diff options
| author | Shailesh Mistry <shailesh.mistry@hotmail.co.uk> | 2017-04-25 21:05:27 +0100 |
|---|---|---|
| committer | Shailesh Mistry <shailesh.mistry@hotmail.co.uk> | 2017-04-26 17:34:39 +0100 |
| commit | 7f5fb63f7f2ef5ff3f234e0653412d8f4a439c0d (patch) | |
| tree | 4091b0464d73965a9dd730d9a552e48537e93c94 /base/slzwd.c | |
| parent | 1d2ba380aaa4df253bb6a1237f136ab4984657bd (diff) | |
| download | ghostpdl-7f5fb63f7f2ef5ff3f234e0653412d8f4a439c0d.tar.gz | |
Bug 694150 : Fix SEGV in s_LZWD_process.
Prevent using prev_code < 0 which would make an entry before the table.
This in turn means that when a length of 4 is decoded, the decoder fails
to find the eod and continues to write off the end of the memory segment.
Diffstat (limited to 'base/slzwd.c')
| -rw-r--r-- | base/slzwd.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/base/slzwd.c b/base/slzwd.c index a3ece825e..9caf2152e 100644 --- a/base/slzwd.c +++ b/base/slzwd.c @@ -242,10 +242,10 @@ s_LZWD_process(stream_state * st, stream_cursor_read * pr, * equal to next_code. */ if (code >= next_code) { - if (code > next_code) { + if ((code > next_code) || (prev_code < 0)) { #ifdef DEBUG - mlprintf2(ss->memory, "[W]code = %d > next_code = %d\n", - code, next_code); + mlprintf3(ss->memory, "[W]code = %d > next_code = %d or prev_code = %d < 0\n", + code, next_code, prev_code); #endif status = ERRC; goto out; |