Bug 693561

Summary:	gs_c_param_list_release() corrupts memory.
Product:	Ghostscript	Reporter:	Alex Cherepanov <alex>
Component:	PDF Writer	Assignee:	Ken Sharp <ken.sharp>
Status:	RESOLVED FIXED
Severity:	normal
Priority:	P2
Version:	master
Hardware:	PC
OS:	Linux
Customer:		Word Size:	---

Description Alex Cherepanov 2013-01-14 15:19:45 UTC

The call to gs_c_param_list_release() in zfunc4.c introduced in rev.
289aa28f46e2be1c87c34d44ee86dec41e87506b causes VM warnings, when gs is tested
with this command line:
gs '-Z?@$' -dNOPAUSE -dBATCH -sDEVICE=pdfwrite -sOutputFile=out.pdf foo.ps

The sample file can can be found here:
http://bugs.ghostscript.com/attachment.cgi?id=9033

Release build of current gs fails with a SEGV. Debug build just displays warnings. Removal of this line clears all problems in all revisions I've tried.

In general, constructing a copy of the parameter list just to accessing a boolean flag seems rather inefficient. Re-doing this for every looping operator
in the function is even less efficient.

Comment 1 Ken Sharp 2014-03-24 03:04:11 UTC

The performance problem is addressed with commit c74e146b74fe6db9f3a91ff71b7478dac79b5c1a

I believe the memory problem is nothing to do with gs_c_param_list_release, but is fixed in commit 23666d2037f14a1ef880e60bce9008203e502436 see the log for details.