diff options
Diffstat (limited to 'xps')
| -rw-r--r-- | xps/xpscff.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/xps/xpscff.c b/xps/xpscff.c index 8d9f6367b..0978d80de 100644 --- a/xps/xpscff.c +++ b/xps/xpscff.c @@ -204,17 +204,23 @@ xps_read_cff_dict(byte *p, byte *e, xps_font_t *font, gs_font_type1 *pt1) if (b0 == 17) { + if (args[0].ival < 0) + return gs_throw(-1, "corrupt cff file offset"); font->charstrings = font->cffdata + args[0].ival; } if (b0 == 18) { + if (args[0].ival < 0 || args[1].ival < 0) + return gs_throw(-1, "corrupt cff file offset"); privatelen = args[0].ival; privateofs = args[1].ival; } if (b0 == 19) { + if (args[0].ival < 0) + return gs_throw(-1, "corrupt cff file offset"); font->subrs = font->cffdata + offset + args[0].ival; } |