diff options
| author | Ethan Vrhel <ethanvrhel@gmail.com> | 2022-08-04 13:18:38 -0700 |
|---|---|---|
| committer | Ethan Vrhel <ethanvrhel@gmail.com> | 2022-08-04 13:18:38 -0700 |
| commit | 1bb1ab40386e546c716ef6e745496919f1802a0b (patch) | |
| tree | 4f52e9408603ee05411a7628eba8ee229afb65c1 /xps | |
| parent | 2c4c912b8ecb06af92112cf2bb8e104174afd7af (diff) | |
| download | ghostpdl-1bb1ab40386e546c716ef6e745496919f1802a0b.tar.gz | |
Bug 705608 : XPS interpreter
Previous fix in commit 7642e51271eafd012a80722b5f82226188de90a2
did not correctly fix the issue. Integer overflow is now checked
which was allowing the issue to persist.
Diffstat (limited to 'xps')
| -rw-r--r-- | xps/xpsfont.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/xps/xpsfont.c b/xps/xpsfont.c index 7ec5416fe..61fa7a015 100644 --- a/xps/xpsfont.c +++ b/xps/xpsfont.c @@ -135,7 +135,7 @@ xps_find_sfnt_table(xps_font_t *font, const char *name, int *lengthp) /* check if the buffer contains enough data to contain nfonts subfonts */ int min_len = 12 + nfonts * 4; - if (font->length < min_len) + if (min_len < 0 || font->length < min_len) { gs_warn("font data length too small"); return -1; |