[gs-bugs] [Bug 698616] - MuPDF - Page_textAsHtml function of mupdf_native.c returns corrupted output

[b***@artifex.com]

http://bugs.ghostscript.com/show_bug.cgi?id=698616

Bug ID: 698616
Summary: Page_textAsHtml function of mupdf_native.c returns
corrupted output
Product: MuPDF
Version: master
Hardware: All
OS: All
Status: UNCONFIRMED
Severity: normal
Priority: P4
Component: mupdf
Assignee: mupdf-***@artifex.com
Reporter: ***@telenet.be
QA Contact: gs-***@ghostscript.com
Word Size: ---

The function Page_textAsHtml from mupdf_native.c returns a byte array where the
beginning of the text is corrupt.

The reason for this corruption is because the buffer to create the java byte
array is being freed before it is used.

So the following code:

arr = (*env)->NewByteArray(env, (jsize)len);
fz_drop_buffer(ctx, buf);
if (!arr) return NULL;
(*env)->SetByteArrayRegion(env, arr, 0, (jsize)len, (jbyte *)data);

Needs to be:
arr = (*env)->NewByteArray(env, (jsize)len);
if (!arr)
{
fz_drop_buffer(ctx, buf);
return NULL;
}
(*env)->SetByteArrayRegion(env, arr, 0, (jsize)len, (jbyte *)data);
fz_drop_buffer(ctx, buf);

[b***@artifex.com]

http://bugs.ghostscript.com/show_bug.cgi?id=698616

***@telenet.be changed:

What |Removed |Added
----------------------------------------------------------------------------
CC| |***@telenet.be

[b***@artifex.com]

http://bugs.ghostscript.com/show_bug.cgi?id=698616

Robin Watts <***@artifex.com> changed:

What |Removed |Added
----------------------------------------------------------------------------
CC| |***@artifex.com
Resolution|--- |FIXED
Status|UNCONFIRMED |RESOLVED

--- Comment #1 from Robin Watts <***@artifex.com> ---
Fixed in:

commit 71a4291781e7db6f0ebdf18acb74ef290110c185
Author: Robin Watts <***@artifex.com>
Date: Wed Nov 8 15:28:47 2017 +0000

Bug 698616: Fix use after free in Page_textAsHtml

Thanks for the report!