Bug 690587

Summary:	setcolorspace + currentgray crashes GS 8.64
Product:	Ghostscript	Reporter:	François Robert <frobert>
Component:	Regression	Assignee:	Ken Sharp <ken.sharp>
Status:	RESOLVED FIXED
Severity:	major
Priority:	P4
Version:	8.64
Hardware:	PC
OS:	Windows 2000
Customer:		Word Size:	---

Description François Robert 2009-07-01 08:15:12 UTC

The following PS program crashes GPL Ghostscript 8.64 on Win32 :

[ /Indexed /DeviceGray 0 <00> ] setcolorspace currentgray

GS 8.64 (Win32) simply dies with no error message, no mesage box.
GS 8.54 and 8.60 (Win32) returns 0.0 on the stack (as expected ? at least it 
does not die...)

Note: This bug was uncovered when writing a separation procset, where 
currentgray  (and others) are used for probing the existence of nested 
separation contexts.

FYI, another issue was uncovered during those tests :

The following incorrect program :
 
[ /Indexed /DeviceGray 1 <00> ] setcolorspace 

on GS 8.64 produces a cryptic error message :
Error: /rangecheck in --@0x10081290--
On GS 8.54 and 8.60, it produces (as expected) :
Error: /rangecheck in --setcolorspace--

Comment 1 Ken Sharp 2009-07-01 08:34:30 UTC

The first issue is some kind of stack confusion; after executing the indexed
procedure (string in this case) to retrieve the base colour, we are expecting to
get a real and don't. This function therefore returns a typecheck error, and
that (oddly) causes the crash, probably because the execution/operand stacks are
in a mess. The crash occurs in pop_estack, from 'stop', attempting to clean up,
and the cleanup procedure we are trying to execute looks like its off the top of
the estack.

The current HEAD from Subversion returns (for me) a rangecheck error in
'execute' for the second problem. This was probably fixed along with one of the
earlier reports of colour space problems.

Assigning to me to address the first issue.

Comment 2 Ken Sharp 2009-07-06 01:52:19 UTC

Fixed in revision 9841, patch here:

http://ghostscript.com/pipermail/gs-cvs/2009-July/009529.html