From: Chris Liddell Date: Mon, 16 Oct 2023 16:49:40 +0100 Subject: Bug 707264: Fix tiffsep(1) requirement for seekable output files Origin: https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=5d2da96e81c7455338302c71a291088a8396245a Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2023-46751 In the device initialization redesign, tiffsep and tiffsep1 lost the requirement for the output files to be seekable. Fixing that highlighted a problem with the error handling in gdev_prn_open_printer_seekable() where closing the erroring file would leave a dangling pointer, and lead to a crash. --- base/gdevprn.c | 1 + devices/gdevtsep.c | 1 + 2 files changed, 2 insertions(+) diff --git a/base/gdevprn.c b/base/gdevprn.c index 0491a3c6c77b..03363238758b 100644 --- a/base/gdevprn.c +++ b/base/gdevprn.c @@ -1271,6 +1271,7 @@ gdev_prn_open_printer_seekable(gx_device *pdev, bool binary_mode, && !IS_LIBCTX_STDERR(pdev->memory, gp_get_file(ppdev->file))) { code = gx_device_close_output_file(pdev, ppdev->fname, ppdev->file); + ppdev->file = NULL; if (code < 0) return code; } diff --git a/devices/gdevtsep.c b/devices/gdevtsep.c index 7fd3c551843f..f7a1b174b101 100644 --- a/devices/gdevtsep.c +++ b/devices/gdevtsep.c @@ -737,6 +737,7 @@ tiffsep_initialize_device_procs(gx_device *dev) { gdev_prn_initialize_device_procs(dev); + set_dev_proc(dev, output_page, gdev_prn_output_page_seekable); set_dev_proc(dev, open_device, tiffsep_prn_open); set_dev_proc(dev, close_device, tiffsep_prn_close); set_dev_proc(dev, map_color_rgb, tiffsep_decode_color); -- 2.43.0