diff options
| -rw-r--r-- | pdf/pdf_cmap.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/pdf/pdf_cmap.c b/pdf/pdf_cmap.c index c06380d08..bc9b6f473 100644 --- a/pdf/pdf_cmap.c +++ b/pdf/pdf_cmap.c @@ -174,6 +174,11 @@ static int general_endcidrange_func(gs_memory_t *mem, pdf_ps_ctx_t *s, pdf_cmap preflen = 1; } + if (stobj[i].size - preflen < 0 || stobj[i + 1].size - preflen < 0) { + (void)pdf_ps_stack_pop(s, to_pop); + return_error(gs_error_syntaxerror); + } + /* Find how many bytes we need for the cidbase value */ /* We always store at least two bytes for the cidbase value */ for (valuelen = 16; valuelen < 32 && (cidbase >> valuelen) > 0; valuelen += 1) |