diff options
| author | Chris Liddell <chris.liddell@artifex.com> | 2019-10-01 10:35:48 +0100 |
|---|---|---|
| committer | Chris Liddell <chris.liddell@artifex.com> | 2019-10-02 08:33:12 +0100 |
| commit | 2d990b065c228802b3913602b4309165e42c08e9 (patch) | |
| tree | 1e7441fed096f7e1c674223a3e8073223f16a752 | |
| parent | f03bac8ec2dabfff5583bf6afdd2b77f1885f8ef (diff) | |
| download | ghostpdl-2d990b065c228802b3913602b4309165e42c08e9.tar.gz | |
Fix memory corruption setting a halftone
When setting a new halftone in the graphics state, we try to re-use the data
from the existing device halftone.
The problem is that the device halftone can have higher component indices than
there are components in the new halftone we are creating. In this case, we can
end up writing off the end of the components array for the new halftone
structure.
Simply check that the new halftone has enough components before doing the
duplication.
| -rw-r--r-- | base/gsht.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/base/gsht.c b/base/gsht.c index bced3730d..df20e8432 100644 --- a/base/gsht.c +++ b/base/gsht.c @@ -985,7 +985,8 @@ gx_gstate_dev_ht_install( gx_ht_order * p_s_order = &p_s_comp->corder; int comp_num = p_s_comp->comp_number; - if (comp_num >= 0 && comp_num < GX_DEVICE_COLOR_MAX_COMPONENTS) { + if (comp_num >= 0 && comp_num < GX_DEVICE_COLOR_MAX_COMPONENTS && + comp_num < dht.num_comp) { gx_ht_order * p_d_order = &dht.components[comp_num].corder; /* indicate that this order has been filled in */ |