diff options
author | Ray Johnston <ray.johnston@artifex.com> | 2019-11-11 20:14:36 -0800 |
---|---|---|
committer | Ray Johnston <ray.johnston@artifex.com> | 2019-11-13 08:19:05 -0800 |
commit | f63270230f329c6e89375af18d2bf2930421174a (patch) | |
tree | 97275cb35c3aa08663f0aff3c74fa2ae41c4a7f3 /devices/gdev4081.c | |
parent | 97277fcf0f70d482481ac329ce473e5687e7a935 (diff) | |
download | ghostpdl-f63270230f329c6e89375af18d2bf2930421174a.tar.gz |
Fix devices that ignore return codes from gdev_prn get_bits & copy_scan_lines
Discovered these when working on bug 701845 'devicen' device. Checking
uncovered a plethora of other places that used one of these functions
assuming success.
Also the gdev_prn_copy_scan_lines had places that assumed the return code
was a valid line_count, so if negative, could memset many lines in front of
an allocated buffer.
The code in a few of these usages is strange, and we don't have a way to
check them, so this may not match the original intent.
Also, while perusing all of these files, check devices for alloc's that
assume success and fix them (usually return gs_error_VMerror).
Diffstat (limited to 'devices/gdev4081.c')
-rw-r--r-- | devices/gdev4081.c | 23 |
1 files changed, 13 insertions, 10 deletions
diff --git a/devices/gdev4081.c b/devices/gdev4081.c index fe40b2c27..bd5c52d83 100644 --- a/devices/gdev4081.c +++ b/devices/gdev4081.c @@ -38,21 +38,19 @@ r4081_print_page(gx_device_printer *pdev, gp_file *prn_stream) int line_size = gdev_mem_bytes_per_scan_line((gx_device *)pdev); int out_size = ((pdev->width + 7) & -8) ; byte *out = (byte *)gs_malloc(pdev->memory, out_size, 1, "r4081_print_page(out)"); - int lnum = 0; + int lnum = 0, code = 0; int last = pdev->height; /* Check allocations */ if ( out == 0 ) - { if ( out ) - gs_free(pdev->memory, (char *)out, out_size, 1, - "r4081_print_page(out)"); - return -1; - } + return_error(gs_error_VMerror); /* find the first line which has something to print */ while ( lnum < last ) { - gdev_prn_copy_scan_lines(pdev, lnum, (byte *)out, line_size); + code = gdev_prn_copy_scan_lines(pdev, lnum, (byte *)out, line_size); + if (code < 0) + goto xit; if ( out[0] != 0 || memcmp((char *)out, (char *)out+1, line_size-1) ) @@ -62,7 +60,9 @@ r4081_print_page(gx_device_printer *pdev, gp_file *prn_stream) /* find the last line which has something to print */ while (last > lnum) { - gdev_prn_copy_scan_lines(pdev, last-1, (byte *)out, line_size); + code = gdev_prn_copy_scan_lines(pdev, last-1, (byte *)out, line_size); + if (code < 0) + goto xit; if ( out[0] != 0 || memcmp((char *)out, (char *)out+1, line_size-1) ) @@ -77,7 +77,9 @@ r4081_print_page(gx_device_printer *pdev, gp_file *prn_stream) /* Print lines of graphics */ while ( lnum < last ) { - gdev_prn_copy_scan_lines(pdev, lnum, (byte *)out, line_size); + code = gdev_prn_copy_scan_lines(pdev, lnum, (byte *)out, line_size); + if (code < 0) + goto xit; gp_fwrite(out, sizeof(char), line_size, prn_stream); lnum ++; } @@ -85,6 +87,7 @@ r4081_print_page(gx_device_printer *pdev, gp_file *prn_stream) /* Eject the page and reinitialize the printer */ gp_fputs("\f\033\rP", prn_stream); +xit: gs_free(pdev->memory, (char *)out, out_size, 1, "r4081_print_page(out)"); - return 0; + return code; } |