Dear gs upstream, Could you reviewthe patch at: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=422712 It seems that under some condition you could segfault and that patch solve the problem. Please comment and assert security impact. Bastien
ESP Ghostscript was an an unofficial fork of GNU Ghostscript. It's now abandoned by the authors and has never been supported by Artifex Software. None of the official versions have any problems running this command line cat testpage_filtered_by_pstops.ps | /usr/bin/gs-esp -dQUIET -dDEBUG -dPARANOIDSAFER -dNOPAUSE -dBATCH -dNOMEDIAATTRS -sDEVICE=cups -sstdout=%stderr -sOUTPUTFILE=%stdout -c - >/dev/null 2>gs_output
Created attachment 8801 [details] Local copy of the sample file.
Bastien, *Please* attach test files here when you open bugs, if you continue fail to do so, they are liable to be closed without further review. Thanks, Chris
Created attachment 8803 [details] Patch patch
Please do not consider the test case in this bug report. Notice that the patch joined apply and the bug lie in the modulus operation! Indeed modulus operation on negative number is implementation defined under C90 but fixed by implementation under C99 (a%b= sign(a) * ( abs(a) % abs(b) )); The bug is still there in base/gxcht.c where: static void init_tile_cursor(int i, tile_cursor_t *ptc, const gx_const_strip_bitmap *btile, int endx, int lasty) { int tw = btile->size.x; int bx = ((ptc->tile_shift = btile->shift) == 0 ? endx : endx + lasty / btile->size.y * ptc->tile_shift) % tw; int by = lasty % btile->size.y; ptc->xoffset = bx >> 3; ptc->xshift = 8 - (bx & 7); ptc->xbytes = (tw - 1) >> 3; ptc->xbits = ((tw - 1) & 7) + 1; ptc->tdata = btile->data; ptc->raster = btile->raster; ptc->row = ptc->tdata + by * (int)ptc->raster; ptc->data = ptc->row + ptc->xoffset; ptc->bit_shift = ptc->xshift; if_debug6('h', "[h]plane %d: size=%d,%d shift=%d bx=%d by=%d\n", i, tw, btile->size.y, btile->shift, bx, by); } So with a C90 compiler, if lasty is negative you could go negative in accessing pct->row and provoke a SEGFAULT ! Here function could be robustified by some assert if number are not negative. Or if negative by using the patch. Remember one this modulus of negative if EVIL. Bastien
REMIND because dependend to compiler is still here.
Please post an example Postscript or PDF file with a suitable command line, which exhibits lasty going negative, and reopen the bug.