diff options
| author | Chris Liddell <chris.liddell@artifex.com> | 2022-02-23 17:31:23 +0000 |
|---|---|---|
| committer | Chris Liddell <chris.liddell@artifex.com> | 2022-02-24 15:19:30 +0000 |
| commit | dba3969a6b5a659a0c6e4286f452e744706813bb (patch) | |
| tree | b6972f823515e34d5eebf899ac66ee46367de067 | |
| parent | a16917a77693e16c3a63a8a00ad782052ed5434e (diff) | |
| download | ghostpdl-dba3969a6b5a659a0c6e4286f452e744706813bb.tar.gz | |
oss-fuzz 44976: Check length of array before accessing
| -rw-r--r-- | pdf/pdf_fontps.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/pdf/pdf_fontps.c b/pdf/pdf_fontps.c index 1b562a37d..3ab399b96 100644 --- a/pdf/pdf_fontps.c +++ b/pdf/pdf_fontps.c @@ -441,7 +441,7 @@ ps_font_def_func(gs_memory_t *mem, pdf_ps_ctx_t *s, byte *buf, byte *bufend) case 5: if (pdf_ps_name_cmp(&s->cur[-1], "StdHW")) { - if (pdf_ps_obj_has_type(&s->cur[0], PDF_PS_OBJ_ARRAY)) { + if (pdf_ps_obj_has_type(&s->cur[0], PDF_PS_OBJ_ARRAY) && s->cur[0].size > 0) { if (pdf_ps_obj_has_type(&s->cur[0].val.arr[0], PDF_PS_OBJ_INTEGER)) { priv->gsu.gst1.data.StdHW.values[0] = (float)s->cur[0].val.arr[0].val.i; priv->gsu.gst1.data.StdHW.count = 1; @@ -453,7 +453,7 @@ ps_font_def_func(gs_memory_t *mem, pdf_ps_ctx_t *s, byte *buf, byte *bufend) } } else if (pdf_ps_name_cmp(&s->cur[-1], "StdVW")) { - if (pdf_ps_obj_has_type(&s->cur[0], PDF_PS_OBJ_ARRAY)) { + if (pdf_ps_obj_has_type(&s->cur[0], PDF_PS_OBJ_ARRAY) && s->cur[0].size > 0) { if (pdf_ps_obj_has_type(&s->cur[0].val.arr[0], PDF_PS_OBJ_INTEGER)) { priv->gsu.gst1.data.StdVW.values[0] = (float)s->cur[0].val.arr[0].val.i; priv->gsu.gst1.data.StdVW.count = 1; |