Bug 705737 : XPS interpreter

Added check to an offset while reading the index header in
xps_count_cff_index. If the offset was read as negative, the function
will return a pointer outside the range of the buffer.

1 files changed, 6 insertions, 0 deletions

diff --git a/xps/xpscff.c b/xps/xpscff.c
index 269926c06..5f1e4c149 100644
--- a/xps/xpscff.c
+++ b/xps/xpscff.c
@@ -415,6 +415,12 @@ xps_count_cff_index(byte *p, byte *e, int *countp)
 
     p += count * offsize;
     last = uofs(p, offsize);
+    if (last < 0 || p + last > e)
+    {
+        gs_throw(-1, "corrupt index header");
+        return 0;
+    }
+
     p += offsize;
     p --; /* stupid offsets */