ static int gdev_PCLm_begin_page(gx_device_pdf_image *pdf_dev, profile_struct->device_profile[0], profile_struct->postren_profile, &rendering_params); } + if (pdf_dev->icclink == NULL) { + gs_free_object(pdf_dev->memory->non_gc_memory, page, "pdfimage create new page"); + return_error(gs_error_VMerror); + } /* If it is identity, release it now and set link to NULL */ if (pdf_dev->icclink->is_identity) { pdf_dev->icclink->procs.free_link(pdf_dev->icclink); @@ -1286,8 +1297,10 @@ static int gdev_PCLm_begin_page(gx_device_pdf_image *pdf_dev, /* Set up the stream and insert the file header */ pdf_dev->strm = s_alloc(pdf_dev->memory->non_gc_memory, "pdfimage_open_temp_stream(strm)"); - if (pdf_dev->strm == 0) + if (pdf_dev->strm == 0) { + gs_free_object(pdf_dev->memory->non_gc_memory, page, "pdfimage create new page"); return_error(gs_error_VMerror); + } pdf_dev->strm_buf = gs_alloc_bytes(pdf_dev->memory->non_gc_memory, 512, "pdfimage_open_temp_stream(strm_buf)"); if (pdf_dev->strm_buf == 0) { @@ -1295,6 +1308,7 @@ static int gdev_PCLm_begin_page(gx_device_pdf_image *pdf_dev, gs_free_object(pdf_dev->memory->non_gc_memory, pdf_dev->strm, "pdfimage_open_temp_stream(strm)"); pdf_dev->strm = 0; + gs_free_object(pdf_dev->memory->non_gc_memory, page, "pdfimage create new page"); return_error(gs_error_VMerror); } swrite_file(pdf_dev->strm, pdf_dev->file, pdf_dev->strm_buf, 512); diff --git a/devices/gdevperm.c b/devices/gdevperm.c index fe2295e71..f2a5e38c5 100644 --- a/devices/gdevperm.c +++ b/devices/gdevperm.c @@ -135,8 +135,8 @@ perm_print_page(gx_device_printer *pdev, gp_file *pstream) gx_device_perm_t * const dev = (gx_device_perm_t *)pdev; int ncomp = dev->num_std_colorant_names; int raw_raster = pdev->width * ncomp; - byte *raw_line; - byte *cooked_line; + byte *raw_line = NULL; + byte *cooked_line = NULL; byte *row; int code = 0; int mode = dev->mode; @@ -145,9 +145,15 @@ perm_print_page(gx_device_printer *pdev, gp_file *pstream) fprintf(pstream, "P6\n%d %d\n255\n", dev->width, dev->height); raw_line = gs_alloc_bytes(pdev->memory, raw_raster, "perm_print_page"); cooked_line = gs_alloc_bytes(pdev->memory, dev->width * 3, "perm_print_page"); + if (raw_line == NULL || cooked_line == NULL) { + gs_free_object(pdev->memory, raw_line, "perm_print_page"); + return_error(gs_error_VMerror); + } for (y = 0; y < dev->height; y++) { int x; code = gdev_prn_get_bits(pdev, y, raw_line, &row); + if (code < 0) + break; for (x = 0; x < dev->width; x++) { int c, m, y, k; int r, g, b; diff --git a/devices/gdevphex.c b/devices/gdevphex.c index f5fac8a22..f3ca50485 100644 --- a/devices/gdevphex.c +++ b/devices/gdevphex.c @@ -947,8 +947,8 @@ static void ScheduleMiddle( SCHEDUL *p ); static void ScheduleTrailing( SCHEDUL *p ); static void ScheduleBand( SCHEDUL *p, int mask ); -static void RenderPage( RENDER *p ); -static void RenderLine( RENDER *p, int line ); +static int RenderPage( RENDER *p ); +static int RenderLine( RENDER *p, int line ); static int IsScanlineEmpty( RENDER *p, byte *line ); static int RleCompress( RAWLINE *raw, int min, int max, byte *rle_data ); @@ -1682,6 +1682,7 @@ static int photoex_print_page( PDEV *device, gp_file *stream ) { int pixels; /* Length of the line */ int x; /* Work vars */ +int code = 0; EDEV *dev; /* Our device */ RENDER *render; /* Rendering info */ @@ -1791,7 +1792,9 @@ double psize; /* Render the page and send image data to printer */ - RenderPage( render ); + code = RenderPage( render ); + if (code < 0) + goto xit; /* Eject the paper, reset printer */ @@ -1799,10 +1802,10 @@ double psize; SendReset( stream ); /* Release the memory and return */ - +xit: gs_free( dev->memory, render->dbuff, pixels, sizeof( long ), "PhotoEX" ); gs_free( dev->memory, render, 1, sizeof( RENDER ), "PhotoEX" ); - return( 0 ); + return( code ); } /* @@ -1810,7 +1813,7 @@ double psize; * ~~~~~~~~~~~~~~ */ -static void RenderPage( RENDER *p ) +static int RenderPage( RENDER *p ) { int last_done; /* The last line rendered */ int last_need; /* The largest line number we need */ @@ -1819,6 +1822,7 @@ int last_band; /* Indicates the last band */ int min, max; /* Min/max active bytes in a raw line */ int phase; /* 1440dpi X weave offset */ int i, j, l, col; +int code = 0; p->htone_thold = HalftoneThold( p ); p->htone_last = -1 - p->htone_thold; @@ -1842,7 +1846,11 @@ int i, j, l, col; last_need = last_done; for ( i = NOZZLES-1 ; i >= 0 && p->schedule.head[ i ] == -1 ; i-- ); if ( i >= 0 ) last_need = p->schedule.head[ i ]; - while ( last_need > last_done ) RenderLine( p, ++last_done ); + while ( last_need > last_done ) { + code = RenderLine( p, ++last_done ); + if (code < 0) + return code; /* punt */ + } /* Now loop through the colours and build the data stream */ @@ -1932,6 +1940,8 @@ int i, j, l, col; move_down += p->schedule.down; } while ( ! last_band ); + + return code; } /* @@ -1944,14 +1954,16 @@ int i, j, l, col; * When it sees a nonempty line again, it restarts the renderer. */ -static void RenderLine( RENDER *p, int line ) +static int RenderLine( RENDER *p, int line ) { byte *data; -int i; +int i, code = 0; /* Get the line from Ghostscript and see if its empty */ - gdev_prn_get_bits( (PDEV *) p->dev, line, p->dbuff, &data ); + code = gdev_prn_get_bits( (PDEV *) p->dev, line, p->dbuff, &data ); + if (code < 0) + return code; if ( IsScanlineEmpty( p, data ) ) { @@ -1994,6 +2006,7 @@ int i; HalftoneLine( p, line, data ); p->htone_last = line; } + return 0; } /* diff --git a/devices/gdevpjet.c b/devices/gdevpjet.c index e794b0a03..d9fc76ff6 100644 --- a/devices/gdevpjet.c +++ b/devices/gdevpjet.c @@ -99,9 +99,10 @@ pj_common_print_page(gx_device_printer *pdev, gp_file *prn_stream, int y_origin, { int line_size; int data_size; - byte *data; - byte *plane_data; - byte *temp; + byte *data = NULL; + byte *plane_data = NULL; + byte *temp = NULL; + int code = 0; /* We round up line_size to a multiple of 8 bytes */ /* because that's the unit of transposition from pixels to planes. */ @@ -154,8 +155,10 @@ pj_common_print_page(gx_device_printer *pdev, gp_file *prn_stream, int y_origin, int num_blank_lines = 0; for ( lnum = 0; lnum < pdev->height; lnum++ ) { byte *end_data = data + line_size; - gdev_prn_copy_scan_lines(pdev, lnum, + code = gdev_prn_copy_scan_lines(pdev, lnum, (byte *)data, line_size); + if (code < 0) + goto xit; /* Remove trailing 0s. */ while ( end_data > data && end_data[-1] == 0 ) end_data--; @@ -223,11 +226,12 @@ pj_common_print_page(gx_device_printer *pdev, gp_file *prn_stream, int y_origin, /* end the page */ gp_fputs(end_page, prn_stream); +xit: gs_free(pdev->memory, (char *)data, data_size, 1, "paintjet_print_page(data)"); gs_free(pdev->memory, (char *)plane_data, line_size * 3, 1, "paintjet_print_page(plane_data)"); gs_free(pdev->memory, temp, line_size * 2, 1, "paintjet_print_page(temp)"); - return 0; + return code; } /* diff --git a/devices/gdevpsim.c b/devices/gdevpsim.c index 3c85c3192..7a194c643 100644 --- a/devices/gdevpsim.c +++ b/devices/gdevpsim.c @@ -143,7 +143,7 @@ static int psmono_print_page(gx_device_printer * pdev, gp_file * prn_stream) { int line_size = gdev_mem_bytes_per_scan_line((gx_device *) pdev); - int lnum; + int lnum, code = 0; byte *line = gs_alloc_bytes(pdev->memory, line_size, "psmono_print_page"); byte invert = (pdev->color_info.depth == 1 ? 0xff : 0); gx_device_pswrite_common_t pswrite_common; @@ -167,7 +167,9 @@ psmono_print_page(gx_device_printer * pdev, gp_file * prn_stream) int left = line_size; byte *data; - gdev_prn_get_bits(pdev, lnum, line, &data); + code = gdev_prn_get_bits(pdev, lnum, line, &data); + if (code < 0) + goto xit; p = data; /* Loop invariant: p + left = data + line_size. */ #define min_repeat_run 10 @@ -216,10 +218,11 @@ psmono_print_page(gx_device_printer * pdev, gp_file * prn_stream) /* Clean up and return. */ fputs("\n", prn_stream); psw_write_page_trailer(prn_stream, 1, true); +xit: gs_free_object(pdev->memory, line, "psmono_print_page"); if (ferror(prn_stream)) return_error(gs_error_ioerror); - return 0; + return code; } /* Close the file. */ @@ -307,7 +310,7 @@ psrgb_print_page(gx_device_printer * pdev, gp_file * prn_stream) int width = pdev->width; byte *lbuf = gs_alloc_bytes(mem, width * 3, "psrgb_print_page(lbuf)"); - int lnum; + int lnum, code = 0; stream fs, a85s, rls; stream_A85E_state a85state; stream_RLE_state rlstate; @@ -354,7 +357,9 @@ psrgb_print_page(gx_device_printer * pdev, gp_file * prn_stream) byte *data; int i, c; - gdev_prn_get_bits(pdev, lnum, lbuf, &data); + code = gdev_prn_get_bits(pdev, lnum, lbuf, &data); + if (code < 0) + goto xit; for (c = 0; c < 3; ++c) { const byte *p; @@ -369,7 +374,10 @@ psrgb_print_page(gx_device_printer * pdev, gp_file * prn_stream) sflush(&fs); fputs("\n", prn_stream); psw_write_page_trailer(prn_stream, 1, true); +xit: gs_free_object(mem, lbuf, "psrgb_print_page(lbuf)"); + if (code < 0) + return_error(code); if (ferror(prn_stream)) return_error(gs_error_ioerror); return 0; diff --git a/devices/gdevrinkj.c b/devices/gdevrinkj.c index cc144d7e5..509edd07d 100644 --- a/devices/gdevrinkj.c +++ b/devices/gdevrinkj.c @@ -818,6 +818,9 @@ rinkj_add_lut(rinkj_device *rdev, rinkj_lutset *lutset, char plane, gp_file *f) if (n_graph < 0 || n_graph > 256) return -1; chain = (rinkj_lutchain *)gs_alloc_bytes(rdev->memory, sizeof(rinkj_lutchain), "rinkj_add_lut"); + if (chain == NULL) { + return -1; + } chain->next = NULL; chain->n_graph = n_graph; chain->graph_x = (double *)gs_alloc_bytes(rdev->memory, sizeof(double) * n_graph, "rinkj_add_lut"); @@ -972,14 +975,23 @@ rinkj_write_image_data(gx_device_printer *pdev, RinkjDevice *cmyk_dev) n_planes = n_planes_in + rdev->separation_names.num_names; if_debug1m('r', rdev->memory, "[r]n_planes = %d\n", n_planes); xsb = pdev->width; - for (i = 0; i < n_planes_out; i++) + for (i = 0; i < n_planes_out; i++) { plane_data[i] = gs_alloc_bytes(pdev->memory, xsb, "rinkj_write_image_data"); - + if (plane_data[i] == NULL) { + while (--i >= 0) + gs_free_object(pdev->memory, plane_data[i], "rinkj_write_image_data"); + return_error(gs_error_VMerror); + } + } if (rdev->icc_link != NULL) { cache = (rinkj_color_cache_entry *)gs_alloc_bytes(pdev->memory, RINKJ_CCACHE_SIZE * sizeof(rinkj_color_cache_entry), "rinkj_write_image_data"); - if (cache == NULL) - return gs_note_error(gs_error_VMerror); + if (cache == NULL) { + /* i == n_planes_out from above */ + while (--i >= 0) + gs_free_object(pdev->memory, plane_data[i], "rinkj_write_image_data"); + return_error(gs_error_VMerror); + } /* Set up cache so that none of the keys will hit. */ @@ -999,11 +1011,15 @@ rinkj_write_image_data(gx_device_printer *pdev, RinkjDevice *cmyk_dev) split_plane_data[6] = plane_data[3]; line = gs_alloc_bytes(pdev->memory, raster, "rinkj_write_image_data"); + if (line == NULL) + goto xit; for (y = 0; y < pdev->height; y++) { byte *row; int x; code = gdev_prn_get_bits(pdev, y, line, &row); + if (code < 0) + goto xit; if (rdev->icc_link == NULL) { int rowix = 0; @@ -1115,6 +1131,7 @@ rinkj_write_image_data(gx_device_printer *pdev, RinkjDevice *cmyk_dev) } rinkj_device_write(cmyk_dev, NULL); +xit: for (i = 0; i < n_planes_in; i++) gs_free_object(pdev->memory, plane_data[i], "rinkj_write_image_data"); gs_free_object(pdev->memory, line, "rinkj_write_image_data"); diff --git a/devices/gdevsppr.c b/devices/gdevsppr.c index 144187e38..ee3c58131 100644 --- a/devices/gdevsppr.c +++ b/devices/gdevsppr.c @@ -115,7 +115,8 @@ sparc_print_page(gx_device_printer *pdev, FILE *prn) struct lpvi_page lpvipage; struct lpvi_err lpvierr; char *out_buf; - int out_size; + int out_size, code = 0; + if (ioctl(fileno(prn),LPVIIOC_GETPAGE,&lpvipage)!=0) { errprintf(pdev->memory, "sparc_print_page: LPVIIOC_GETPAGE failed\n"); @@ -132,7 +133,12 @@ sparc_print_page(gx_device_printer *pdev, FILE *prn) } out_size=lpvipage.bitmap_width*lpvipage.page_length; out_buf=gs_malloc(pdev->memory, out_size,1,"sparc_print_page: out_buf"); - gdev_prn_copy_scan_lines(pdev,0,out_buf,out_size); + if (out_buf == NULL) + return_error(gs_error_VMerror); + + code = gdev_prn_copy_scan_lines(pdev,0,out_buf,out_size); + if (code < 0) + goto xit; while (write(fileno(prn),out_buf,out_size)!=out_size) { if (ioctl(fileno(prn),LPVIIOC_GETERR,&lpvierr)!=0) @@ -182,6 +188,7 @@ sparc_print_page(gx_device_printer *pdev, FILE *prn) errprintf(pdev->memory, "OK.\n"); warning=0; } +xit: gs_free(pdev->memory, out_buf,out_size,1,"sparc_print_page: out_buf"); - return 0; + return code; } diff --git a/devices/gdevstc.c b/devices/gdevstc.c index 9040f062a..951ded0e8 100644 --- a/devices/gdevstc.c +++ b/devices/gdevstc.c @@ -362,6 +362,7 @@ stc_print_page(gx_device_printer * pdev, gp_file *prn_stream) int prt_pixels; /* Number of pixels printed */ byte *col_line; /* A Line with a byte per pixel */ + int code = 0; #define OK4GO ((flags & STCOK4GO) != 0) #define SORRY ( flags &= ~STCOK4GO) @@ -591,7 +592,11 @@ stc_print_page(gx_device_printer * pdev, gp_file *prn_stream) if(sd->stc.buf_y < sd->stc.prt_scans) { /* Test for White */ - gdev_prn_get_bits(pdev,sd->stc.buf_y,ext_line,&ext_data); + code = gdev_prn_get_bits(pdev,sd->stc.buf_y,ext_line,&ext_data); + if (code < 0) { + SORRY; + goto xit; + } color = stc_iswhite(sd,prt_pixels,ext_data) ? ext_size : 0; @@ -747,6 +752,7 @@ stc_print_page(gx_device_printer * pdev, gp_file *prn_stream) *** Release the dynamic memory ***/ +xit: if(ext_line != NULL) gs_free(sd->memory, ext_line,ext_size,1,"stc_print_page/ext_line"); diff --git a/devices/gdevtifs.c b/devices/gdevtifs.c index 2a52d3b73..2d612bac6 100644 --- a/devices/gdevtifs.c +++ b/devices/gdevtifs.c @@ -331,6 +331,9 @@ int gdev_tiff_begin_page(gx_device_tiff *tfdev, profile_struct->device_profile[0], profile_struct->postren_profile, &rendering_params); } + if (tfdev->icclink == NULL) { + return_error(gs_error_VMerror); + } /* If it is identity, release it now and set link to NULL */ if (tfdev->icclink->is_identity) { tfdev->icclink->procs.free_link(tfdev->icclink); @@ -477,7 +480,7 @@ tiff_print_page(gx_device_printer *dev, TIFF *tif, int min_feature_size) for (row = 0; row < dev->height && code >= 0; row++) { code = gdev_prn_copy_scan_lines(dev, row, data, size); if (code < 0) - break; + goto cleanup; if (min_feature_size > 1) { filtered_count = min_feature_size_process(data, min_feature_data); if (filtered_count == 0) diff --git a/devices/gdevtknk.c b/devices/gdevtknk.c index cd88a42d4..35d98bfe7 100644 --- a/devices/gdevtknk.c +++ b/devices/gdevtknk.c @@ -125,6 +125,7 @@ tekink_print_page(gx_device_printer *pdev, gp_file *prn_stream) register byte bdata,mdata,ydata,cdata; register byte mask,inbyte; register byte *indataend,*outdataend; + int code = 0; /* Allocate a temporary buffer for color separation. The buffer is partitioned into an input buffer and four @@ -134,7 +135,8 @@ tekink_print_page(gx_device_printer *pdev, gp_file *prn_stream) line_size = gdev_mem_bytes_per_scan_line((gx_device *)pdev); color_line_size=(pdev->width+7)/8; indata1=(byte *)malloc(line_size+4*(color_line_size+1)); - if (indata1==NULL) return -1; + if (indata1==NULL) + return_error(gs_error_VMerror); /* pointers to the partions */ indataend=indata1+line_size; bdata1=indataend; @@ -150,7 +152,9 @@ tekink_print_page(gx_device_printer *pdev, gp_file *prn_stream) scan_lines=pdev->height; for (scan_line=0;scan_line<scan_lines;scan_line++){ /* get data */ - gdev_prn_copy_scan_lines(pdev,scan_line,indata1,line_size); + code = gdev_prn_copy_scan_lines(pdev,scan_line,indata1,line_size); + if (code < 0) + goto xit; /* Separate data into color planes */ bdatap = bdata1+1; mdatap = mdata1+1; @@ -248,7 +252,8 @@ tekink_print_page(gx_device_printer *pdev, gp_file *prn_stream) gp_fputs("\f",prn_stream); } +xit: /* Deallocate temp buffer */ free(indata1); - return 0; + return code; } diff --git a/devices/gdevtsep.c b/devices/gdevtsep.c index bb905b73e..5b0429b46 100644 --- a/devices/gdevtsep.c +++ b/devices/gdevtsep.c @@ -1796,6 +1796,9 @@ tiffsep_prn_open(gx_device * pdev) profile_struct->device_profile[0], profile_struct->postren_profile, &rendering_params); } + if (pdev_sep->icclink == NULL) { + return_error(gs_error_VMerror); + } /* If it is identity, release it now and set link to NULL */ if (pdev_sep->icclink->is_identity) { pdev_sep->icclink->procs.free_link(pdev_sep->icclink); diff --git a/devices/gdevwpr2.c b/devices/gdevwpr2.c index 3f834b577..29af469be 100644 --- a/devices/gdevwpr2.c +++ b/devices/gdevwpr2.c @@ -571,9 +571,12 @@ win_pr2_print_page(gx_device_printer * pdev, gp_file * file) lines = scan_lines - y; else lines = yslice; - for (i = 0; i < lines; i++) - gdev_prn_copy_scan_lines(pdev, y + i, + for (i = 0; i < lines; i++) { + code = gdev_prn_copy_scan_lines(pdev, y + i, row + (bmp_raster * (lines - 1 - i)), raster); + if (code < 0) + goto xit; + } if (ratio > 1) { StretchDIBits(wdev->hdcprn, 0, y*ratio, pdev->width*ratio, lines*ratio, @@ -618,6 +621,7 @@ win_pr2_print_page(gx_device_printer * pdev, gp_file * file) ShowWindow(wdev->hDlgModeless, SW_HIDE); } +xit: GlobalUnlock(hrow); GlobalFree(hrow); diff --git a/devices/gdevxcf.c b/devices/gdevxcf.c index 39c72831d..a7e661746 100644 --- a/devices/gdevxcf.c +++ b/devices/gdevxcf.c @@ -1270,11 +1270,18 @@ xcf_write_image_data(xcf_write_ctx *xc, gx_device_printer *pdev) tile_data = (byte **)gs_alloc_bytes(pdev->memory, xc->n_tiles_x * sizeof(byte *), "xcf_write_image_data"); + if (line == NULL || tile_data == NULL) { + code = gs_error_VMerror; + goto xit; + } + memset(tile_data, 0, xc->n_tiles_x * sizeof(byte *)); for (tile_i = 0; tile_i < xc->n_tiles_x; tile_i++) { int tile_bytes = xcf_tile_sizeof(xc, tile_i) * bytes_pp; tile_data[tile_i] = gs_alloc_bytes(pdev->memory, tile_bytes, "xcf_write_image_data"); + if (tile_data[tile_i] == NULL) + goto xit; } for (tile_j = 0; tile_j < xc->n_tiles_y; tile_j++) { int y0, y1; @@ -1285,6 +1292,8 @@ xcf_write_image_data(xcf_write_ctx *xc, gx_device_printer *pdev) y1 = min(xc->height, y0 + TILE_HEIGHT); for (y = y0; y < y1; y++) { code = gdev_prn_get_bits(pdev, y, line, &row); + if (code < 0) + goto xit; if (link == NULL) xcf_shuffle_to_tile(xc, tile_data, row, y); else @@ -1303,9 +1312,12 @@ xcf_write_image_data(xcf_write_ctx *xc, gx_device_printer *pdev) } } - for (tile_i = 0; tile_i < xc->n_tiles_x; tile_i++) { - gs_free_object(pdev->memory, tile_data[tile_i], - "xcf_write_image_data"); +xit: + if (tile_data != NULL) { + for (tile_i = 0; tile_i < xc->n_tiles_x; tile_i++) { + gs_free_object(pdev->memory, tile_data[tile_i], + "xcf_write_image_data"); + } } gs_free_object(pdev->memory, tile_data, "xcf_write_image_data"); gs_free_object(pdev->memory, line, "xcf_write_image_data"); diff --git a/devices/gdevxcmp.c b/devices/gdevxcmp.c index 0aa73314d..5cf5a56cc 100644 --- a/devices/gdevxcmp.c +++ b/devices/gdevxcmp.c @@ -134,13 +134,16 @@ alloc_std_cmap(gx_device_X *xdev, bool colored) /* Allocate the dynamic color table, if needed and possible. */ /* Uses: vinfo, cman.num_rgb. Sets: cman.dynamic.*. */ -static void +/* Return true if the allocation was successful. */ +static bool alloc_dynamic_colors(gx_device_X * xdev, int num_colors) { if (num_colors > 0) { xdev->cman.dynamic.colors = (x11_color_t **) gs_malloc(xdev->memory, sizeof(x11_color_t *), xdev->cman.num_rgb, "x11 cman.dynamic.colors"); + if (xdev->cman.dynamic.colors == NULL) + return false; if (xdev->cman.dynamic.colors) { int i; @@ -152,6 +155,7 @@ alloc_dynamic_colors(gx_device_X * xdev, int num_colors) xdev->cman.dynamic.used = 0; } } + return true; } /* Allocate an X color, updating the reverse map. */ @@ -388,8 +392,9 @@ gdev_x_setup_colors(gx_device_X * xdev) } /* Allocate the dynamic color table. */ - alloc_dynamic_colors(xdev, CUBE(xdev->cman.num_rgb) - - CUBE(xdev->color_info.dither_colors)); + if (!alloc_dynamic_colors(xdev, CUBE(xdev->cman.num_rgb) - + CUBE(xdev->color_info.dither_colors))) + return_error(gs_error_VMerror); #undef CUBE #undef CBRT break; @@ -436,8 +441,9 @@ grayscale: } /* Allocate the dynamic color table. */ - alloc_dynamic_colors(xdev, xdev->cman.num_rgb - - xdev->color_info.dither_grays); + if (!alloc_dynamic_colors(xdev, xdev->cman.num_rgb - + xdev->color_info.dither_grays)) + return_error(gs_error_VMerror); break; case 'M': monochrome: |