diff options
| author | Chris Liddell <chris.liddell@artifex.com> | 2022-08-30 08:52:40 +0100 |
|---|---|---|
| committer | Chris Liddell <chris.liddell@artifex.com> | 2022-08-30 10:19:56 +0100 |
| commit | ed51807f5c7d5208c703de3ab60cff49adf96328 (patch) | |
| tree | 4bc489a2bfa187bb1515df6ef5d43c77cd3cad5d /base/ttinterp.c | |
| parent | 0381294369ea5bacd10b4167b336bf1cb6d8d4ef (diff) | |
| download | ghostpdl-ed51807f5c7d5208c703de3ab60cff49adf96328.tar.gz | |
oss-fuzz 50656: Bounds check instruction buffer in Ins_NPUSHB()
Diffstat (limited to 'base/ttinterp.c')
| -rw-r--r-- | base/ttinterp.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/base/ttinterp.c b/base/ttinterp.c index 63846c8d8..23a7c949e 100644 --- a/base/ttinterp.c +++ b/base/ttinterp.c @@ -2325,7 +2325,8 @@ static int nInstrCount=0; L = (Int)CUR.code[CUR.IP + 1]; - if ( BOUNDS( L, CUR.stackSize+1-CUR.top ) ) + if ( BOUNDS( L, CUR.stackSize+1-CUR.top ) + || BOUNDS( L, CUR.codeSize+1-CUR.IP)) { CUR.error = TT_Err_Stack_Overflow; return; |