[gs-cvs] rev 7116 - trunk/gs/src

[lpd at ghostscript.com]

Author: lpd
Date: 2006-10-22 10:58:51 -0700 (Sun, 22 Oct 2006)
New Revision: 7116

Modified:
   trunk/gs/src/ibnum.c
   trunk/gs/src/zupath.c
Log:
Fixes bug: the user path operators didn't check encoded user paths to make
sure that the operand string/array and operator string allowed read access.
Partially fixes a discrepancy in PS3 CET 13-29-3.


Modified: trunk/gs/src/ibnum.c
===================================================================
--- trunk/gs/src/ibnum.c	2006-10-21 22:38:11 UTC (rev 7115)
+++ trunk/gs/src/ibnum.c	2006-10-22 17:58:51 UTC (rev 7116)
@@ -16,6 +16,7 @@
 #include "math_.h"
 #include "memory_.h"
 #include "ghost.h"
+#include "opcheck.h"
 #include "ierrors.h"
 #include "stream.h"
 #include "ibnum.h"
@@ -34,12 +35,13 @@
 int
 num_array_format(const ref * op)
 {
+    int format;
+
     switch (r_type(op)) {
 	case t_string:
 	    {
 		/* Check that this is a legitimate encoded number string. */
 		const byte *bp = op->value.bytes;
-		int format;
 
 		if (r_size(op) < 4 || bp[0] != bt_num_array_value)
 		    return_error(e_typecheck);
@@ -49,15 +51,18 @@
 		    (r_size(op) - 4) / encoded_number_bytes(format)
 		    )
 		    return_error(e_rangecheck);
-		return format;
 	    }
+	    break;
 	case t_array:
 	case t_mixedarray:
 	case t_shortarray:
-	    return num_array;
+	    format = num_array;
+	    break;
 	default:
 	    return_error(e_typecheck);
     }
+    check_read(*op);
+    return format;
 }
 
 /* Get the number of elements in an encoded number array/string. */

Modified: trunk/gs/src/zupath.c
===================================================================
--- trunk/gs/src/zupath.c	2006-10-21 22:38:11 UTC (rev 7115)
+++ trunk/gs/src/zupath.c	2006-10-22 17:58:51 UTC (rev 7116)
@@ -591,6 +591,7 @@
 	if (code < 0)
 	    return code;
 	format = code;
+	check_read(opcodes);
 	opp = opcodes.value.bytes;
 	ocount = r_size(&opcodes);
 	while (ocount--) {