Created attachment 13629 [details]
POC to trigger out of bounds read (gs)

After some fuzz testing I found a crashing test case.

Git Head: 04b37bbce174eed24edec7ad5b920eb93db4d47d

Command: gs -dNOPAUSE -sDEVICE=bit -sOUTPUTFILE=/dev/null -dSAFER gs_oobr_mark_line_tr -c quit

ASAN:

==14081==ERROR: AddressSanitizer: SEGV on unknown address 0x6311178a3868 (pc 0x00000192041c bp 0x62a00028a078 sp 0x7ffcdf457340 T0)
==14081==The signal is caused by a READ memory access.
    #0 0x192041b in mark_line_tr XYZ/ghostpdl/./base/gxscanc.c:2185:29
    #1 0x191f1b4 in gx_scan_convert_tr XYZ/ghostpdl/./base/gxscanc.c:2359:25
    #2 0x17a6513 in gx_general_fill_path XYZ/ghostpdl/./base/gxfill.c:482:24
    #3 0x17a6513 in gx_default_fill_path XYZ/ghostpdl/./base/gxfill.c:702
    #4 0x1839bf1 in gx_fill_path XYZ/ghostpdl/./base/gxpaint.c:52:12
    #5 0x1491e52 in do_fill XYZ/ghostpdl/./base/gspaint.c:319:12
    #6 0x1491e52 in fill_with_rule XYZ/ghostpdl/./base/gspaint.c:353
    #7 0x14ca8c8 in gs_fapi_finish_render XYZ/ghostpdl/./base/gxfapi.c:1066:24
    #8 0x14d4faa in gs_fapi_do_char XYZ/ghostpdl/./base/gxfapi.c:1682:16
    #9 0x1bc8fce in FAPI_char XYZ/ghostpdl/./psi/zfapi.c:2358:13
    #10 0x1a29dee in interp XYZ/ghostpdl/./psi/interp.c:1320:40
    #11 0x1a29dee in gs_call_interp XYZ/ghostpdl/./psi/interp.c:517
    #12 0x1a29dee in gs_interpret XYZ/ghostpdl/./psi/interp.c:474
    #13 0x19fcab2 in gs_main_interpret XYZ/ghostpdl/./psi/imain.c:247:12
    #14 0x19fcab2 in gs_main_run_string_end XYZ/ghostpdl/./psi/imain.c:665
    #15 0x19fcab2 in gs_main_run_string_with_length XYZ/ghostpdl/./psi/imain.c:623
    #16 0x1a08c1e in run_string XYZ/ghostpdl/./psi/imainarg.c:983:16
    #17 0x1a08c1e in runarg XYZ/ghostpdl/./psi/imainarg.c:973
    #18 0x1a08078 in argproc XYZ/ghostpdl/./psi/imainarg.c:906:16
    #19 0x1a00a93 in gs_main_init_with_args XYZ/ghostpdl/./psi/imainarg.c:238:24
    #20 0x547608 in main XYZ/ghostpdl/./psi/gs.c:96:16
    #21 0x7ffa44c6d82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #22 0x47ba38 in _start (/usr/local/bin/gs+0x47ba38)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV XYZ/ghostpdl/./base/gxscanc.c:2185:29 in mark_line_tr
==14081==ABORTING