diff options
| author | Michael Vrhel <michael.vrhel@artifex.com> | 2022-04-13 16:37:07 -0700 |
|---|---|---|
| committer | Michael Vrhel <michael.vrhel@artifex.com> | 2022-04-13 20:25:50 -0700 |
| commit | 1a18793a02e1dab7676d594366b93847fde6fe44 (patch) | |
| tree | 3ec8548d5763d3a357047d7b06a2dc8ce12439cc /base/gsptype1.c | |
| parent | 3e8878ec0a55b0d83365ba17ea48c4cff27be480 (diff) | |
| download | ghostpdl-1a18793a02e1dab7676d594366b93847fde6fe44.tar.gz | |
Bug 705197 OSS 46307
In the example of Bug 705197 the PDF interpreter
reuses a pattern during a circular reference causing an aliasing
of two nested patterns, one of which has a softmask. The change in
the buffer size of the inner one blows away the color information of the
outer one leading to a mismatch of color spaces. Added a check
in the pdf14 group composition to catch the case when the color space sizes
are wrong and avoid buffer over-runs that would occur when we try
to do the group composition. I return a Fatal error to the interpreter
thinking it would stop but it seems to swallow this and continue on its way.
Clearly being in this situation indicates something very bad has
happened I would expect to see GS error out when this occurs.
Diffstat (limited to 'base/gsptype1.c')
| -rw-r--r-- | base/gsptype1.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/base/gsptype1.c b/base/gsptype1.c index 75f6b9529..cea1ad3bc 100644 --- a/base/gsptype1.c +++ b/base/gsptype1.c @@ -1960,7 +1960,7 @@ gx_dc_pattern_write( Just write the tile id. */ gs_id id = ptile->id; /* Ensure sizeof(gs_id). */ if_debug2m('v', dev->memory, - "[v*] Writing trans tile ID into clist, uid = %ld id = %ld \n", + "[v*] Writing trans tile ID into clist, uid = %ld id = %u \n", ptile->uid.id, ptile->id); memcpy(dp, &ptile->id, sizeof(id)); *psize = sizeof(gs_id); @@ -1972,7 +1972,7 @@ gx_dc_pattern_write( the clist */ if (ptile->ttrans != NULL) { if_debug2m('v', dev->memory, - "[v*] Writing trans tile into clist, uid = %ld id = %ld \n", + "[v*] Writing trans tile into clist, uid = %ld id = %u \n", ptile->uid.id, ptile->id); return gx_dc_pattern_trans_write_raster(ptile, offset, data, psize); } @@ -2286,7 +2286,7 @@ gx_dc_pattern_read( ptile->ttrans->deep = deep; pdevc->type = &gx_dc_pattern_trans; if_debug2m('v', pgs->memory, - "[v*] Reading trans tile from clist into cache, uid = %ld id = %ld \n", + "[v*] Reading trans tile from clist into cache, uid = %ld id = %u \n", ptile->uid.id, ptile->id); code = gx_dc_pattern_read_trans_buff(ptile, offset1, dp, left, mem); |