From 4ceaf92815302863a8c86fcfcf2347e0118dd3a5 Mon Sep 17 00:00:00 2001 From: Ray Johnston Date: Tue, 22 Sep 2020 13:10:04 -0700 Subject: [PATCH] Fix gp_file allocations to use thread_safe_memory. The gpmisc.c does allocations for gp_file objects and buffers used by gp_fprintf, as well as gp_validate_path_len. The helgrind run with -dBGPrint -dNumRenderingThreads=4 and PCL input showed up the gp_fprintf problem since the clist rendering would call gp_fprintf using the same allocator (PCL's chunk allocator which is non_gc_memory). The chunk allocator is intentionally not thread safe (for performance). Upstream-Status: Backport [https://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=4ceaf92815302863a8c86fcfcf2347e0118dd3a5] CVE: CVE-2023-36664 #Dependency Patch1 Signed-off-by: Vijay Anusuri --- base/gpmisc.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/base/gpmisc.c b/base/gpmisc.c index 34cd71f..c4fffae 100644 --- a/base/gpmisc.c +++ b/base/gpmisc.c @@ -435,7 +435,7 @@ generic_pwrite(gp_file *f, size_t count, gs_offset_t offset, const void *buf) gp_file *gp_file_alloc(gs_memory_t *mem, const gp_file_ops_t *prototype, size_t size, const char *cname) { - gp_file *file = (gp_file *)gs_alloc_bytes(mem->non_gc_memory, size, cname ? cname : "gp_file"); + gp_file *file = (gp_file *)gs_alloc_bytes(mem->thread_safe_memory, size, cname ? cname : "gp_file"); if (file == NULL) return NULL; @@ -449,7 +449,7 @@ gp_file *gp_file_alloc(gs_memory_t *mem, const gp_file_ops_t *prototype, size_t memset(((char *)file)+sizeof(*prototype), 0, size - sizeof(*prototype)); - file->memory = mem->non_gc_memory; + file->memory = mem->thread_safe_memory; return file; } @@ -1047,7 +1047,7 @@ gp_validate_path_len(const gs_memory_t *mem, prefix_len = 0; } rlen = len+1; - bufferfull = (char *)gs_alloc_bytes(mem->non_gc_memory, rlen + prefix_len, "gp_validate_path"); + bufferfull = (char *)gs_alloc_bytes(mem->thread_safe_memory, rlen + prefix_len, "gp_validate_path"); if (bufferfull == NULL) return gs_error_VMerror; @@ -1093,7 +1093,7 @@ gp_validate_path_len(const gs_memory_t *mem, break; } - gs_free_object(mem->non_gc_memory, bufferfull, "gp_validate_path"); + gs_free_object(mem->thread_safe_memory, bufferfull, "gp_validate_path"); #ifdef EACCES if (code == gs_error_invalidfileaccess) errno = EACCES; -- 2.25.1