434e336
From 4f83478c88c2e05d6e8d79ca4557eb039354d2f3 Mon Sep 17 00:00:00 2001
434e336
From: Chris Liddell <chris.liddell@artifex.com>
434e336
Date: Thu, 27 Apr 2017 13:03:33 +0100
434e336
Subject: [PATCH 1/2] Bug 697799: have .eqproc check its parameters
434e336
434e336
The Ghostscript custom operator .eqproc was not check the number or type of
434e336
the parameters it was given.
434e336
---
434e336
 psi/zmisc3.c | 6 ++++++
434e336
 1 file changed, 6 insertions(+)
434e336
434e336
diff --git a/psi/zmisc3.c b/psi/zmisc3.c
434e336
index 54b3042..37293ff 100644
434e336
--- a/psi/zmisc3.c
434e336
+++ b/psi/zmisc3.c
434e336
@@ -56,6 +56,12 @@ zeqproc(i_ctx_t *i_ctx_p)
434e336
     ref2_t stack[MAX_DEPTH + 1];
434e336
     ref2_t *top = stack;
434e336
 
434e336
+    if (ref_stack_count(&o_stack) < 2)
434e336
+        return_error(gs_error_stackunderflow);
434e336
+    if (!r_is_array(op - 1) || !r_is_array(op)) {
434e336
+        return_error(gs_error_typecheck);
434e336
+    }
434e336
+
434e336
     make_array(&stack[0].proc1, 0, 1, op - 1);
434e336
     make_array(&stack[0].proc2, 0, 1, op);
434e336
     for (;;) {
434e336
-- 
434e336
2.9.3
434e336
434e336
434e336
From 04b37bbce174eed24edec7ad5b920eb93db4d47d Mon Sep 17 00:00:00 2001
434e336
From: Chris Liddell <chris.liddell@artifex.com>
434e336
Date: Thu, 27 Apr 2017 13:21:31 +0100
434e336
Subject: [PATCH 2/2] Bug 697799: have .rsdparams check its parameters
434e336
434e336
The Ghostscript internal operator .rsdparams wasn't checking the number or
434e336
type of the operands it was being passed. Do so.
434e336
---
434e336
 psi/zfrsd.c | 22 +++++++++++++++-------
434e336
 1 file changed, 15 insertions(+), 7 deletions(-)
434e336
434e336
diff --git a/psi/zfrsd.c b/psi/zfrsd.c
434e336
index 191107d..950588d 100644
434e336
--- a/psi/zfrsd.c
434e336
+++ b/psi/zfrsd.c
434e336
@@ -49,13 +49,20 @@ zrsdparams(i_ctx_t *i_ctx_p)
434e336
     ref *pFilter;
434e336
     ref *pDecodeParms;
434e336
     int Intent = 0;
434e336
-    bool AsyncRead;
434e336
+    bool AsyncRead = false;
434e336
     ref empty_array, filter1_array, parms1_array;
434e336
     uint i;
434e336
-    int code;
434e336
+    int code = 0;
434e336
+
434e336
+    if (ref_stack_count(&o_stack) < 1)
434e336
+        return_error(gs_error_stackunderflow);
434e336
+    if (!r_has_type(op, t_dictionary) && !r_has_type(op, t_null)) {
434e336
+        return_error(gs_error_typecheck);
434e336
+    }
434e336
 
434e336
     make_empty_array(&empty_array, a_readonly);
434e336
-    if (dict_find_string(op, "Filter", &pFilter) > 0) {
434e336
+    if (r_has_type(op, t_dictionary)
434e336
+        && dict_find_string(op, "Filter", &pFilter) > 0) {
434e336
         if (!r_is_array(pFilter)) {
434e336
             if (!r_has_type(pFilter, t_name))
434e336
                 return_error(gs_error_typecheck);
434e336
@@ -94,12 +101,13 @@ zrsdparams(i_ctx_t *i_ctx_p)
434e336
                 return_error(gs_error_typecheck);
434e336
         }
434e336
     }
434e336
-    code = dict_int_param(op, "Intent", 0, 3, 0, &Intent);
434e336
+    if (r_has_type(op, t_dictionary))
434e336
+        code = dict_int_param(op, "Intent", 0, 3, 0, &Intent);
434e336
     if (code < 0 && code != gs_error_rangecheck) /* out-of-range int is ok, use 0 */
434e336
         return code;
434e336
-    if ((code = dict_bool_param(op, "AsyncRead", false, &AsyncRead)) < 0
434e336
-        )
434e336
-        return code;
434e336
+    if (r_has_type(op, t_dictionary))
434e336
+        if ((code = dict_bool_param(op, "AsyncRead", false, &AsyncRead)) < 0)
434e336
+            return code;
434e336
     push(1);
434e336
     op[-1] = *pFilter;
434e336
     if (pDecodeParms)
434e336
-- 
434e336
2.9.3
434e336