[gs-bugs] [Bug 698773] - Ghostscript - crash by spool file

[b***@artifex.com]

http://bugs.ghostscript.com/show_bug.cgi?id=698773

Bug ID: 698773
Summary: crash by spool file
Product: Ghostscript
Version: 9.22
Hardware: PC
OS: Windows 7
Status: UNCONFIRMED
Severity: normal
Priority: P4
Component: Client API
Assignee: ghostpdl-***@artifex.com
Reporter: ***@sohu.com
QA Contact: gs-***@ghostscript.com
Word Size: ---

[b***@artifex.com]

http://bugs.ghostscript.com/show_bug.cgi?id=698773

--- Comment #1 from aaa9452604 <***@sohu.com> ---
Created attachment 14487
--> http://bugs.ghostscript.com/attachment.cgi?id=14487&action=edit
the spool file is producted by using Adobe PDF driver (print the testpage)

crashed
gswin32.exe is also crashed.

[b***@artifex.com]

http://bugs.ghostscript.com/show_bug.cgi?id=698773

aaa9452604 <***@sohu.com> changed:

What |Removed |Added
----------------------------------------------------------------------------
Severity|normal |critical

[b***@artifex.com]

http://bugs.ghostscript.com/show_bug.cgi?id=698773

aaa9452604 <***@sohu.com> changed:

What |Removed |Added
----------------------------------------------------------------------------
Summary|crash by spool file |crashed by spool file

[b***@artifex.com]

http://bugs.ghostscript.com/show_bug.cgi?id=698773

Chris Liddell (chrisl) <***@artifex.com> changed:

What |Removed |Added
----------------------------------------------------------------------------
CC| |***@artifex.com
Severity|critical |normal

[b***@artifex.com]

http://bugs.ghostscript.com/show_bug.cgi?id=698773

Ken Sharp <***@artifex.com> changed:

What |Removed |Added
----------------------------------------------------------------------------
Component|Client API |Font API
Assignee|ghostpdl-***@artifex.com |***@artifex.com

--- Comment #2 from Ken Sharp <***@artifex.com> ---
For me this results in a GPF in decode_bytes() because byte *s has the value
0x03 which is of course invalid.

It looks like we are treating an integer value as a string. The result of

if (dict_find(CharStrings, &char_name, &glyph) <= 0) {

at line 1190 in zfapi.c. The object being returned appears to be an integer
(3).

NB please give the Ghostscript command line being used, when reporting bugs. In
this case, fortunately, it doesn't matter but it often does.

[b***@artifex.com]

http://bugs.ghostscript.com/show_bug.cgi?id=698773

Chris Liddell (chrisl) <***@artifex.com> changed:

What |Removed |Added
----------------------------------------------------------------------------
Status|UNCONFIRMED |RESOLVED
Resolution|--- |FIXED

--- Comment #3 from Chris Liddell (chrisl) <***@artifex.com> ---
Fixed in:
http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=3ad236df1e