diff options
| author | Ken Sharp <ken.sharp@artifex.com> | 2017-03-20 09:34:11 +0000 |
|---|---|---|
| committer | Ken Sharp <ken.sharp@artifex.com> | 2017-03-20 09:34:11 +0000 |
| commit | 309eca4e0a31ea70dcc844812691439312dad091 (patch) | |
| tree | 3222116ec39ee0d3382a6a8d7fec640a6b07d55a /base/gdevmem.c | |
| parent | dd5da2cb3e08398ac6d86598b36b00994d058308 (diff) | |
| download | ghostpdl-309eca4e0a31ea70dcc844812691439312dad091.tar.gz | |
Ensure a device has raster memory, before trying to read it.
Bug #697676 "Null pointer dereference in mem_get_bits_rectangle()"
This is only possible by abusing/mis-using Ghostscript-specific
language extensions, so cannot happen in a general PostScript program.
Nevertheless, Ghostscript should not crash. So this commit checks the
memory device to see if raster memory has been allocated, before trying
to read from it.
Diffstat (limited to 'base/gdevmem.c')
| -rw-r--r-- | base/gdevmem.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/base/gdevmem.c b/base/gdevmem.c index afd05bdb3..d52d68414 100644 --- a/base/gdevmem.c +++ b/base/gdevmem.c @@ -606,6 +606,8 @@ mem_get_bits_rectangle(gx_device * dev, const gs_int_rect * prect, GB_PACKING_CHUNKY | GB_COLORS_NATIVE | GB_ALPHA_NONE; return_error(gs_error_rangecheck); } + if (mdev->line_ptrs == 0x00) + return_error(gs_error_rangecheck); if ((w <= 0) | (h <= 0)) { if ((w | h) < 0) return_error(gs_error_rangecheck); |