summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
...
* oss-fuzz 50656: Bounds check instruction buffer in Ins_NPUSHB()Chris Liddell2022-09-021-1/+2
|
* GhostPDF - Only get the required number of Range values for a ColorSpaceKen Sharp2022-09-021-1/+1
| | | | | | | | | Bug #705828 "stack-overflow in /targets/ghostscript/foo/./pdf/pdf_colour.c:2236 pdfi_create_colorspace_by_array" The code was reading all the entries in a Range array into a stack array. But we hadn't validated the maximum number in the array so we could overrun. Limit the copy to the maximum number required by the 'N' value (which is validated).
* GhostPDF - abort repair of ObjStm on errorKen Sharp2022-09-021-2/+2
| | | | | | | | | | | | | | | OSS-fuzz 50747 The corrupted file has an ObjStm where the value of 'N', the number of objects in the stream, is corrupted and huge. We read the objects from a SubFileDecode, so we don't overrun, but we were ignoring the error return and attempting to read a full 'N' objects. There's really no point, corrupted ObjStms are more or less irreperable so if we get an error, just stop. This doesn't prevent a crash or any other problem, it just means we stop handling an irreparable file more quickly.
* oss-fuzz 50731/50732: pdfi - validate BitsPerComponent for imagesChris Liddell2022-09-021-0/+4
|
* oss-fuzz 50720: CFF - validate fontname string lengthChris Liddell2022-09-021-3/+4
|
* Coverity 380513: Missed a macro instance before.Chris Liddell2022-09-021-2/+2
|
* GhostPDF + GS - improve error handlingKen Sharp2022-09-022-16/+59
| | | | | | | | | | | | | | | | Arising from Bug #705784, if we hadn't built the PDF interpreter we would get typecheck errors which were somewhat misleading as to the source of the problem. This commit tidies up the error handling in the area of .PDFInit so that we not only detect the problem there but give a warning that it occurred. In addition, add a means to detect if the PDF interpreter is built in before we stat trying to process a PDF file and, if it is not, give a sensible error message. Tested with BUILD_PDF 0 and with NEWPDF true and false.
* Coverity 380510/380513: Avoid redundant ID type checkChris Liddell2022-09-023-50/+55
| | | | | | | | | | Since we've already checked the font and macro ID types are string, coverity spots that the type checks in the ID accessor macros are redundant. So, add accessors for when we already know the ID is a string ID. Secondly, tidy up macro naming, so it's not so easily confused with a variable or constant value.
* graphics library - prevent seg fault in .tempfileKen Sharp2022-09-021-4/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | Coverity ID #380524 A seg fault can be reproduced on Windows using this PostScript: (d:\\temp) (w+) .tempfile The problem occurs because on Windows gp_file_name_is_absolute permits either '\' or '/' to be used as a separator, but gp_file_name_separator can (obviously) only return one separator, in this case '/'. This means the loop stripping the prefix fails to find any separator and exits with plen = -1, which causes a seg fault in the memcpy below. The first part of the fix is to check plen and if it's less than 0 exit with an error. The remainder of the commit changes from using the separator string to calling gp_file_name_check_separator instead. This has two benefits; firstly it means that on Windows both separators can be detected, secondly for OS's where the separator is more than a single byte we can still detect it, which we could not before. Ghostscript itself never uses .tempfile with a filename, so this can only occur with PostScript input.
* Coverity ID 380512Ken Sharp2022-09-021-5/+14
| | | | | | | | | | | We were not using the return value from pdfi_array_get_number(). Since we're making changes anyway, duplicate the fix in commit 0cbcfd63c0865a8c3a8d9d4bd81ba27cb0432487 to avoid storing the dereferenced object in the array, in case we end up with a CropBox where the array contains an indirect reference to the Pages tree. The earlier commit only updated the array we were using for the canvas size.
* GhostPDF - detect self-referencing indirect objectsKen Sharp2022-09-021-0/+10
| | | | | | | | | | | Bug #785703 "stack overflow in pdf/pdf_loop_detect.c:76 pdfi_loop_detector_check_object (exploitable) " The file is corrupted in such a way that dereferencing object 6 results in an indirect reference to object 6. Add a specific check to the dereference code to compare any resulting indirect reference with the requested object number, and if they are the same throw a circular reference error.
* Explicitly disable LERC for "local" libtiff buildChris Liddell2022-08-241-1/+1
|
* GhostPDF - Another memory leak fix with malfromed PDF files.Ken Sharp2022-08-241-1/+14
| | | | | | | This is exactly the same problem as was fixed in commit 21b9a273b4aa94d88eb0c9731d339af1decce2cc, but that fixed the problem when called from Ghostscript, this commit does the same for the stand alone PDF interpreter.
* GhostPDF - fix memory leak with malformed PDF filesKen Sharp2022-08-241-5/+35
| | | | | | | | | | | | | | | | | | | | | | Using the file from OSS-fuzz #47753 and this command line: -K1048576 -r200x200 -sBandListStorage=memory -dMaxBitmap=0 -dBufferSpace=450k -dMediaPosition=1 -dcupsColorSpace=1 -dSAFER -dNOPAUSE -dBATCH -dNOINTERPOLATE -dNOMEDIAATTRS -sDEVICE=nullpage Leaked memory due to the array checking of the various Box parameters. One of the MediaBox entries is an (invalid) indirect reference to the Pages tree, when we fetched the reference from the array we dereferenced it and stored the dereferenced value in the MediaBox array, thus creating a circular reference: Pages->Page->MediaBox ^ | |------------ Which meant we never counted down any of the objects in the sequence to 0 and freed them. Using the 'no_store_R' variant avoids storing the dereferenced object back to the array. Since we don't need the object, other than to get its numeric value, this doesn't cost any performance.
* Dates for 10.0.0 RC1ghostpdl-10.0.0rc1Chris Liddell2022-08-2447-47/+47
|
* pdfi: Remove the CIDSystemInfo Supplement check in the cidfmap codeChris Liddell2022-08-231-16/+1
| | | | | | | | | The pdfi code for reading and using mappings for CIDFonts in cidfmap validated all the CIDSystemInfo (registry, ordering and supplement) and if any didn't match, it would reject the mapping. It turns out that the old code ignored the Supplement value, so the pdfi code will now, too.
* GhostPDF - Fix memory leak with pdfmarksKen Sharp2022-08-231-2/+3
| | | | | | | | Don't replace the array entry with the dereferenced object until we have recursively dereferenced the object. We were storing the value in the array before fully descending through its contents, which meant that if we found a circular reference we were 'baking it in' to the array.
* Update release notes/hightlights for 10.00.0 RC1Chris Liddell2022-08-232-38/+20
|
* Version number, dates and product string for 10.0.0 RC1ghostpdl-10.0.0_release_tests_002Chris Liddell2022-08-2349-79/+79
|
* GhostPDF - use recursive array fetch to avoid circular referenceKen Sharp2022-08-231-1/+1
| | | | Bug #705777 " stack overflow in psi/idict.c:160 dict_alloc (exploitable)"
* Graphics library - enforce limit on Colors with PixelDifference filterKen Sharp2022-08-231-3/+8
| | | | | | | | | | | | | | | Bug #705776 "stack-overflow in /base/gsmchunk.c:1110:31 in chunk_free_object" The PixelDifference filter has a memory buffer in the stream state to hold 'Colors' values, that buffer is hard-coded at 60 values, despite the fact that, according to the comment in spdiffx.h at line 27 the value of Colors can be arbitrarily large. Because the initialisation function doesn't check the value of Colors we can end up running off the buffer and overwriting memory. This commit checks the value of Colors and if it exceeds the maximum value at compile-time returns a rangecheck error.
* oss-fuzz 50527: Fix CIDtoGIDMap bounds check for CIDType2 fontsChris Liddell2022-08-231-5/+2
| | | | in pdfi_cidtype2_get_glyph_index()
* Bug 705774: Fix (not!) a memory leak in mkromfs.cChris Liddell2022-08-231-2/+7
| | | | | | Since mkromfs is only run as part of the build process, and the "leaked" memory isn't really leaked, the only reason to fix this is so certain sanitizers can be used without requiring CCFLAGSAUX/LDFLAGSAUX to differ from CFLAGS/LDFLAGS.
* oss-fuzz 50370: Always fully tidy up a filter pipelineChris Liddell2022-08-221-4/+5
| | | | | | | | | | | | | | When shutting down the device, pdfwrite would flush and close the pipeline of filters in place for the main output stream. But s_close_filters() would stop the process if a filter in the pipeline threw an error. As pdfwrite immediately then closes the ouput file, the ultimate target of the pipeline, this would then later cause a crash then the garbager attempted to "sweep up" the errant stream objects. Or, in the non-gc use case, it would cause a memory leak. So change s_close_filters() to continue to destroy the filters in the pipeline even after an error (but strill return the relevant error), meaning the filter pipelines are always cleaned up, even if one or more filters has an error.
* GhostPDF - fix memory leakKen Sharp2022-08-221-1/+1
| | | | | | | Seen with OSS-fuzz #42920, teh nullpage device and Ghostscript (not gpdf) To gt the reference counting right we need to not count up 'currdict', but we do need to NULL 'Parent' instead.
* oss-fuzz 50057: freetype: [base, type1] Better handling of out-of-memory ↵Chris Liddell2022-08-222-2/+5
| | | | | | | situations. Committed upstream: https://gitlab.freedesktop.org/freetype/freetype/-/commit/37b718d5899bc4a85425fcc548a7636871808f96
* GhostPDF - fix a typo in an error messageKen Sharp2022-08-221-2/+2
| | | | Bug 705767 "Dereference of free object 41, next object number as offset failed"
* GhostPDF - correct returrn code checkKen Sharp2022-08-221-1/+1
| | | | | | | Bug #705769 "NULL pointer dereference in pdf/pdf_misc.c:110 in pdfi_name" pdfi_dict_knownget_type returns a typecheck error if the object has the wrong type. So we need to check for a return code > 0.
* ps2write - fix PSPageOptions with multi-page inputKen Sharp2022-08-202-10/+14
| | | | | | | | | | | | | Commit 7d6d69ff17c43664482fe0dc34676a46ba551d93 accidentally broke PSPageOptions with multi-page input, because the array of strings was freed on every page. This commit fixes that problem; note you cannot change PSPageOptions once it has been set, except by restoring back to the point before the device was opened. Also the documentation formatting was slightly broken, fix that at the same time.
* oss-fuzz 50326: Fix and use bounds checkChris Liddell2022-08-192-3/+6
| | | | | | for Type 1/2 charstring executaion state stack. The bounds checking macro was incorrect, and wasn't being used in the minimal CharString interpreter used by pdfwrite and co.
* GhostPDF - fix memory leak with Widget annotationsKen Sharp2022-08-181-2/+4
| | | | | | | | | | | | | | | | Exhibited by /tests_private/pdf/sumatra/1348_-_support_Additional_Actions.pdf The problem can occur if we find either /T or /FT in the current dictionary but don't find both. In that case we try to find the keys in any /Parent dictionary. But if the Parent contains *both* keys then it would replace the stored one found in the earlier dictionary, without counting it down, leading to a memory leak. We don't actually use the /T and /FT values which we retrieve, so the simplest solution is to simply discard them as soon as they are found. Once we do that, we don't need to count them down on exit any more either.
* GhostPDF - reference counting fixKen Sharp2022-08-181-1/+0
| | | | | | | The file from OSS-fuzz 50321 has an Annotation with a /Parent which is an integer, this was causing us to count down the reference too many times and free the object while it was still in the cache, leading to a seg fault.
* pdfwrite - check allocated memoryKen Sharp2022-08-171-0/+2
| | | | | | | | | | | | Observed with OSS-fuzz 50113 and this command line: -K1048576 -r200x200 -sBandListStorage=memory -dMaxBitmap=0 -dBufferSpace=450k -dMediaPosition=1 -dcupsColorSpace=1 -dSAFER -dNOPAUSE -dBATCH -dNOINTERPOLATE -dNOMEDIAATTRS -sDEVICE=pdfwrite -sOutputFile=out.pdf We tried to allocate memory to hold a number of Unicode code points, but we didn't check to see if the allocation succeeded. In this case it fails, and we then tried to use the pointer. Check the allocation and return an error if it fails.
* graphics library - NULL return pointer if ToUnicode allocation failsKen Sharp2022-08-171-0/+1
| | | | | | | | | | | | Seen with the file from OSS-fuzz 42916 and : -K1048576 -r200x200 -sBandListStorage=memory -dMaxBitmap=0 -dBufferSpace=450k -dMediaPosition=1 -dcupsColorSpace=1 -dSAFER -dNOPAUSE -dBATCH -dNOINTERPOLATE -dNOMEDIAATTRS -sDEVICE=pdfwrite -sOutputFile=out.pdf If we failed to allocate 'map' we would properly free the (already allocated) pcmap, but we left the pointer pointing at the freed memory. Later we would free the font, and would then attempt to free the free memory, and crash. Fix by setting the returned pointer to NULL.
* Bump version number and date to 10.01.0Chris Liddell2022-08-172-4/+4
| | | | for the git prelease code.
* Add a stern warning about using the old PDF interpreterChris Liddell2022-08-171-0/+1
|
* oss-fuzz 50307: free temporary forwarding device on errorChris Liddell2022-08-171-1/+3
|
* Coverity ID 302300Ken Sharp2022-08-171-2/+2
| | | | | Two booleans were initialised with the wrong value which meant some code could never be executed.
* Coverity ID 380288Ken Sharp2022-08-171-5/+1
| | | | | | | | We can't get to the 'exit' label after we've added the Parent, so there's no need for the code to remove it again currently. Explicitly cast the cleartomark to void just to indicate it's deliberate.
* oss-fuzz 50306: Add bounds check in Type 2 charstring interpreterChris Liddell2022-08-171-0/+2
| | | | Missing stack bounds check
* Check for "make" before checking for GNU makeChris Liddell2022-08-171-0/+10
| | | | | | | | | | | | | | | | If left to its defaults, the build system on Unix will assume GNU make, and use GNU make features to speed up the build process. configure would check for GNU make for this reason, but wasn't checking if there was a "make" program available first, leading to a potentiall confusing error message. This checks that a "make" program exists, before trying to check it's GNU make. Secondly, in recognition that some systems (Solaris, for example) have their own make, but often have GNU make available as "gmake", add a "--with-make=" option allowing a user to set a custom name for the make executable to look for and check the version.
* Bug 705737 : XPS interpreterEthan Vrhel2022-08-161-0/+6
| | | | | | Added check to an offset while reading the index header in xps_count_cff_index. If the offset was read as negative, the function will return a pointer outside the range of the buffer.
* GhostPDF - more work on Widget annotationsKen Sharp2022-08-161-12/+33
| | | | | | | | | | | | | | | | | | | | | The first problem is that the code did not do what the comments said. We exited the loop searching for T and FT keys as soon as we found either, and then only checked if we had at least one of the keys. The comments (and the old PostScript code) say we should not render the annotation unless both keys are present. Change the loop and exit conditions to implement this. The second change is handling the /Parent. If we use a simple dictionary accessor then the value of the key will be dereferenced and stored in the dictionary. Fine if the Parent is valid but if the Parent value is an indirect reference to (eg) the Pages tree, then we will end up with a circular reference (Pages->Page->annot->Pages) which will leak memory. Use more complicated code to access the dictionary without storing the dereferenced value of /Parent in the dictionary.
* GhostPDF - Correct Widget annotation key nameKen Sharp2022-08-161-6/+6
| | | | | | | | | The comment around line 3662, copied from the original PostScript implementation, refers to the FT (Field Type) key, but the code was actually trying to find a key named /TF, whcih didn't exist because there is no such key defined. Fix the spelling, and change all the variable names to match.
* Coverity ID 380288Ken Sharp2022-08-161-1/+1
| | | | Check dev_profile is not NULL before dereferencing.
* oss-fuzz 50267: Type 2 charstrings, bounds check "control" stackChris Liddell2022-08-161-1/+3
| | | | | | We have a "control" stack which we push/pop onto when running Subrs/GlobalSubrs. Add bounds checking to ensure we don't over flow that stack.
* Coverity ID 380288Ken Sharp2022-08-161-4/+1
| | | | | Since this is a failure exit, code must be less than zero, so testing code and branching if it is >= 0 is unreachable.
* graphics library - curve flattening failureKen Sharp2022-08-151-2/+8
| | | | | | | | | | | OSS-fuzz #50243 The fuzzed file strokes a massive curve section, so long that we decide we have to subdivide it before flattening it. This led to us failing to satisfy the exit condition, and running an infinite loop until we ran out of memory trying to add line segments. Fix the exit test so that we exit if we have no more points to consider.
* oss-fuzz 50099: Fix mistake in setting CFF data buffer limitChris Liddell2022-08-151-2/+3
| | | | for fdarray subfonts
* GhostPDF - remove Parent key from stream dictionaries after insertionKen Sharp2022-08-151-1/+17
| | | | | | | | | | | | | | | | | | | | Bug #705746 "stack-overflow in pdf_misc.c:162 pdfi_string_from_name" When handling XObjects we check the stream dictionary to see if it is the same as the one we were handed, or different (Forms). If it is different then we add the current stream dictionary to the XObject dictionary as a /Parent, so that Resource searching will trickle back up the stack of objects until it either finds the Resource or runs out of dictionaries to check. However, we didn't remove the Parent again; this turns out to be a problem if the file is broken in such a way as to define the /Info dictionary as being one of these streams. If we try to turn the Info dictionary into a PostScript dictionary after we've inserted a /Parent then we can end up with a circular reference. The obvious solution is to remove the key if we added it, we only need it for the duration of the Form in order to find Resources.
View Lorry Controller Status