From aeb5563228be1922855be10aaf910541ac0a1e11 Mon Sep 17 00:00:00 2001
From: fan <2018302070250@whu.edu.cn>
Date: Fri, 24 Nov 2023 07:21:27 +0000
Subject: [PATCH] repair CVE-2020-21710

Signed-off-by: fan <2018302070250@whu.edu.cn>
---
 devices/gdevepsn.c | 20 +++++++++++++++-----
 1 file changed, 15 insertions(+), 5 deletions(-)

diff --git a/devices/gdevepsn.c b/devices/gdevepsn.c
index 49faaf3..2f0ae03 100644
--- a/devices/gdevepsn.c
+++ b/devices/gdevepsn.c
@@ -159,10 +159,10 @@ eps_print_page(gx_device_printer *pdev, gp_file *prn_stream, int y_9pin_high,
         int line_size = gdev_mem_bytes_per_scan_line((gx_device *)pdev);
         /* Note that in_size is a multiple of 8. */
         int in_size = line_size * (8 * in_y_mult);
-        byte *buf1 = (byte *)gs_malloc(pdev->memory, in_size, 1, "eps_print_page(buf1)");
-        byte *buf2 = (byte *)gs_malloc(pdev->memory, in_size, 1, "eps_print_page(buf2)");
-        byte *in = buf1;
-        byte *out = buf2;
+        byte *buf1;
+        byte *buf2;
+        byte *in;
+        byte *out;
         int out_y_mult = (y_24pin ? 3 : 1);
         int x_dpi = (int)pdev->x_pixels_per_inch;
         char start_graphics =
@@ -174,7 +174,17 @@ eps_print_page(gx_device_printer *pdev, gp_file *prn_stream, int y_9pin_high,
         int bytes_per_space = dots_per_space * out_y_mult;
         int tab_min_pixels = x_dpi * MIN_TAB_10THS / 10;
         int skip = 0, lnum = 0, pass, ypass;
-
+   
+        if (bytes_per_space == 0) {
+            /* This avoids divide by zero later on, bug 701843. */
+            return_error(gs_error_rangecheck);
+        }
+        
+        buf1 = (byte *)gs_malloc(pdev->memory, in_size, 1, "eps_print_page(buf1)");
+        buf2 = (byte *)gs_malloc(pdev->memory, in_size, 1, "eps_print_page(buf2)");
+        in = buf1;
+        out = buf2;
+        
         /* Check allocations */
         if ( buf1 == 0 || buf2 == 0 )
         {	if ( buf1 )
-- 
Gitee