source: branches/fc13-dev/server/common/patches/ghostscript-CVE-2010-1628.patch @ 1616

gs/psi/idosave.h

@@ -18 +18 @@
 #  define idosave_INCLUDED
 
 /*
+ * Structure for saved change chain for save/restore.  Because of the
+ * garbage collector, we need to distinguish the cases where the change
+ * is in a static object, a dynamic ref, or a dynamic struct.
+ */
+typedef struct alloc_change_s alloc_change_t;
+struct alloc_change_s {
+    alloc_change_t *next;
+    ref_packed *where;
+    ref contents;
+#define AC_OFFSET_STATIC (-2)   /* static object */
+#define AC_OFFSET_REF (-1)      /* dynamic ref */
+#define AC_OFFSET_ALLOCATED (-3) /* a newly allocated ref array */
+    short offset;               /* if >= 0, offset within struct */
+};
+
+/*
  * Save a change that must be undone by restore.  We have to pass the
  * pointer to the containing object to alloc_save_change for two reasons:
  *
@@ -29 +45 @@
  * relocate the pointer to it from the change record during garbage
  * collection.
  */
+
 int alloc_save_change(gs_dual_memory_t *dmem, const ref *pcont,
                       ref_packed *ptr, client_name_t cname);
 int alloc_save_change_in(gs_ref_memory_t *mem, const ref *pcont,
@@ -36 +53 @@
 /* Remove an AC_OFFSET_ALLOCATED element. */
 void alloc_save_remove(gs_ref_memory_t *mem, ref_packed *obj, client_name_t cname);
 /* Allocate a structure for recording an allocation event. */
-int alloc_save_change_alloc(gs_ref_memory_t *mem, client_name_t cname, ref_packed ***ppr);
+int alloc_save_change_alloc(gs_ref_memory_t *mem, client_name_t cname, alloc_change_t **pcp);
 
 #endif /* idosave_INCLUDED */

gs/psi/isave.c

@@ -156 +156 @@
 /* A link to igcref.c . */
 ptr_proc_reloc(igc_reloc_ref_ptr_nocheck, ref_packed);
 
-/*
- * Structure for saved change chain for save/restore.  Because of the
- * garbage collector, we need to distinguish the cases where the change
- * is in a static object, a dynamic ref, or a dynamic struct.
- */
-typedef struct alloc_change_s alloc_change_t;
-struct alloc_change_s {
-    alloc_change_t *next;
-    ref_packed *where;
-    ref contents;
-#define AC_OFFSET_STATIC (-2)   /* static object */
-#define AC_OFFSET_REF (-1)      /* dynamic ref */
-#define AC_OFFSET_ALLOCATED (-3) /* a newly allocated ref array */
-    short offset;               /* if >= 0, offset within struct */
-};
-
 static 
 CLEAR_MARKS_PROC(change_clear_marks)
 {
@@ -519 +503 @@
 
 /* Allocate a structure for recording an allocation event. */
 int
-alloc_save_change_alloc(gs_ref_memory_t *mem, client_name_t cname, ref_packed ***ppr)
+alloc_save_change_alloc(gs_ref_memory_t *mem, client_name_t cname, alloc_change_t **pcp)
 {
     register alloc_change_t *cp;
 
@@ -533 +517 @@
     cp->where = 0;
     cp->offset = AC_OFFSET_ALLOCATED;
     make_null(&cp->contents);
-    mem->changes = cp;
-    *ppr = &cp->where;
+    *pcp = cp;
     return 1;
 }
 

gs/psi/ialloc.c

@@ -185 +185 @@
          */
         chunk_t *pcc = mem->pcc;
         ref *end;
+        alloc_change_t *cp = 0;
+        int code = 0;
 
+        if ((gs_memory_t *)mem != mem->stable_memory) {
+            code = alloc_save_change_alloc(mem, "gs_alloc_ref_array", &cp);
+            if (code < 0)
+                return code;
+        }
         obj = gs_alloc_struct_array((gs_memory_t *) mem, num_refs + 1,
                                     ref, &st_refs, cname);
         if (obj == 0)
@@ -210 +217 @@
             chunk_locate_ptr(obj, &cl);
             cl.cp->has_refs = true;
         }
-        if ((gs_memory_t *)mem != mem->stable_memory) {
-            ref_packed **ppr = 0;
-            int code = alloc_save_change_alloc(mem, "gs_alloc_ref_array", &ppr);
-            if (code < 0)
-                return code;
-            if (ppr)
-                *ppr = (ref_packed *)obj;
-        }
+        if (cp) {
+            mem->changes = cp;
+            cp->where = (ref_packed *)obj;
+        }
     }
     make_array(parr, attrs | mem->space, num_refs, obj);
     return 0;