From 0b74e344c7b39f39a088e0fd0a02dc0b8fc435bf Mon Sep 17 00:00:00 2001 From: tlits Date: Tue, 5 Dec 2023 16:59:41 +0800 Subject: [PATCH] =?UTF-8?q?CVE-2020-16297=20=E5=AE=89=E5=85=A8=E6=9B=B4?= =?UTF-8?q?=E6=96=B0=EF=BC=9A=E4=BF=AE=E5=A4=8DArtifex=20Software=20Ghosts?= =?UTF-8?q?cript=20v9.50=E7=89=88=E6=9C=AC=E4=B8=AD=E7=9A=84contrib/gdevbj?= =?UTF-8?q?ca.c=E6=96=87=E4=BB=B6=E7=9A=84FloydSteinbergDitheringC()?= =?UTF-8?q?=E5=AD=98=E5=9C=A8=E7=BC=93=E5=86=B2=E5=8C=BA=E9=94=99=E8=AF=AF?= =?UTF-8?q?=E6=BC=8F=E6=B4=9E=E3=80=82?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- contrib/gdevbjca.c | 36 ++++++++++++++++++++++-------------- 1 file changed, 22 insertions(+), 14 deletions(-) diff --git a/contrib/gdevbjca.c b/contrib/gdevbjca.c index a023f0e..3573f55 100644 --- a/contrib/gdevbjca.c +++ b/contrib/gdevbjca.c @@ -342,12 +342,14 @@ bjc_compress(const byte *row, uint raster, byte *compressed) register byte test, test2; test = *exam; - while ( exam < end_row ) { - test2 = *++exam; + while ( ++exam < end_row ) { + test2 = *exam; if ( test == test2 ) break; test = test2; } + /* exam points to the byte that didn't match, or end_row + * if we ran out of data. */ /* Find out how long the run is */ end_dis = exam - 1; @@ -655,12 +657,15 @@ FloydSteinbergDitheringC(gx_device_bjc_printer *dev, for( i=width; i>0; i--, row+=4, err_vect+=3) { /*separate components */ /* C + K */ - err_corrC = dev->bjc_gamma_tableC[ (*row) + (*(row+3))] - + dev->FloydSteinbergC; - err_corrM = dev->bjc_gamma_tableM[(*(row+1)) + (*(row+3))] - + dev->FloydSteinbergM; - err_corrY = dev->bjc_gamma_tableY[(*(row+2)) + (*(row+3))] - + dev->FloydSteinbergY; + int v = row[0] + row[3]; + if (v > 255) v = 255; + err_corrC = dev->bjc_gamma_tableC[v] + dev->FloydSteinbergC; + v = row[1] + row[3]; + if (v > 255) v = 255; + err_corrM = dev->bjc_gamma_tableM[v] + dev->FloydSteinbergM; + v = row[2] + row[3]; + if (v > 255) v = 255; + err_corrY = dev->bjc_gamma_tableY[v] + dev->FloydSteinbergY; if(err_corrC > 4080 && limit_extr) err_corrC = 4080; if(err_corrM > 4080 && limit_extr) err_corrM = 4080; @@ -751,12 +756,15 @@ FloydSteinbergDitheringC(gx_device_bjc_printer *dev, for( i=width; i>0; i--, row-=4, err_vect-=3) { - err_corrC = dev->bjc_gamma_tableC[ (*row) + (*(row+3))] - + dev->FloydSteinbergC; - err_corrM = dev->bjc_gamma_tableM[(*(row+1)) + (*(row+3))] - + dev->FloydSteinbergM; - err_corrY = dev->bjc_gamma_tableY[(*(row+2)) + (*(row+3))] - + dev->FloydSteinbergY; + int v = row[0] + row[3]; + if (v > 255) v = 255; + err_corrC = dev->bjc_gamma_tableC[v] + dev->FloydSteinbergC; + v = row[1] + row[3]; + if (v > 255) v = 255; + err_corrM = dev->bjc_gamma_tableM[v] + dev->FloydSteinbergM; + v = row[2] + row[3]; + if (v > 255) v = 255; + err_corrY = dev->bjc_gamma_tableY[v] + dev->FloydSteinbergY; if(err_corrC > 4080 && limit_extr) err_corrC = 4080; if(err_corrM > 4080 && limit_extr) err_corrM = 4080; -- Gitee