summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorZdenek Hutyra <zhutyra@centrum.cz>2025-01-13 09:07:57 +0000
committerChris Liddell <chris.liddell@artifex.com>2025-03-12 09:36:57 +0000
commit8b6d19b2b4079da6863ef25f2370f25d4b054919 (patch)
tree8f814c69e0d75fb6d36038d60acc2aa41db4fb20
parent7c065ada18ec1c3a98ae399bacf57801533b28cd (diff)
Bug 708192: Fix potential print buffer overflow
CVE-2025-27836
-rw-r--r--contrib/japanese/gdev10v.c22
1 files changed, 16 insertions, 6 deletions
diff --git a/contrib/japanese/gdev10v.c b/contrib/japanese/gdev10v.c
index 0bd3cec02..9d27573dc 100644
--- a/contrib/japanese/gdev10v.c
+++ b/contrib/japanese/gdev10v.c
@@ -199,17 +199,25 @@ bj10v_print_page(gx_device_printer *pdev, gp_file *prn_stream)
int bytes_per_column = bits_per_column / 8;
int x_skip_unit = bytes_per_column * (xres / 180);
int y_skip_unit = (yres / 180);
- byte *in = (byte *)gs_malloc(pdev->memory->non_gc_memory, 8, line_size, "bj10v_print_page(in)");
- /* We need one extra byte in <out> for our sentinel. */
- byte *out = (byte *)gs_malloc(pdev->memory->non_gc_memory, bits_per_column * line_size + 1, 1, "bj10v_print_page(out)");
+ byte *in, *out;
int lnum = 0;
int y_skip = 0;
int code = 0;
int blank_lines = 0;
int bytes_per_data = ((xres == 360) && (yres == 360)) ? 1 : 3;
- if ( in == 0 || out == 0 )
- return -1;
+ if (bits_per_column == 0 || line_size > (max_int - 1) / bits_per_column) {
+ code = gs_note_error(gs_error_rangecheck);
+ goto error;
+ }
+
+ in = (byte *)gs_malloc(pdev->memory->non_gc_memory, 8, line_size, "bj10v_print_page(in)");
+ /* We need one extra byte in <out> for our sentinel. */
+ out = (byte *)gs_malloc(pdev->memory->non_gc_memory, bits_per_column * line_size + 1, 1, "bj10v_print_page(out)");
+ if ( in == NULL || out == NULL ) {
+ code = gs_note_error(gs_error_VMerror);
+ goto error;
+ }
/* Initialize the printer. */
prn_puts(pdev, "\033@");
@@ -320,8 +328,10 @@ notz:
}
/* Eject the page */
-xit: prn_putc(pdev, 014); /* form feed */
+xit:
+ prn_putc(pdev, 014); /* form feed */
prn_flush(pdev);
+error:
gs_free(pdev->memory->non_gc_memory, (char *)out, bits_per_column, line_size, "bj10v_print_page(out)");
gs_free(pdev->memory->non_gc_memory, (char *)in, 8, line_size, "bj10v_print_page(in)");
return code;