File CVE-2016-9601.patch of Package ghostscript-mini

Overview Repositories Revisions Requests Users Attributes Meta

File CVE-2016-9601.patch of Package ghostscript-mini (Revision c6038a2a08da75c1bd0f005aad0a1b2a)

Currently displaying revision c6038a2a08da75c1bd0f005aad0a1b2a , Show latest

From e698d5c11d27212aa1098bc5b1673a3378563092 Mon Sep 17 00:00:00 2001
From: Robin Watts <robin.watts@artifex.com>
Date: Mon, 12 Dec 2016 17:47:17 +0000
Subject: [PATCH] Squash signed/unsigned warnings in MSVC jbig2 build.

diff --git a/jbig2dec/jbig2.c b/jbig2dec/jbig2.c
index deda676..54a19c9 100644
--- a/jbig2dec/jbig2.c
+++ b/jbig2dec/jbig2.c
@@ -434,7 +434,7 @@ typedef struct {
 } Jbig2WordStreamBuf;
 
 static int
-jbig2_word_stream_buf_get_next_word(Jbig2WordStream *self, int offset,
+jbig2_word_stream_buf_get_next_word(Jbig2WordStream *self, size_t offset,
   uint32_t *word)
 {
   Jbig2WordStreamBuf *z = (Jbig2WordStreamBuf *)self;
@@ -448,7 +448,7 @@ jbig2_word_stream_buf_get_next_word(Jbig2WordStream *self, int offset,
     return -1;
   else
     {
-      int i;
+      size_t i;
 
       result = 0;
       for (i = 0; i < z->size - offset; i++)
diff --git a/jbig2dec/jbig2.h b/jbig2dec/jbig2.h
index 2714e17..626603d 100644
--- a/jbig2dec/jbig2.h
+++ b/jbig2dec/jbig2.h
@@ -71,18 +71,20 @@ typedef struct _Jbig2SymbolDictionary Jbig2SymbolDictionary;
 */
 
 struct _Jbig2Image {
-        int             width, height, stride;
+        uint32_t             width;
+    uint32_t height;
+    uint32_t stride;
         uint8_t        *data;
 	int		refcount;
 };
 
-Jbig2Image*     jbig2_image_new(Jbig2Ctx *ctx, int width, int height);
+Jbig2Image*     jbig2_image_new(Jbig2Ctx *ctx, uint32_t width, uint32_t height);
 Jbig2Image*	jbig2_image_clone(Jbig2Ctx *ctx, Jbig2Image *image);
 void		jbig2_image_release(Jbig2Ctx *ctx, Jbig2Image *image);
 void            jbig2_image_free(Jbig2Ctx *ctx, Jbig2Image *image);
 void		jbig2_image_clear(Jbig2Ctx *ctx, Jbig2Image *image, int value);
 Jbig2Image	*jbig2_image_resize(Jbig2Ctx *ctx, Jbig2Image *image,
-                                int width, int height);
+                                uint32_t width, uint32_t height);
 
 /* errors are returned from the library via a callback. If no callback
    is provided (a NULL argument is passed ot jbig2_ctx_new) a default
diff --git a/jbig2dec/jbig2_generic.c b/jbig2dec/jbig2_generic.c
index 1add900..7a37507 100644
--- a/jbig2dec/jbig2_generic.c
+++ b/jbig2dec/jbig2_generic.c
@@ -824,7 +824,7 @@ jbig2_immediate_generic_region(Jbig2Ctx *ctx, Jbig2Segment *segment,
   byte seg_flags;
   int8_t gbat[8];
   int offset;
-  int gbat_bytes = 0;
+    uint32_t gbat_bytes = 0;
   Jbig2GenericRegionParams params;
   int code = 0;
   Jbig2Image *image = NULL;
diff --git a/jbig2dec/jbig2_halftone.c b/jbig2dec/jbig2_halftone.c
index 48d095a..eedbbc8 100644
--- a/jbig2dec/jbig2_halftone.c
+++ b/jbig2dec/jbig2_halftone.c
@@ -284,8 +284,8 @@ jbig2_decode_gray_scale_image(Jbig2Ctx *ctx, Jbig2Segment* segment,
 {
   uint8_t **GSVALS = NULL;
   size_t consumed_bytes = 0;
-  int i, j, code, stride;
-  int x, y;
+    uint32_t i, j, stride, x, y;
+    int code;
   Jbig2Image **GSPLANES;
   Jbig2GenericRegionParams rparams;
   Jbig2WordStream *ws = NULL;
@@ -305,8 +305,8 @@ jbig2_decode_gray_scale_image(Jbig2Ctx *ctx, Jbig2Segment* segment,
       jbig2_error(ctx, JBIG2_SEVERITY_FATAL, segment->number,
                   "failed to allocate %dx%d image for GSPLANES", GSW, GSH);
       /* free already allocated */
-      for (j = i-1; j >= 0; --j) {
-        jbig2_image_release(ctx, GSPLANES[j]);
+      for (j = i; j > 0;) {
+        jbig2_image_release(ctx, GSPLANES[--j]);
       }
       jbig2_free(ctx->allocator, GSPLANES);
       return NULL;
@@ -359,9 +359,10 @@ jbig2_decode_gray_scale_image(Jbig2Ctx *ctx, Jbig2Segment* segment,
   }
 
   /* C.5 step 2. Set j = GSBPP-2 */ 
-  j = GSBPP - 2;
+  j = GSBPP - 1;
   /* C.5 step 3. decode loop */ 
-  while(j >= 0) {
+  while(j > 0) {
+    j--;
     /*  C.5 step 3. (a) */
     if (GSMMR) {
       code = jbig2_decode_halftone_mmr(ctx, &rparams, data + consumed_bytes,
@@ -385,7 +386,6 @@ jbig2_decode_gray_scale_image(Jbig2Ctx *ctx, Jbig2Segment* segment,
       GSPLANES[j]->data[i] ^= GSPLANES[j+1]->data[i];
 
     /*  C.5 step 3. (c) */
-    --j;
   }
 
   /* allocate GSVALS */
@@ -401,8 +401,8 @@ jbig2_decode_gray_scale_image(Jbig2Ctx *ctx, Jbig2Segment* segment,
       jbig2_error(ctx, JBIG2_SEVERITY_FATAL, segment->number,
                   "failed to allocate GSVALS: %d bytes", GSH * GSW);
       /* free already allocated */
-      for (j = i-1; j >= 0; --j) {
-        jbig2_free(ctx->allocator, GSVALS[j]);
+      for (j = i; j > 0;) {
+        jbig2_free(ctx->allocator, GSVALS[--j]);
       }
       jbig2_free(ctx->allocator, GSVALS);
       GSVALS = NULL;
@@ -495,7 +495,7 @@ jbig2_decode_halftone_region(Jbig2Ctx *ctx, Jbig2Segment *segment,
   uint8_t **GI;
   Jbig2Image *HSKIP = NULL;
   Jbig2PatternDict * HPATS;
-  int i;
+  uint32_t i;
   uint32_t mg, ng;
   int32_t x, y;
   uint8_t gray_val;
@@ -523,7 +523,7 @@ jbig2_decode_halftone_region(Jbig2Ctx *ctx, Jbig2Segment *segment,
 
   /* calculate ceil(log2(HNUMPATS)) */
   HBPP = 0; 
-  while(HNUMPATS > (1 << ++HBPP));
+  while(HNUMPATS > (1U << ++HBPP));
 
   /* 6.6.5 point 4. decode gray-scale image as mentioned in annex C */
   GI = jbig2_decode_gray_scale_image(ctx, segment, data, size,
diff --git a/jbig2dec/jbig2_huffman.c b/jbig2dec/jbig2_huffman.c
index 38efb99..4ba45c6 100644
--- a/jbig2dec/jbig2_huffman.c
+++ b/jbig2dec/jbig2_huffman.c
@@ -50,9 +50,9 @@ struct _Jbig2HuffmanState {
      is (offset + 4) * 8. */
   uint32_t this_word;
   uint32_t next_word;
-  int offset_bits;
-  int offset;
-  int offset_limit;
+  uint32_t offset_bits;
+  uint32_t offset;
+  uint32_t offset_limit;
 
   Jbig2WordStream *ws;
   Jbig2Ctx *ctx;
@@ -60,7 +60,7 @@ struct _Jbig2HuffmanState {
 
 
 static uint32_t
-huff_get_next_word(Jbig2HuffmanState *hs, int offset)
+huff_get_next_word(Jbig2HuffmanState *hs, uint32_t offset)
 {
   uint32_t word = 0;
   Jbig2WordStream *ws = hs->ws;
@@ -215,7 +215,7 @@ void jbig2_huffman_advance(Jbig2HuffmanState *hs, int offset)
 /* return the offset of the huffman decode pointer (in bytes)
  * from the beginning of the WordStream
  */
-int
+uint32_t
 jbig2_huffman_offset(Jbig2HuffmanState *hs)
 {
   return hs->offset + (hs->offset_bits >> 3);
diff --git a/jbig2dec/jbig2_huffman.h b/jbig2dec/jbig2_huffman.h
index 2e2fdec..303b622 100644
--- a/jbig2dec/jbig2_huffman.h
+++ b/jbig2dec/jbig2_huffman.h
@@ -68,7 +68,7 @@ jbig2_huffman_skip(Jbig2HuffmanState *hs);
 
 void jbig2_huffman_advance(Jbig2HuffmanState *hs, int offset);
 
-int
+uint32_t
 jbig2_huffman_offset(Jbig2HuffmanState *hs);
 
 int32_t
diff --git a/jbig2dec/jbig2_image.c b/jbig2dec/jbig2_image.c
index b21bbea..ef7239a 100644
--- a/jbig2dec/jbig2_image.c
+++ b/jbig2dec/jbig2_image.c
@@ -33,10 +33,10 @@
 
 
 /* allocate a Jbig2Image structure and its associated bitmap */
-Jbig2Image* jbig2_image_new(Jbig2Ctx *ctx, int width, int height)
+Jbig2Image* jbig2_image_new(Jbig2Ctx *ctx, uint32_t width, uint32_t height)
 {
 	Jbig2Image	*image;
-	int		stride;
+	uint32_t		stride;
         int64_t         check;
 
 	image = jbig2_new(ctx, Jbig2Image, 1);
@@ -102,7 +102,7 @@ void jbig2_image_free(Jbig2Ctx *ctx, Jbig2Image *image)
 
 /* resize a Jbig2Image */
 Jbig2Image *jbig2_image_resize(Jbig2Ctx *ctx, Jbig2Image *image,
-				int width, int height)
+				uint32_t width, uint32_t height)
 {
 	if (width == image->width) {
             /* check for integer multiplication overflow */
@@ -142,11 +142,11 @@ int jbig2_image_compose_unopt(Jbig2Ctx *ctx,
 			Jbig2Image *dst, Jbig2Image *src,
                         int x, int y, Jbig2ComposeOp op)
 {
-    int i, j;
-    int sw = src->width;
-    int sh = src->height;
-    int sx = 0;
-    int sy = 0;
+    uint32_t i, j;
+    uint32_t sw = src->width;
+    uint32_t sh = src->height;
+    uint32_t sx = 0;
+    uint32_t sy = 0;
 
     /* clip to the dst image boundaries */
     if (x < 0) { sx += -x; sw -= -x; x = 0; }
@@ -208,10 +208,10 @@ int jbig2_image_compose_unopt(Jbig2Ctx *ctx,
 int jbig2_image_compose(Jbig2Ctx *ctx, Jbig2Image *dst, Jbig2Image *src,
 			int x, int y, Jbig2ComposeOp op)
 {
-    int i, j;
-    int w, h;
-    int leftbyte, rightbyte;
-    int shift;
+    uint32_t i, j;
+    uint32_t w, h;
+    uint32_t leftbyte, rightbyte;
+    uint32_t shift;
     uint8_t *s, *ss;
     uint8_t *d, *dd;
     uint8_t mask, rightmask;
@@ -228,8 +228,8 @@ int jbig2_image_compose(Jbig2Ctx *ctx, Jbig2Image *dst, Jbig2Image *src,
 
     if (x < 0) { w += x; x = 0; }
     if (y < 0) { h += y; y = 0; }
-    w = (x + w < dst->width) ? w : dst->width - x;
-    h = (y + h < dst->height) ? h : dst->height - y;
+    w = ((uint32_t)x + w < dst->width) ? w : ((dst->width >= (uint32_t)x) ? dst->width - (uint32_t)x : 0);
+    h = ((uint32_t)y + h < dst->height) ? h : ((dst->height >= (uint32_t)y) ? dst->height - (uint32_t)y : 0);
 #ifdef JBIG2_DEBUG
     jbig2_error(ctx, JBIG2_SEVERITY_DEBUG, -1,
       "compositing %dx%d at (%d, %d) after clipping\n",
@@ -255,8 +255,8 @@ int jbig2_image_compose(Jbig2Ctx *ctx, Jbig2Image *dst, Jbig2Image *src,
     }
 #endif
 
-    leftbyte = x >> 3;
-    rightbyte = (x + w - 1) >> 3;
+    leftbyte = (uint32_t)x >> 3;
+    rightbyte = ((uint32_t)x + w - 1) >> 3;
     shift = x & 7;
 
     /* general OR case */
diff --git a/jbig2dec/jbig2_mmr.c b/jbig2dec/jbig2_mmr.c
index cd7b061..14d9579 100644
--- a/jbig2dec/jbig2_mmr.c
+++ b/jbig2dec/jbig2_mmr.c
@@ -39,20 +39,21 @@
 #include "jbig2_mmr.h"
 
 typedef struct {
-	int width;
-	int height;
+	uint32_t width;
+	uint32_t height;
 	const byte *data;
 	size_t size;
-	int data_index;
-	int bit_index;
+	uint32_t data_index;
+	uint32_t bit_index;
 	uint32_t word;
 } Jbig2MmrCtx;
 
+#define MINUS1 ((uint32_t)-1)
 
 static void
 jbig2_decode_mmr_init(Jbig2MmrCtx *mmr, int width, int height, const byte *data, size_t size)
 {
-	int i;
+	size_t i;
 	uint32_t word = 0;
 
 	mmr->width = width;
@@ -734,14 +735,14 @@ const mmr_table_node jbig2_mmr_black_decode[] = {
 #define getbit(buf, x) ( ( buf[x >> 3] >> ( 7 - (x & 7) ) ) & 1 )
 
 static int
-jbig2_find_changing_element(const byte *line, int x, int w)
+jbig2_find_changing_element(const byte *line, uint32_t x, uint32_t w)
 {
 	int a, b;
 
 	if (line == 0)
-		return w;
+        return (int)w;
 
-	if (x == -1) {
+    if (x == MINUS1) {
 		a = 0;
 		x = 0;
 	}
@@ -761,7 +762,7 @@ jbig2_find_changing_element(const byte *line, int x, int w)
 }
 
 static int
-jbig2_find_changing_element_of_color(const byte *line, int x, int w, int color)
+jbig2_find_changing_element_of_color(const byte *line, uint32_t x, uint32_t w, int color)
 {
 	if (line == 0)
 		return w;
@@ -775,9 +776,9 @@ static const byte lm[8] = { 0xFF, 0x7F, 0x3F, 0x1F, 0x0F, 0x07, 0x03, 0x01 };
 static const byte rm[8] = { 0x00, 0x80, 0xC0, 0xE0, 0xF0, 0xF8, 0xFC, 0xFE };
 
 static void
-jbig2_set_bits(byte *line, int x0, int x1)
+jbig2_set_bits(byte *line, uint32_t x0, uint32_t x1)
 {
-	int a0, a1, b0, b1, a;
+    uint32_t a0, a1, b0, b1, a;
 
 	a0 = x0 >> 3;
 	a1 = x1 >> 3;
@@ -834,8 +835,8 @@ jbig2_decode_get_run(Jbig2MmrCtx *mmr, const mmr_table_node *table, int initial_
 static int
 jbig2_decode_mmr_line(Jbig2MmrCtx *mmr, const byte *ref, byte *dst)
 {
-	int a0 = -1;
-	int a1, a2, b1, b2;
+    uint32_t a0 = MINUS1;
+    uint32_t a1, a2, b1, b2;
 	int c = 0;		/* 0 is white, black is 1 */
 
 	while (1)
@@ -843,7 +844,7 @@ jbig2_decode_mmr_line(Jbig2MmrCtx *mmr, const byte *ref, byte *dst)
 		uint32_t word = mmr->word;
 		/* printf ("%08x\n", word); */
 
-		if (a0 >= mmr->width)
+        if (a0 != MINUS1 && a0 >= mmr->width)
 			break;
 
 		if ((word >> (32 - 3)) == 1)
@@ -852,7 +853,7 @@ jbig2_decode_mmr_line(Jbig2MmrCtx *mmr, const byte *ref, byte *dst)
 
 			jbig2_decode_mmr_consume(mmr, 3);
 
-			if (a0 == -1)
+            if (a0 == MINUS1)
 				a0 = 0;
 
 			if (c == 0) {
@@ -862,7 +863,7 @@ jbig2_decode_mmr_line(Jbig2MmrCtx *mmr, const byte *ref, byte *dst)
 				a2 = a1 + black_run;
 				if (a1 > mmr->width) a1 = mmr->width;
 				if (a2 > mmr->width) a2 = mmr->width;
-				if (a2 < a1 || a1 < 0) return -1;
+				if (a1 == MINUS1 || a2 < a1) return -1;
 				jbig2_set_bits(dst, a1, a2);
 				a0 = a2;
 				/* printf ("H %d %d\n", white_run, black_run); */
@@ -875,7 +876,7 @@ jbig2_decode_mmr_line(Jbig2MmrCtx *mmr, const byte *ref, byte *dst)
 				a2 = a1 + white_run;
 				if (a1 > mmr->width) a1 = mmr->width;
 				if (a2 > mmr->width) a2 = mmr->width;
-				if (a1 < a0 || a0 < 0) return -1;
+				if (a0 == MINUS1 || a1 < a0) return -1;
 				jbig2_set_bits(dst, a0, a1);
 				a0 = a2;
 				/* printf ("H %d %d\n", black_run, white_run); */
@@ -890,7 +891,7 @@ jbig2_decode_mmr_line(Jbig2MmrCtx *mmr, const byte *ref, byte *dst)
 			b2 = jbig2_find_changing_element(ref, b1, mmr->width);
 			if (c)
 			{
-				if (b2 < a0 || a0 < 0) return -1;
+				if (a0 == MINUS1 || b2 < a0) return -1;
 				jbig2_set_bits(dst, a0, b2);
 			}
 			a0 = b2;
@@ -903,7 +904,7 @@ jbig2_decode_mmr_line(Jbig2MmrCtx *mmr, const byte *ref, byte *dst)
 			b1 = jbig2_find_changing_element_of_color(ref, a0, mmr->width, !c);
 			if (c)
 			{
-				if (b1 < a0 || a0 < 0) return -1;
+				if (a0 == MINUS1 || b1 < a0) return -1;
 				jbig2_set_bits(dst, a0, b1);
 			}
 			a0 = b1;
@@ -918,7 +919,7 @@ jbig2_decode_mmr_line(Jbig2MmrCtx *mmr, const byte *ref, byte *dst)
 			if (b1 + 1 > mmr->width) break;
 			if (c)
 			{
-				if (b1 + 1 < a0 || a0 < 0) return -1;
+				if (a0 == MINUS1 || b1 + 1 < a0) return -1;
 				jbig2_set_bits(dst, a0, b1 + 1);
 			}
 			a0 = b1 + 1;
@@ -933,7 +934,7 @@ jbig2_decode_mmr_line(Jbig2MmrCtx *mmr, const byte *ref, byte *dst)
 			if (b1 + 2 > mmr->width) break;
 			if (c)
 			{
-				if (b1 + 2 < a0 || a0 < 0) return -1;
+				if (a0 == MINUS1 || b1 + 2 < a0) return -1;
 				jbig2_set_bits(dst, a0, b1 + 2);
 			}
 			a0 = b1 + 2;
@@ -945,10 +946,10 @@ jbig2_decode_mmr_line(Jbig2MmrCtx *mmr, const byte *ref, byte *dst)
 			/* printf ("VR(3)\n"); */
 			jbig2_decode_mmr_consume(mmr, 7);
 			b1 = jbig2_find_changing_element_of_color(ref, a0, mmr->width, !c);
-			if (b1 + 3 > mmr->width) break;
+			if (b1 + 3 > (int)mmr->width) break;
 			if (c)
 			{
-				if (b1 + 3 < a0 || a0 < 0) return -1;
+				if (a0 == MINUS1 || b1 + 3 < a0) return -1;
 				jbig2_set_bits(dst, a0, b1 + 3);
 			}
 			a0 = b1 + 3;
@@ -960,10 +961,10 @@ jbig2_decode_mmr_line(Jbig2MmrCtx *mmr, const byte *ref, byte *dst)
 			/* printf ("VL(1)\n"); */
 			jbig2_decode_mmr_consume(mmr, 3);
 			b1 = jbig2_find_changing_element_of_color(ref, a0, mmr->width, !c);
-			if (b1 - 1 < 0) break;
+			if (b1 < 1) break;
 			if (c)
 			{
-				if (b1 - 1 < a0 || a0 < 0) return -1;
+				if (a0 == MINUS1 || b1 - 1 < a0) return -1;
 				jbig2_set_bits(dst, a0, b1 - 1);
 			}
 			a0 = b1 - 1;
@@ -975,7 +976,7 @@ jbig2_decode_mmr_line(Jbig2MmrCtx *mmr, const byte *ref, byte *dst)
 			/* printf ("VL(2)\n"); */
 			jbig2_decode_mmr_consume(mmr, 6);
 			b1 = jbig2_find_changing_element_of_color(ref, a0, mmr->width, !c);
-			if (b1 - 2 < 0) break;
+			if (b1 < 2) break;
 			if (c)
 			{
 				if (b1 - 2 < a0 || a0 < 0) return -1;
@@ -990,10 +991,10 @@ jbig2_decode_mmr_line(Jbig2MmrCtx *mmr, const byte *ref, byte *dst)
 			/* printf ("VL(3)\n"); */
 			jbig2_decode_mmr_consume(mmr, 7);
 			b1 = jbig2_find_changing_element_of_color(ref, a0, mmr->width, !c);
-			if (b1 - 3 < 0) break;
+			if (b1 < 3) break;
 			if (c)
 			{
-				if (b1 - 3 < a0 || a0 < 0) return -1;
+				if (a0 == MINUS1 || b1 - 3 < a0) return -1;
 				jbig2_set_bits(dst, a0, b1 - 3);
 			}
 			a0 = b1 - 3;
@@ -1015,10 +1016,10 @@ jbig2_decode_generic_mmr(Jbig2Ctx *ctx,
 	Jbig2Image *image)
 {
 	Jbig2MmrCtx mmr;
-	const int rowstride = image->stride;
+    const uint32_t rowstride = image->stride;
 	byte *dst = image->data;
 	byte *ref = NULL;
-	int y;
+    uint32_t y;
 	int code = 0;
 
 	jbig2_decode_mmr_init(&mmr, image->width, image->height, data, size);
@@ -1055,10 +1056,10 @@ jbig2_decode_halftone_mmr(Jbig2Ctx *ctx,
 	Jbig2Image *image, size_t* consumed_bytes)
 {
 	Jbig2MmrCtx mmr;
-	const int rowstride = image->stride;
+    const uint32_t rowstride = image->stride;
 	byte *dst = image->data;
 	byte *ref = NULL;
-	int y;
+    uint32_t y;
         int code = 0;
 	const uint32_t EOFB = 0x001001;
 
diff --git a/jbig2dec/jbig2_page.c b/jbig2dec/jbig2_page.c
index e82ff26..3d4cd46 100644
--- a/jbig2dec/jbig2_page.c
+++ b/jbig2dec/jbig2_page.c
@@ -171,9 +171,9 @@ int
 jbig2_end_of_stripe(Jbig2Ctx *ctx, Jbig2Segment *segment, const uint8_t *segment_data)
 {
     Jbig2Page page = ctx->pages[ctx->current_page];
-    int end_row;
+    uint32_t end_row;
 
-    end_row = jbig2_get_int32(segment_data);
+    end_row = jbig2_get_uint32(segment_data);
     if (end_row < page.end_row) {
 	jbig2_error(ctx, JBIG2_SEVERITY_WARNING, segment->number,
 	    "end of stripe segment with non-positive end row advance"
@@ -274,7 +274,7 @@ jbig2_page_add_result(Jbig2Ctx *ctx, Jbig2Page *page, Jbig2Image *image,
 
     /* grow the page to accomodate a new stripe if necessary */
     if (page->striped) {
-	int new_height = y + image->height + page->end_row;
+	uint32_t new_height = y + image->height + page->end_row;
 	if (page->image->height < new_height) {
 	    jbig2_error(ctx, JBIG2_SEVERITY_DEBUG, -1,
 		"growing page buffer to %d rows "
diff --git a/jbig2dec/jbig2_priv.h b/jbig2dec/jbig2_priv.h
index 978216d..c13c8fd 100644
--- a/jbig2dec/jbig2_priv.h
+++ b/jbig2dec/jbig2_priv.h
@@ -129,7 +129,7 @@ struct _Jbig2Page {
              y_resolution;	/* in pixels per meter */
     uint16_t stripe_size;
     bool striped;
-    int end_row;
+    uint32_t end_row;
     uint8_t flags;
     Jbig2Image *image;
 };
@@ -184,7 +184,7 @@ int jbig2_halftone_region(Jbig2Ctx *ctx, Jbig2Segment *segment,
 typedef struct _Jbig2WordStream Jbig2WordStream;
 
 struct _Jbig2WordStream {
-  int (*get_next_word) (Jbig2WordStream *self, int offset, uint32_t *word);
+  int (*get_next_word) (Jbig2WordStream *self, size_t offset, uint32_t *word);
 };
 
 Jbig2WordStream *
diff --git a/jbig2dec/jbig2_segment.c b/jbig2dec/jbig2_segment.c
index 1725761..19b0161 100644
--- a/jbig2dec/jbig2_segment.c
+++ b/jbig2dec/jbig2_segment.c
@@ -41,10 +41,10 @@ jbig2_parse_segment_header (Jbig2Ctx *ctx, uint8_t *buf, size_t buf_size,
   uint8_t rtscarf;
   uint32_t rtscarf_long;
   uint32_t *referred_to_segments;
-  int referred_to_segment_count;
-  int referred_to_segment_size;
-  int pa_size;
-  int offset;
+    uint32_t referred_to_segment_count;
+    uint32_t referred_to_segment_size;
+    uint32_t pa_size;
+    uint32_t offset;
 
   /* minimum possible size of a jbig2 segment header */
   if (buf_size < 11)
@@ -94,7 +94,7 @@ jbig2_parse_segment_header (Jbig2Ctx *ctx, uint8_t *buf, size_t buf_size,
   /* 7.2.5 */
   if (referred_to_segment_count)
     {
-      int i;
+      uint32_t i;
 
       referred_to_segments = jbig2_new(ctx, uint32_t,
         referred_to_segment_count * referred_to_segment_size);
diff --git a/jbig2dec/jbig2_symbol_dict.c b/jbig2dec/jbig2_symbol_dict.c
index e12e89b..d4dc078 100644
--- a/jbig2dec/jbig2_symbol_dict.c
+++ b/jbig2dec/jbig2_symbol_dict.c
@@ -92,9 +92,9 @@ jbig2_dump_symbol_dict(Jbig2Ctx *ctx, Jbig2Segment *segment)
 
 /* return a new empty symbol dict */
 Jbig2SymbolDict *
-jbig2_sd_new(Jbig2Ctx *ctx, int n_symbols)
+jbig2_sd_new(Jbig2Ctx *ctx, uint32_t n_symbols)
 {
-   Jbig2SymbolDict *new = NULL;
+   Jbig2SymbolDict *new_dict = NULL;
 
    if (n_symbols < 0) {
      jbig2_error(ctx, JBIG2_SEVERITY_FATAL, -1,
@@ -102,33 +102,33 @@ jbig2_sd_new(Jbig2Ctx *ctx, int n_symbols)
      return NULL;
    }
 
-   new = jbig2_new(ctx, Jbig2SymbolDict, 1);
-   if (new != NULL) {
-     new->glyphs = jbig2_new(ctx, Jbig2Image*, n_symbols);
-     new->n_symbols = n_symbols;
+   new_dict = jbig2_new(ctx, Jbig2SymbolDict, 1);
+   if (new_dict != NULL) {
+     new_dict->glyphs = jbig2_new(ctx, Jbig2Image*, n_symbols);
+     new_dict->n_symbols = n_symbols;
    } else {
      jbig2_error(ctx, JBIG2_SEVERITY_FATAL, -1,
          "unable to allocate new empty symbol dict");
      return NULL;
    }
 
-   if (new->glyphs != NULL) {
-     memset(new->glyphs, 0, n_symbols*sizeof(Jbig2Image*));
+   if (new_dict->glyphs != NULL) {
+     memset(new_dict->glyphs, 0, n_symbols*sizeof(Jbig2Image*));
    } else {
      jbig2_error(ctx, JBIG2_SEVERITY_FATAL, -1,
          "unable to allocate glyphs for new empty symbol dict");
-     jbig2_free(ctx->allocator, new);
+     jbig2_free(ctx->allocator, new_dict);
      return NULL;
    }
 
-   return new;
+   return new_dict;
 }
 
 /* release the memory associated with a symbol dict */
 void
 jbig2_sd_release(Jbig2Ctx *ctx, Jbig2SymbolDict *dict)
 {
-   int i;
+   uint32_t i;
 
    if (dict == NULL) return;
    for (i = 0; i < dict->n_symbols; i++)
@@ -146,12 +146,12 @@ jbig2_sd_glyph(Jbig2SymbolDict *dict, unsigned int id)
 }
 
 /* count the number of dictionary segments referred to by the given segment */
-int
+uint32_t
 jbig2_sd_count_referred(Jbig2Ctx *ctx, Jbig2Segment *segment)
 {
     int index;
     Jbig2Segment *rsegment;
-    int n_dicts = 0;
+    uint32_t n_dicts = 0;
 
     for (index = 0; index < segment->referred_to_segment_count; index++) {
         rsegment = jbig2_find_segment(ctx, segment->referred_to_segments[index]);
@@ -172,8 +172,8 @@ jbig2_sd_list_referred(Jbig2Ctx *ctx, Jbig2Segment *segment)
     int index;
     Jbig2Segment *rsegment;
     Jbig2SymbolDict **dicts;
-    int n_dicts = jbig2_sd_count_referred(ctx, segment);
-    int dindex = 0;
+    uint32_t n_dicts = jbig2_sd_count_referred(ctx, segment);
+    uint32_t dindex = 0;
 
     dicts = jbig2_new(ctx, Jbig2SymbolDict*, n_dicts);
     if (dicts == NULL)
@@ -206,10 +206,10 @@ jbig2_sd_list_referred(Jbig2Ctx *ctx, Jbig2Segment *segment)
 /* generate a new symbol dictionary by concatenating a list of
    existing dictionaries */
 Jbig2SymbolDict *
-jbig2_sd_cat(Jbig2Ctx *ctx, int n_dicts, Jbig2SymbolDict **dicts)
+jbig2_sd_cat(Jbig2Ctx *ctx, uint32_t n_dicts, Jbig2SymbolDict **dicts)
 {
-  int i,j,k, symbols;
-  Jbig2SymbolDict *new = NULL;
+  uint32_t i,j,k, symbols;
+  Jbig2SymbolDict *new_dict = NULL;
 
   /* count the imported symbols and allocate a new array */
   symbols = 0;
@@ -217,18 +217,18 @@ jbig2_sd_cat(Jbig2Ctx *ctx, int n_dicts, Jbig2SymbolDict **dicts)
     symbols += dicts[i]->n_symbols;
 
   /* fill a new array with cloned glyph pointers */
-  new = jbig2_sd_new(ctx, symbols);
-  if (new != NULL) {
+  new_dict = jbig2_sd_new(ctx, symbols);
+  if (new_dict != NULL) {
     k = 0;
     for (i = 0; i < n_dicts; i++)
       for (j = 0; j < dicts[i]->n_symbols; j++)
-        new->glyphs[k++] = jbig2_image_clone(ctx, dicts[i]->glyphs[j]);
+        new_dict->glyphs[k++] = jbig2_image_clone(ctx, dicts[i]->glyphs[j]);
   } else {
     jbig2_error(ctx, JBIG2_SEVERITY_WARNING, -1,
         "failed to allocate new symbol dictionary");
   }
 
-  return new;
+  return new_dict;
 }
 
 
@@ -476,7 +476,7 @@ jbig2_decode_symbol_dict(Jbig2Ctx *ctx,
 
 		  if (REFAGGNINST > 1) {
 		      Jbig2Image *image;
-		      int i;
+                        uint32_t i;
 
 		      if (tparams == NULL)
 		      {
@@ -571,7 +571,7 @@ jbig2_decode_symbol_dict(Jbig2Ctx *ctx,
 		      uint32_t ID;
 		      int32_t RDX, RDY;
 		      int BMSIZE = 0;
-		      int ninsyms = params->SDNUMINSYMS;
+                        uint32_t ninsyms = params->SDNUMINSYMS;
 		      int code1 = 0;
 		      int code2 = 0;
 		      int code3 = 0;
@@ -679,8 +679,9 @@ jbig2_decode_symbol_dict(Jbig2Ctx *ctx,
       if (params->SDHUFF && !params->SDREFAGG) {
 	/* 6.5.9 */
 	Jbig2Image *image;
-	int BMSIZE = jbig2_huffman_get(hs, params->SDHUFFBMSIZE, &code);
-	int j, x;
+            uint32_t BMSIZE = jbig2_huffman_get(hs, params->SDHUFFBMSIZE, &code);
+            uint32_t j;
+            int x;
 
 	if (code || (BMSIZE < 0)) {
 	  jbig2_error(ctx, JBIG2_SEVERITY_FATAL, segment->number,
@@ -782,23 +783,23 @@ jbig2_decode_symbol_dict(Jbig2Ctx *ctx,
   }
   else
   {
-    int i = 0;
-    int j = 0;
-    int k;
+    uint32_t i = 0;
+    uint32_t j = 0;
+    uint32_t k;
     int exflag = 0;
-    int64_t limit = params->SDNUMINSYMS + params->SDNUMNEWSYMS;
-    int32_t exrunlength;
+    uint32_t limit = params->SDNUMINSYMS + params->SDNUMNEWSYMS;
+    uint32_t exrunlength;
     int zerolength = 0;
 
     while (i < limit) {
       if (params->SDHUFF)
         exrunlength = jbig2_huffman_get(hs, SBHUFFRSIZE, &code);
       else
-        code = jbig2_arith_int_decode(IAEX, as, &exrunlength);
+        code = jbig2_arith_int_decode(IAEX, as, (int32_t *)&exrunlength);
       /* prevent infinite loop */
       zerolength = exrunlength > 0 ? 0 : zerolength + 1;
       if (code || (exrunlength > limit - i) || (exrunlength < 0) || (zerolength > 4) ||
-          (exflag && (exrunlength > params->SDNUMEXSYMS - j))) {
+          (exflag && (exrunlength + j > params->SDNUMEXSYMS))) {
         if (code)
           jbig2_error(ctx, JBIG2_SEVERITY_FATAL, segment->number,
             "failed to decode exrunlength for exported symbols");
@@ -891,8 +892,8 @@ jbig2_symbol_dictionary(Jbig2Ctx *ctx, Jbig2Segment *segment,
 {
   Jbig2SymbolDictParams params;
   uint16_t flags;
-  int sdat_bytes;
-  int offset;
+    uint32_t sdat_bytes;
+    uint32_t offset;
   Jbig2ArithCx *GB_stats = NULL;
   Jbig2ArithCx *GR_stats = NULL;
   int table_index = 0;
@@ -1063,7 +1064,7 @@ jbig2_symbol_dictionary(Jbig2Ctx *ctx, Jbig2Segment *segment,
 
   /* 7.4.2.2 (2) */
   {
-    int n_dicts = jbig2_sd_count_referred(ctx, segment);
+        uint32_t n_dicts = jbig2_sd_count_referred(ctx, segment);
     Jbig2SymbolDict **dicts = NULL;
 
     if (n_dicts > 0) {
diff --git a/jbig2dec/jbig2_symbol_dict.h b/jbig2dec/jbig2_symbol_dict.h
index ae88f1a..966c1ff 100644
--- a/jbig2dec/jbig2_symbol_dict.h
+++ b/jbig2dec/jbig2_symbol_dict.h
@@ -37,7 +37,7 @@ jbig2_sd_glyph(Jbig2SymbolDict *dict, unsigned int id);
 
 /* return a new empty symbol dict */
 Jbig2SymbolDict *
-jbig2_sd_new(Jbig2Ctx *ctx, int n_symbols);
+jbig2_sd_new(Jbig2Ctx *ctx, uint32_t n_symbols);
 
 /* release the memory associated with a symbol dict */
 void
@@ -46,12 +46,12 @@ jbig2_sd_release(Jbig2Ctx *ctx, Jbig2SymbolDict *dict);
 /* generate a new symbol dictionary by concatenating a list of
    existing dictionaries */
 Jbig2SymbolDict *
-jbig2_sd_cat(Jbig2Ctx *ctx, int n_dicts,
+jbig2_sd_cat(Jbig2Ctx *ctx, uint32_t n_dicts,
 			Jbig2SymbolDict **dicts);
 
 /* count the number of dictionary segments referred
    to by the given segment */
-int
+uint32_t
 jbig2_sd_count_referred(Jbig2Ctx *ctx, Jbig2Segment *segment);
 
 /* return an array of pointers to symbol dictionaries referred
diff --git a/jbig2dec/jbig2_text.c b/jbig2dec/jbig2_text.c
index 5c9df26..dddc97e 100644
--- a/jbig2dec/jbig2_text.c
+++ b/jbig2dec/jbig2_text.c
@@ -56,7 +56,7 @@
 int
 jbig2_decode_text_region(Jbig2Ctx *ctx, Jbig2Segment *segment,
                              const Jbig2TextRegionParams *params,
-                             const Jbig2SymbolDict * const *dicts, const int n_dicts,
+                             const Jbig2SymbolDict * const *dicts, const uint32_t n_dicts,
                              Jbig2Image *image,
                              const byte *data, const size_t size,
 			     Jbig2ArithCx *GR_stats, Jbig2ArithState *as, Jbig2WordStream *ws)
@@ -467,19 +467,19 @@ cleanup2:
 int
 jbig2_text_region(Jbig2Ctx *ctx, Jbig2Segment *segment, const byte *segment_data)
 {
-    int offset = 0;
+    uint32_t offset = 0;
     Jbig2RegionSegmentInfo region_info;
     Jbig2TextRegionParams params;
     Jbig2Image *image = NULL;
     Jbig2SymbolDict **dicts = NULL;
-    int n_dicts = 0;
+    uint32_t n_dicts = 0;
     uint16_t flags = 0;
     uint16_t huffman_flags = 0;
     Jbig2ArithCx *GR_stats = NULL;
     int code = 0;
     Jbig2WordStream *ws = NULL;
     Jbig2ArithState *as = NULL;
-    int table_index = 0;
+    uint32_t table_index = 0;
     const Jbig2HuffmanParams *huffman_params = NULL;
 
     /* 7.4.1 */
@@ -826,7 +826,7 @@ jbig2_text_region(Jbig2Ctx *ctx, Jbig2Segment *segment, const byte *segment_data
             "unable to retrive symbol dictionaries! previous parsing error?");
         goto cleanup1;
     } else {
-	int index;
+	uint32_t index;
 	if (dicts[0] == NULL) {
         code =jbig2_error(ctx, JBIG2_SEVERITY_WARNING, segment->number,
             "unable to find first referenced symbol dictionary!");
@@ -877,8 +877,8 @@ jbig2_text_region(Jbig2Ctx *ctx, Jbig2Segment *segment, const byte *segment_data
     }
 
     if (!params.SBHUFF) {
-	int SBSYMCODELEN, index;
-        int SBNUMSYMS = 0;
+	uint32_t SBSYMCODELEN, index;
+        uint32_t SBNUMSYMS = 0;
 	for (index = 0; index < n_dicts; index++) {
 	    SBNUMSYMS += dicts[index]->n_symbols;
 	}
@@ -896,7 +896,7 @@ jbig2_text_region(Jbig2Ctx *ctx, Jbig2Segment *segment, const byte *segment_data
     }
 
 	/* Table 31 */
-	for (SBSYMCODELEN = 0; (1 << SBSYMCODELEN) < SBNUMSYMS; SBSYMCODELEN++);
+	for (SBSYMCODELEN = 0; (1U << SBSYMCODELEN) < SBNUMSYMS; SBSYMCODELEN++);
     params.IAID = jbig2_arith_iaid_ctx_new(ctx, SBSYMCODELEN);
 	params.IARI = jbig2_arith_int_ctx_new(ctx);
 	params.IARDW = jbig2_arith_int_ctx_new(ctx);
diff --git a/jbig2dec/jbig2_text.h b/jbig2dec/jbig2_text.h
index f52e840..6c1944e 100644
--- a/jbig2dec/jbig2_text.h
+++ b/jbig2dec/jbig2_text.h
@@ -70,7 +70,7 @@ typedef struct {
 int
 jbig2_decode_text_region(Jbig2Ctx *ctx, Jbig2Segment *segment,
                              const Jbig2TextRegionParams *params,
-                             const Jbig2SymbolDict * const *dicts, const int n_dicts,
+                             const Jbig2SymbolDict * const *dicts, const uint32_t n_dicts,
                              Jbig2Image *image,
                              const byte *data, const size_t size,
 			     Jbig2ArithCx *GR_stats,

Places

File CVE-2016-9601.patch of Package ghostscript-mini (Revision c6038a2a08da75c1bd0f005aad0a1b2a)

Places