Bug 693561 - gs_c_param_list_release() corrupts memory.
Summary: gs_c_param_list_release() corrupts memory.
Status: RESOLVED FIXED
Alias: None
Product: Ghostscript
Classification: Unclassified
Component: PDF Writer (show other bugs)
Version: master
Hardware: PC Linux
: P2 normal
Assignee: Ken Sharp
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2013-01-14 15:19 UTC by Alex Cherepanov
Modified: 2014-03-24 03:04 UTC (History)
0 users

See Also:
Customer:
Word Size: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Alex Cherepanov 2013-01-14 15:19:45 UTC 
The call to gs_c_param_list_release() in zfunc4.c introduced in rev.
289aa28f46e2be1c87c34d44ee86dec41e87506b causes VM warnings, when gs is tested
with this command line:
gs '-Z?@$' -dNOPAUSE -dBATCH -sDEVICE=pdfwrite -sOutputFile=out.pdf foo.ps

The sample file can can be found here:
http://bugs.ghostscript.com/attachment.cgi?id=9033

Release build of current gs fails with a SEGV. Debug build just displays warnings. Removal of this line clears all problems in all revisions I've tried.

In general, constructing a copy of the parameter list just to accessing a boolean flag seems rather inefficient. Re-doing this for every looping operator
in the function is even less efficient.
Comment 1 Ken Sharp 2014-03-24 03:04:11 UTC 
The performance problem is addressed with commit c74e146b74fe6db9f3a91ff71b7478dac79b5c1a

I believe the memory problem is nothing to do with gs_c_param_list_release, but is fixed in commit 23666d2037f14a1ef880e60bce9008203e502436 see the log for details.