diff options
| author | Chris Liddell <chris.liddell@artifex.com> | 2021-05-07 16:24:07 +0100 |
|---|---|---|
| committer | Chris Liddell <chris.liddell@artifex.com> | 2021-05-07 16:26:58 +0100 |
| commit | 0678e99a0570ab5a2617b95fe4fba47b8f384283 (patch) | |
| tree | 7b3d81fa991a5156d7d56ee0d0e9eff0fb796a1b | |
| parent | 40e7a6db51d669811abebc1e2518e45edbae75bb (diff) | |
| download | ghostpdl-0678e99a0570ab5a2617b95fe4fba47b8f384283.tar.gz | |
Fix memory overruns in stack init
I'd made mistakes in the pdfi PS stack init code making the stack dynamically
allocated.
| -rw-r--r-- | pdf/pdf_fontps.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/pdf/pdf_fontps.c b/pdf/pdf_fontps.c index 3c6b6a093..47e313bf8 100644 --- a/pdf/pdf_fontps.c +++ b/pdf/pdf_fontps.c @@ -50,9 +50,9 @@ pdfi_pscript_stack_init(pdf_context *pdfi_ctx, pdf_ps_oper_list_t *ops, void *cl s->stack[i].type = PDF_PS_OBJ_STACK_BOTTOM; for (i = 0; i < PDF_PS_STACK_GUARDS; i++) - s->stack[size + 1 + i].type = PDF_PS_OBJ_STACK_TOP; + s->stack[size - 1 + i].type = PDF_PS_OBJ_STACK_TOP; - for (i = 0; i < size; i++) { + for (i = 0; i < size - 1; i++) { pdf_ps_make_null(&(s->cur[i])); } return 0; |