From a9181df87d78828318f2e9f8d4ea012bc06883b9 Mon Sep 17 00:00:00 2001
From: Bruno Victal <mirai@makinata.eu>
Date: Thu, 7 Sep 2023 16:51:23 +0100
Subject: [PATCH 3/3] Fix double-free when requesting MediaBox.
Explicitly close the Ghostscript PDF interpreter before calling quit.
References:
[1]: <https://bugs.ghostscript.com/show_bug.cgi?id=705855>
[2]: <https://bugs.ghostscript.com/show_bug.cgi?id=705836>
---
src/u_ghostscript.c | 13 ++++++++-----
1 file changed, 8 insertions(+), 5 deletions(-)
diff --git a/src/u_ghostscript.c b/src/u_ghostscript.c
index 5974b31..d14674f 100644
--- a/src/u_ghostscript.c
+++ b/src/u_ghostscript.c
@@ -317,10 +317,10 @@ gsexe(FILE **out, bool *isnew, char *exenew, char *exeold)
* Call ghostscript to extract the /MediaBox from the pdf given in file.
* Command line, for gs >= 9.50,
* gs -q -dNODISPLAY --permit-file-read=in.pdf -c \
- * "(in.pdf) (r) file runpdfbegin 1 pdfgetpage /MediaBox pget pop == quit"
+ * "(in.pdf) (r) file runpdfbegin 1 pdfgetpage /MediaBox pget pop == runpdfend quit"
* gs < 9.50:
* gs -q -dNODISPLAY -dNOSAFER -c \
- * "(in.pdf) (r) file runpdfbegin 1 pdfgetpage /MediaBox pget pop == quit"
+ * "(in.pdf) (r) file runpdfbegin 1 pdfgetpage /MediaBox pget pop == runpdfend quit"
* The command line was found, and modified a bit, at
*https://stackoverflow.com/questions/2943281/using-ghostscript-to-get-page-size
* Beginning with gs 9.50, "-dSAFER" is the default, and permission to access
@@ -349,9 +349,11 @@ gsexe_mediabox(char *file, int *llx, int *lly, int *urx, int *ury)
return -3;
exenew = "%s -q -dNODISPLAY \"--permit-file-read=%s\" -c \"(%s) (r) "
- "file runpdfbegin 1 pdfgetpage /MediaBox pget pop == quit\"";
+ "file runpdfbegin 1 pdfgetpage /MediaBox pget pop == "
+ "runpdfend quit\"";
exeold = "%s -q -dNODISPLAY -c \"(%s) (r) "
- "file runpdfbegin 1 pdfgetpage /MediaBox pget pop == quit\"";
+ "file runpdfbegin 1 pdfgetpage /MediaBox pget pop == "
+ "runpdfend quit\"";
/* malloc() buffers for the command line, if necessary */
fmt = exenew;
@@ -445,7 +447,8 @@ gslib_mediabox(char *file, int *llx, int *lly, int *urx, int *ury)
argnew[3] = "--permit-file-read=%s"; /* file */
argnew[4] = "-c";
argnew[5] =
- "(%s) (r) file runpdfbegin 1 pdfgetpage /MediaBox pget pop == quit";
+ "(%s) (r) file runpdfbegin 1 pdfgetpage /MediaBox pget pop == "
+ "runpdfend quit";
argold[0] = argnew[0];
argold[1] = argnew[1];
--
2.40.1
