source: trunk/server/common/patches/ghostscript-CVE-2010-1628.patch @ 1587

Index: gs/psi/idosave.h
===================================================================
--- gs/psi/idosave.h    (revision 11306)
+++ gs/psi/idosave.h    (working copy)
@@ -18,6 +18,22 @@
 #  define idosave_INCLUDED
 
 /*
+ * Structure for saved change chain for save/restore.  Because of the
+ * garbage collector, we need to distinguish the cases where the change
+ * is in a static object, a dynamic ref, or a dynamic struct.
+ */
+typedef struct alloc_change_s alloc_change_t;
+struct alloc_change_s {
+    alloc_change_t *next;
+    ref_packed *where;
+    ref contents;
+#define AC_OFFSET_STATIC (-2)  /* static object */
+#define AC_OFFSET_REF (-1)     /* dynamic ref */
+#define AC_OFFSET_ALLOCATED (-3) /* a newly allocated ref array */
+    short offset;              /* if >= 0, offset within struct */
+};
+
+/*
  * Save a change that must be undone by restore.  We have to pass the
  * pointer to the containing object to alloc_save_change for two reasons:
  *
@@ -29,6 +45,7 @@
  * relocate the pointer to it from the change record during garbage
  * collection.
  */
+
 int alloc_save_change(gs_dual_memory_t *dmem, const ref *pcont,
                      ref_packed *ptr, client_name_t cname);
 int alloc_save_change_in(gs_ref_memory_t *mem, const ref *pcont,
@@ -36,6 +53,6 @@
 /* Remove an AC_OFFSET_ALLOCATED element. */
 void alloc_save_remove(gs_ref_memory_t *mem, ref_packed *obj, client_name_t cname);
 /* Allocate a structure for recording an allocation event. */
-int alloc_save_change_alloc(gs_ref_memory_t *mem, client_name_t cname, ref_packed ***ppr);
+int alloc_save_change_alloc(gs_ref_memory_t *mem, client_name_t cname, alloc_change_t **pcp);
 
 #endif /* idosave_INCLUDED */
Index: gs/psi/isave.c
===================================================================
--- gs/psi/isave.c      (revision 11306)
+++ gs/psi/isave.c      (working copy)
@@ -156,22 +156,6 @@
 /* A link to igcref.c . */
 ptr_proc_reloc(igc_reloc_ref_ptr_nocheck, ref_packed);
 
-/*
- * Structure for saved change chain for save/restore.  Because of the
- * garbage collector, we need to distinguish the cases where the change
- * is in a static object, a dynamic ref, or a dynamic struct.
- */
-typedef struct alloc_change_s alloc_change_t;
-struct alloc_change_s {
-    alloc_change_t *next;
-    ref_packed *where;
-    ref contents;
-#define AC_OFFSET_STATIC (-2)  /* static object */
-#define AC_OFFSET_REF (-1)     /* dynamic ref */
-#define AC_OFFSET_ALLOCATED (-3) /* a newly allocated ref array */
-    short offset;              /* if >= 0, offset within struct */
-};
-
 static 
 CLEAR_MARKS_PROC(change_clear_marks)
 {
@@ -519,7 +503,7 @@
 
 /* Allocate a structure for recording an allocation event. */
 int
-alloc_save_change_alloc(gs_ref_memory_t *mem, client_name_t cname, ref_packed ***ppr)
+alloc_save_change_alloc(gs_ref_memory_t *mem, client_name_t cname, alloc_change_t **pcp)
 {
     register alloc_change_t *cp;
 
@@ -533,8 +517,7 @@
     cp->where = 0;
     cp->offset = AC_OFFSET_ALLOCATED;
     make_null(&cp->contents);
-    mem->changes = cp;
-    *ppr = &cp->where;
+    *pcp = cp;
     return 1;
 }
 
Index: gs/psi/ialloc.c
===================================================================
--- gs/psi/ialloc.c     (revision 11306)
+++ gs/psi/ialloc.c     (working copy)
@@ -185,7 +185,14 @@
         */
        chunk_t *pcc = mem->pcc;
        ref *end;
+       alloc_change_t *cp = 0;
+        int code = 0;
 
+       if ((gs_memory_t *)mem != mem->stable_memory) {
+           code = alloc_save_change_alloc(mem, "gs_alloc_ref_array", &cp);
+           if (code < 0)
+               return code;
+       }
        obj = gs_alloc_struct_array((gs_memory_t *) mem, num_refs + 1,
                                    ref, &st_refs, cname);
        if (obj == 0)
@@ -210,14 +217,10 @@
            chunk_locate_ptr(obj, &cl);
            cl.cp->has_refs = true;
        }
-       if ((gs_memory_t *)mem != mem->stable_memory) {
-           ref_packed **ppr = 0;
-           int code = alloc_save_change_alloc(mem, "gs_alloc_ref_array", &ppr);
-           if (code < 0)
-               return code;
-            if (ppr)
-               *ppr = (ref_packed *)obj;
-       }
+       if (cp) {
+            mem->changes = cp;
+            cp->where = (ref_packed *)obj;
+        }
     }
     make_array(parr, attrs | mem->space, num_refs, obj);
     return 0;