diff options
| author | Ken Sharp <ken.sharp@artifex.com> | 2018-09-21 09:49:58 +0100 |
|---|---|---|
| committer | Ken Sharp <ken.sharp@artifex.com> | 2018-09-21 09:50:22 +0100 |
| commit | 7ee525fd0010a4f0bb507417860e9faa058c6315 (patch) | |
| tree | 60b74edbefdf46012309c00d86fcd5769ac394b0 | |
| parent | 2118711d122aeb170031ab7eb80e5a9269055772 (diff) | |
| download | ghostpdl-7ee525fd0010a4f0bb507417860e9faa058c6315.tar.gz | |
Bug #699801 "zparse_dsc_comments can crash with invalid dsc_state"
Although zparse_dsc_comments() does check the types of its operands, it
wasn't checking the return value from dict_find_string properly. It was
effectively assuming that the dictionary parameter was the *correct*
dictionary and would contain the key/value pair it needed.
Here we check to see if the key has not been found and throw an error
if so.
| -rw-r--r-- | psi/zdscpars.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/psi/zdscpars.c b/psi/zdscpars.c index ca3d3d4d2..a8cb75da3 100644 --- a/psi/zdscpars.c +++ b/psi/zdscpars.c @@ -457,6 +457,9 @@ zparse_dsc_comments(i_ctx_t *i_ctx_p) code = dict_find_string(opDict, dsc_dict_name, &pvalue); if (code < 0) return code; + if (code == 0) + return_error(gs_error_undefined); + dsc_state = r_ptr(pvalue, dsc_data_t); /* * Pick up the comment string to be parsed. |