diff options
| author | Ray Johnston <ray.johnston@artifex.com> | 2009-07-08 06:02:40 +0000 |
|---|---|---|
| committer | Ray Johnston <ray.johnston@artifex.com> | 2009-07-08 06:02:40 +0000 |
| commit | 83416429ec67c617dbde1bbcb4ee88fb3ce38a78 (patch) | |
| tree | 6ff3ddd4f29cd8c0a3b5c9cffb078753f38e9f07 | |
| parent | eaca5e4d109be45e002bbafbb4b422c8544095a0 (diff) | |
Fix for segfault caused by dereference of a stale pointer (pgs->dev_color).
Bug 690519 detected with pkmraw during regression testing.
DETAILS:
If a GC was run during a pattern accum in the PS interpreter, the pgs->dev_color
structure could be moved. This was not tracked, probably because the dev_color
was assumed to be "dynamic". The fix performs gx_unset_dev_color during the
pattern_paint_cleanup (in zpcolor.c). This minimal change is all that is needed
since only the PS interpreter runs a "real" GC that moves structures.
EXPECTED DIFFERENCES:
PP0001G0.pdf pkmraw, 300 dpi (the file that segfaulted)
git-svn-id: http://svn.ghostscript.com/ghostscript/trunk@9846 a1074d23-0009-0410-80fe-cf8c14f379e6
| -rw-r--r-- | gs/psi/zpcolor.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/gs/psi/zpcolor.c b/gs/psi/zpcolor.c index c6b87b480..1215bdeb3 100644 --- a/gs/psi/zpcolor.c +++ b/gs/psi/zpcolor.c @@ -331,6 +331,7 @@ pattern_paint_cleanup(i_ctx_t *i_ctx_p) (*dev_proc(pdev, close_device)) ((gx_device *) pdev); } code = gs_grestore(igs); + gx_unset_dev_color(igs); /* dev_color may need updating if GC ran */ if (pdev == NULL) { gx_device *cdev = gs_currentdevice_inline(igs); int code1 = dev_proc(cdev, pattern_manage)(cdev, gx_no_bitmap_id, NULL, |