[gs-cvs] rev 7130 - trunk/gs/src

[raph at ghostscript.com]

Author: raph
Date: 2006-10-26 16:10:05 -0700 (Thu, 26 Oct 2006)
New Revision: 7130

Modified:
   trunk/gs/src/gsdsrc.c
Log:
Fix: make out-of-bounds string DataSource reads return 0 bytes, rather 
than UMR. Spec calls for /rangecheck, but CPSI silently returns garbage. 
Improves 09-47B page 12 (focus on test 6), but exact match to CPSI is
probably not feasible.


Modified: trunk/gs/src/gsdsrc.c
===================================================================
--- trunk/gs/src/gsdsrc.c	2006-10-26 22:14:01 UTC (rev 7129)
+++ trunk/gs/src/gsdsrc.c	2006-10-26 23:10:05 UTC (rev 7130)
@@ -45,17 +45,29 @@
 RELOC_PTRS_END
 
 /* Access data from a string or a byte object. */
-/* Does *not* check bounds. */
+/* Does check bounds, and returns 0 data oob. Spec calls for rangecheck,
+   but CPSI implementation silently gives (bogus) data. */
 int
 data_source_access_string(const gs_data_source_t * psrc, ulong start,
 			  uint length, byte * buf, const byte ** ptr)
 {
     const byte *p = psrc->data.str.data + start;
 
-    if (ptr)
-	*ptr = p;
-    else
-	memcpy(buf, p, length);
+    if (start + length <= psrc->data.str.size) {
+	if (ptr)
+	    *ptr = p;
+	else
+	    memcpy(buf, p, length);
+    } else {
+	if (start < psrc->data.str.size) {
+	    uint oklen = psrc->data.str.size - start;
+	    memcpy(buf, p, oklen);
+	    memset(buf + oklen, 0, length - oklen);
+	} else {
+	    memset(buf, 0, length);
+	}
+	*ptr = buf;
+    }
     return 0;
 }
 /* access_bytes is identical to access_string, but has a different */