Bug 692348 - utf8-Ghostscript: Crash if any of the GS_ environment variables not defined
Summary: utf8-Ghostscript: Crash if any of the GS_ environment variables not defined
Status: RESOLVED FIXED
Alias: None
Product: Ghostscript
Classification: Unclassified
Component: General (show other bugs)
Version: master
Hardware: PC Windows XP
: P4 normal
Assignee: Default assignee
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2011-07-16 19:06 UTC by SaGS
Modified: 2011-07-29 18:52 UTC (History)
1 user (show)

See Also:
Customer:
Word Size: ---


Attachments
Suggested patch. (3.00 KB, patch)
2011-07-16 19:07 UTC, SaGS
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description SaGS 2011-07-16 19:06:11 UTC
The Windows utf8 version of Ghostscript crashes when one or the other of the 
GS_* environment variables are not set. Since GS_OPTIONS is rarely set and it 
is fetched at startup, this means GS usually won't run.

The reason is the utf8 "gp_getenv_registry()" fails to return the "entry not 
found" verdict, instead is returns "buffer too small", sets the needed buffer 
size to zero and leaves the buffer for the output value undefined. The code 
calls "gp_getenv_registry()" once with buffer size = 0 in order to know how 
big the buffer needs to be, and if the entry exists calls the function a 2nd 
time to get the value assuming this 2nd call cannot fail. Because the 2nd call 
also has buffer size = 0, no value is returned. That function also has other 
problems, like doing "free(NULL)". I also hope the patch suggested in 
comment #1 makes the flow-control in the code more clear.
Comment 1 SaGS 2011-07-16 19:07:31 UTC
Created attachment 7679 [details]
Suggested patch.

Bug #692348: utf8-Ghostscript - Crash if any of the GS_ environment variables not defined.

For GS_ registry entries that are not set, the utf8 version of
'gp_getenv_registry()' incorrectly returned an 'insufficient buffer space'
verdict and let the 'needed buffer size' to 0 (cbData = 0 after
'RegQueryValueExW()'). The call to fetch the value was then made also with
a 0-sized buffer, did the same thing, and left the buffer for the value
undefined. There were also other problems, for example non-REG_SZ entries
were ignored only when the value was actually requested (not during the
request for the buffer size) and the function was doing 'free(wp)'
with wp == NULL in a few cases.
Comment 2 Alex Cherepanov 2011-07-29 18:52:15 UTC
This patch has been committed by Ray on 2011-07-17 as a rev.
44a2fd0bb1e2dd12e9ba475da0bdbb93081325d5