Created attachment 9794 [details] log.txt Seg faults in the 64 bit build of ghostscript were found by fuzzing in gx_default_fillpage (gdevddrw.c:1125) while reading these files. See the attached log.txt for details. 084db199_8cc1aef4_d13f0af2_e9158eed_fc5ee2df.SIGSEGV.d1c.169.psdcmyk.300.1 084db199_8cc1aef4_d13f0af2_e9158eed_fc5ee2df.SIGSEGV.d1c.169.psdcmyk.72.0
These problems are Bountible to Shelly and Simon (only) under the arrangement we set up previously for jbig2 and jpeg 2000 problems. If you 2 can divide them fairly that's great if not I'll review them and assign them. Let me know.
Created attachment 11015 [details] Patch for seg fault in fuzzing file The test file can be cut down to one line :- /eq { showpage grestore grestore } def This was causing a showpage after the device had been closed and hence a segfault. The attached patch ensures that systemdict will be used at the correct time and avoid malicious code being injected into the system.
Comment on attachment 11015 [details] Patch for seg fault in fuzzing file The patch is fine with me. Thanks. Commit, or let me know if you want me to.
Patch committed as http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=4fc4b8410d3
Hello, this commit breaks 'ps2pdf' script. Reverting it solves the problem. Details: running 'ps2pdf' on attached 'ex.eps' file I get $ ps2pdf ex.eps Unrecoverable error: undefined in quit Operand stack: --nostringval-- begin Interesting thing it that 'ps2pdf' script creates PDF file but wrong dimension. ghostscript version: compiled from GIT, latest commit: commit 062f4b4536b7b3fa1742e31c05dc57fe241d6690 Author: Chris Liddell <chris.liddell@artifex.com> Date: Wed Aug 13 20:33:36 2014 +0100 Bug 695423: follow up. Fix the description comments. No cluster differences
Created attachment 11112 [details] Simple EPS file to test 'ps2pdf' script
This patch breaks "quit" apparently. With the patch (commit 4fc4b84) it also causes bug 695240. Clearly this needs further work.
Is "quit" not stored in systemdict, then? That would seem... er, odd....
(In reply to Chris Liddell from comment #8) > Is "quit" not stored in systemdict, then? That would seem... er, odd.... It is, but apparently systemdict is not open, or something. If I do 'systemdict /quit get exec' then it works. If I simply do 'quit'. then it gives me an 'undefined' error. I is also the cause of the strange 'undefined' error in #695240. Perhaps the name table is broken in some way ?
Because this breaks '-o' and makes it difficult to close the interpreter interactively as well as causing spurious errors in ps2pdf and with at least some pdfwrite configurations, I've chosen to revert the patch. This is done in commit 1db534ed2b1277b265652d4b660b11e957a3e0bf
Fixed (fully) in: http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=a7e8f759