Attachment #212839 for bug #272314

Lines 596-601 jbig2_immediate_generic_region(Jbig2Ctx Link Here

(-)ghostscript-8.70/jbig2dec/jbig2_generic.c.jbig2dec-nullderef (+4 lines)
596	memcpy (params.gbat, gbat, gbat_bytes);	596	memcpy (params.gbat, gbat, gbat_bytes);
597		597
598	image = jbig2_image_new(ctx, rsi.width, rsi.height);	598	image = jbig2_image_new(ctx, rsi.width, rsi.height);
		599	if (image == NULL)
		600	return jbig2_error(ctx, JBIG2_SEVERITY_FATAL, segment->number,
		601	"failed to allocate buffer for image");
		602
599	jbig2_error(ctx, JBIG2_SEVERITY_DEBUG, segment->number,	603	jbig2_error(ctx, JBIG2_SEVERITY_DEBUG, segment->number,
600	"allocated %d x %d image buffer for region decode results",	604	"allocated %d x %d image buffer for region decode results",
601	rsi.width, rsi.height);	605	rsi.width, rsi.height);

Lines 367-372 jbig2_decode_symbol_dict(Jbig2Ctx *ctx, Link Here

(-)ghostscript-8.70/jbig2dec/jbig2_symbol_dict.c.jbig2dec-nullderef (+20 lines)
367	memcpy(region_params.gbat, params->sdat, sdat_bytes);	367	memcpy(region_params.gbat, params->sdat, sdat_bytes);
368		368
369	image = jbig2_image_new(ctx, SYMWIDTH, HCHEIGHT);	369	image = jbig2_image_new(ctx, SYMWIDTH, HCHEIGHT);
		370	if (image == NULL) {
		371	jbig2_error(ctx, JBIG2_SEVERITY_FATAL, segment->number,
		372	"failed to allocate image storage");
		373	return NULL;
		374	}
370		375
371	code = jbig2_decode_generic_region(ctx, segment, &region_params,	376	code = jbig2_decode_generic_region(ctx, segment, &region_params,
372	as, image, GB_stats);	377	as, image, GB_stats);
Lines 517-522 jbig2_decode_symbol_dict(Jbig2Ctx *ctx, Link Here
517	ID, RDX, RDY);	522	ID, RDX, RDY);
518		523
519	image = jbig2_image_new(ctx, SYMWIDTH, HCHEIGHT);	524	image = jbig2_image_new(ctx, SYMWIDTH, HCHEIGHT);
		525	if (image == NULL) {
		526	jbig2_error(ctx, JBIG2_SEVERITY_FATAL, segment->number,
		527	"failed to allocate image storage");
		528	return NULL;
		529	}
520		530
521	/* Table 18 */	531	/* Table 18 */
522	rparams.GRTEMPLATE = params->SDRTEMPLATE;	532	rparams.GRTEMPLATE = params->SDRTEMPLATE;
Lines 635-640 jbig2_decode_symbol_dict(Jbig2Ctx *ctx, Link Here
635	for (j = HCFIRSTSYM; j < NSYMSDECODED; j++) {	645	for (j = HCFIRSTSYM; j < NSYMSDECODED; j++) {
636	Jbig2Image *glyph;	646	Jbig2Image *glyph;
637	glyph = jbig2_image_new(ctx, SDNEWSYMWIDTHS[j], HCHEIGHT);	647	glyph = jbig2_image_new(ctx, SDNEWSYMWIDTHS[j], HCHEIGHT);
		648	if (glyph == NULL) {
		649	jbig2_error(ctx, JBIG2_SEVERITY_FATAL, segment->number,
		650	"error allocating image storage for glyph");
		651	while (--j >= HCFIRSTSYM) {
		652	jbig2_image_release(ctx, SDNEWSYMS->glyphs[j]);
		653	SDNEWSYMS->glyphs[j] = NULL;
		654	}
		655	jbig2_image_release(ctx, image);
		656	return NULL;
		657	}
638	jbig2_image_compose(ctx, glyph, image,	658	jbig2_image_compose(ctx, glyph, image,
639	-x, 0, JBIG2_COMPOSE_REPLACE);	659	-x, 0, JBIG2_COMPOSE_REPLACE);
640	x += SDNEWSYMWIDTHS[j];	660	x += SDNEWSYMWIDTHS[j];

Lines 312-317 jbig2_decode_text_region(Jbig2Ctx *ctx, Link Here

(-)ghostscript-8.70/jbig2dec/jbig2_text.c.jbig2dec-nullderef (+6 lines)
312	IBO = IB;	312	IBO = IB;
313	refimage = jbig2_image_new(ctx, IBO->width + RDW,	313	refimage = jbig2_image_new(ctx, IBO->width + RDW,
314	IBO->height + RDH);	314	IBO->height + RDH);
		315	if (image == NULL)
		316	return jbig2_error(ctx, JBIG2_SEVERITY_FATAL, segment->number,
		317	"could not allocate image storage");
315		318
316	/* Table 12 */	319	/* Table 12 */
317	rparams.GRTEMPLATE = params->SBRTEMPLATE;	320	rparams.GRTEMPLATE = params->SBRTEMPLATE;
Lines 676-681 jbig2_parse_text_region(Jbig2Ctx *ctx, J Link Here
676	}	679	}
677		680
678	image = jbig2_image_new(ctx, region_info.width, region_info.height);	681	image = jbig2_image_new(ctx, region_info.width, region_info.height);
		682	if (image == NULL)
		683	return jbig2_error(ctx, JBIG2_SEVERITY_WARNING, segment->number,
		684	"unable to allocate image storage");
679		685
680	ws = jbig2_word_stream_buf_new(ctx, segment_data + offset, segment->data_length - offset);	686	ws = jbig2_word_stream_buf_new(ctx, segment_data + offset, segment->data_length - offset);
681	if (!params.SBHUFF) {	687	if (!params.SBHUFF) {

Return to bug 272314