Attachment #194334 for bug #272314

Lines 599-604 jbig2_immediate_generic_region(Jbig2Ctx Link Here

(-)ghostscript-8.64/jbig2dec/jbig2_generic.c (+3 lines)
599	memcpy (params.gbat, gbat, gbat_bytes);	599	memcpy (params.gbat, gbat, gbat_bytes);
600		600
601	image = jbig2_image_new(ctx, rsi.width, rsi.height);	601	image = jbig2_image_new(ctx, rsi.width, rsi.height);
		602	if (image == NULL)
		603	return jbig2_error(ctx, JBIG2_SEVERITY_FATAL, segment->number,
		604	"invalid image");
602	jbig2_error(ctx, JBIG2_SEVERITY_DEBUG, segment->number,	605	jbig2_error(ctx, JBIG2_SEVERITY_DEBUG, segment->number,
603	"allocated %d x %d image buffer for region decode results",	606	"allocated %d x %d image buffer for region decode results",
604	rsi.width, rsi.height);	607	rsi.width, rsi.height);

Lines 59-65 struct _Jbig2Image { Link Here

(-)ghostscript-8.64/jbig2dec/jbig2.h (-1 / +1 lines)
59	int refcount;	59	int refcount;
60	};	60	};
61		61
62	Jbig2Image* jbig2_image_new(Jbig2Ctx *ctx, int width, int height);	62	Jbig2Image* jbig2_image_new(Jbig2Ctx *ctx, unsigned long width, unsigned long height);
63	Jbig2Image* jbig2_image_clone(Jbig2Ctx ctx, Jbig2Image image);	63	Jbig2Image* jbig2_image_clone(Jbig2Ctx ctx, Jbig2Image image);
64	void jbig2_image_release(Jbig2Ctx ctx, Jbig2Image image);	64	void jbig2_image_release(Jbig2Ctx ctx, Jbig2Image image);
65	void jbig2_image_free(Jbig2Ctx ctx, Jbig2Image image);	65	void jbig2_image_free(Jbig2Ctx ctx, Jbig2Image image);

Lines 24-29 Link Here

(-)ghostscript-8.64/jbig2dec/jbig2_image.c (-6 / +14 lines)
24	#include <stdio.h>	24	#include <stdio.h>
25	#include <stdlib.h>	25	#include <stdlib.h>
26	#include <string.h> /* memcpy() */	26	#include <string.h> /* memcpy() */
		27	#include <limits.h> /* INT_MAX */
27		28
28	#include "jbig2.h"	29	#include "jbig2.h"
29	#include "jbig2_priv.h"	30	#include "jbig2_priv.h"
Lines 31-40 Link Here
31		32
32		33
33	/* allocate a Jbig2Image structure and its associated bitmap */	34	/* allocate a Jbig2Image structure and its associated bitmap */
34	Jbig2Image* jbig2_image_new(Jbig2Ctx *ctx, int width, int height)	35	Jbig2Image* jbig2_image_new(Jbig2Ctx *ctx, unsigned long width, unsigned long height)
35	{	36	{
36	Jbig2Image *image;	37	Jbig2Image *image;
37	int stride;	38	unsigned long stride;
		39
		40	if (width == 0 \|\| height == 0 \|\| width > INT_MAX \|\| height > INT_MAX) {
		41	jbig2_error(ctx, JBIG2_SEVERITY_FATAL, -1,
		42	"invalid image dimensions! [%lux%lu]\n", width, height);
		43	jbig2_free(ctx->allocator, image);
		44	return NULL;
		45	}
38		46
39	image = (Jbig2Image )jbig2_alloc(ctx->allocator, sizeof(image));	47	image = (Jbig2Image )jbig2_alloc(ctx->allocator, sizeof(image));
40	if (image == NULL) {	48	if (image == NULL) {
Lines 47-60 Jbig2Image* jbig2_image_new(Jbig2Ctx *ct Link Here
47	image->data = (uint8_t )jbig2_alloc(ctx->allocator, strideheight);	55	image->data = (uint8_t )jbig2_alloc(ctx->allocator, strideheight);
48	if (image->data == NULL) {	56	if (image->data == NULL) {
49	jbig2_error(ctx, JBIG2_SEVERITY_FATAL, -1,	57	jbig2_error(ctx, JBIG2_SEVERITY_FATAL, -1,
50	"could not allocate image data buffer! [%d bytes]\n", stride*height);	58	"could not allocate image data buffer! [%lu bytes]\n", stride*height);
51	jbig2_free(ctx->allocator, image);	59	jbig2_free(ctx->allocator, image);
52	return NULL;	60	return NULL;
53	}	61	}
54		62
55	image->width = width;	63	image->width = (int) width;
56	image->height = height;	64	image->height = (int) height;
57	image->stride = stride;	65	image->stride = (int) stride;
58	image->refcount = 1;	66	image->refcount = 1;
59		67
60	return image;	68	return image;

Lines 407-413 jbig2_refinement_region(Jbig2Ctx *ctx, J Link Here

(-)ghostscript-8.64/jbig2dec/jbig2_refinement.c (-1 / +1 lines)
407	image = jbig2_image_new(ctx, rsi.width, rsi.height);	407	image = jbig2_image_new(ctx, rsi.width, rsi.height);
408	if (image == NULL)	408	if (image == NULL)
409	return jbig2_error(ctx, JBIG2_SEVERITY_FATAL, segment->number,	409	return jbig2_error(ctx, JBIG2_SEVERITY_FATAL, segment->number,
410	"unable to allocate image storage");	410	"unable to allocate image storage");
411	jbig2_error(ctx, JBIG2_SEVERITY_DEBUG, segment->number,	411	jbig2_error(ctx, JBIG2_SEVERITY_DEBUG, segment->number,
412	"allocated %d x %d image buffer for region decode results",	412	"allocated %d x %d image buffer for region decode results",
413	rsi.width, rsi.height);	413	rsi.width, rsi.height);

Lines 370-375 jbig2_decode_symbol_dict(Jbig2Ctx *ctx, Link Here

(-)ghostscript-8.64/jbig2dec/jbig2_symbol_dict.c (+19 lines)
370	memcpy(region_params.gbat, params->sdat, sdat_bytes);	370	memcpy(region_params.gbat, params->sdat, sdat_bytes);
371		371
372	image = jbig2_image_new(ctx, SYMWIDTH, HCHEIGHT);	372	image = jbig2_image_new(ctx, SYMWIDTH, HCHEIGHT);
		373	if (image == NULL) {
		374	jbig2_error(ctx, JBIG2_SEVERITY_FATAL, segment->number,
		375	"unable to allocate image storage");
		376	/* todo: memory cleanup */
		377	return NULL;
		378	}
373		379
374	code = jbig2_decode_generic_region(ctx, segment, &region_params,	380	code = jbig2_decode_generic_region(ctx, segment, &region_params,
375	as, image, GB_stats);	381	as, image, GB_stats);
Lines 520-525 jbig2_decode_symbol_dict(Jbig2Ctx *ctx, Link Here
520	ID, RDX, RDY);	526	ID, RDX, RDY);
521		527
522	image = jbig2_image_new(ctx, SYMWIDTH, HCHEIGHT);	528	image = jbig2_image_new(ctx, SYMWIDTH, HCHEIGHT);
		529	if (image == NULL) {
		530	code = jbig2_error(ctx, JBIG2_SEVERITY_FATAL, segment->number,
		531	"Out of memory creating symbol image");
		532	/* todo: memory cleanup */
		533	return NULL;
		534	}
523		535
524	/* Table 18 */	536	/* Table 18 */
525	rparams.GRTEMPLATE = params->SDRTEMPLATE;	537	rparams.GRTEMPLATE = params->SDRTEMPLATE;
Lines 638-643 jbig2_decode_symbol_dict(Jbig2Ctx *ctx, Link Here
638	for (j = HCFIRSTSYM; j < NSYMSDECODED; j++) {	650	for (j = HCFIRSTSYM; j < NSYMSDECODED; j++) {
639	Jbig2Image *glyph;	651	Jbig2Image *glyph;
640	glyph = jbig2_image_new(ctx, SDNEWSYMWIDTHS[j], HCHEIGHT);	652	glyph = jbig2_image_new(ctx, SDNEWSYMWIDTHS[j], HCHEIGHT);
		653	if (glyph == NULL) {
		654	jbig2_error(ctx, JBIG2_SEVERITY_FATAL, segment->number,
		655	"unable to allocate image storage");
		656	/* todo: memory cleanup */
		657	return NULL;
		658	}
		659
641	jbig2_image_compose(ctx, glyph, image,	660	jbig2_image_compose(ctx, glyph, image,
642	-x, 0, JBIG2_COMPOSE_REPLACE);	661	-x, 0, JBIG2_COMPOSE_REPLACE);
643	x += SDNEWSYMWIDTHS[j];	662	x += SDNEWSYMWIDTHS[j];

Lines 315-320 jbig2_decode_text_region(Jbig2Ctx *ctx, Link Here

(-)ghostscript-8.64/jbig2dec/jbig2_text.c (+12 lines)
315	IBO = IB;	315	IBO = IB;
316	image = jbig2_image_new(ctx, IBO->width + RDW,	316	image = jbig2_image_new(ctx, IBO->width + RDW,
317	IBO->height + RDH);	317	IBO->height + RDH);
		318	if (image == NULL) {
		319	jbig2_error(ctx, JBIG2_SEVERITY_FATAL, segment->number,
		320	"unable to allocate image storage");
		321	/* todo: memory cleanup */
		322	return -1;
		323	}
318		324
319	/* Table 12 */	325	/* Table 12 */
320	rparams.GRTEMPLATE = params->SBRTEMPLATE;	326	rparams.GRTEMPLATE = params->SBRTEMPLATE;
Lines 676-681 jbig2_parse_text_region(Jbig2Ctx *ctx, J Link Here
676	}	682	}
677		683
678	image = jbig2_image_new(ctx, region_info.width, region_info.height);	684	image = jbig2_image_new(ctx, region_info.width, region_info.height);
		685	if (image == NULL) {
		686	jbig2_error(ctx, JBIG2_SEVERITY_FATAL, segment->number,
		687	"unable to allocate image storage");
		688	/* todo: memory cleanup */
		689	return -1;
		690	}
679		691
680	ws = jbig2_word_stream_buf_new(ctx, segment_data + offset, segment->data_length - offset);	692	ws = jbig2_word_stream_buf_new(ctx, segment_data + offset, segment->data_length - offset);
681	if (!params.SBHUFF) {	693	if (!params.SBHUFF) {

Return to bug 272314