Safeguard against infinite .include recursion

Detected by oss-fuzz

1 files changed, 38 insertions, 19 deletions

diff --git a/src/cmscgats.c b/src/cmscgats.c
index 5a1d4b7..6e8f2dc 100644
--- a/src/cmscgats.c
+++ b/src/cmscgats.c
@@ -679,6 +679,42 @@ cmsFloat64Number ParseFloatNumber(const char *Buffer)
 }
 
 
+// Reads a string, special case to avoid infinite resursion on .include
+static
+void InStringSymbol(cmsIT8* it8)
+{
+    while (isseparator(it8->ch))
+        NextCh(it8);
+
+    if (it8->ch == '\'' || it8->ch == '\"')
+    {
+        CMSREGISTER char* idptr;
+        int k, sng;
+
+        idptr = it8->str;
+        sng = it8->ch;
+        k = 0;
+        NextCh(it8);
+
+        while (k < (MAXSTR - 1) && it8->ch != sng) {
+
+            if (it8->ch == '\n' || it8->ch == '\r') k = MAXSTR + 1;
+            else {
+                *idptr++ = (char)it8->ch;
+                NextCh(it8);
+                k++;
+            }
+        }
+
+        it8->sy = SSTRING;
+        *idptr = '\0';
+        NextCh(it8);        
+    }
+    else
+        SynError(it8, "String expected");
+
+}
+
 // Reads next symbol
 static
 void InSymbol(cmsIT8* it8)
@@ -872,24 +908,7 @@ void InSymbol(cmsIT8* it8)
         // String.
         case '\'':
         case '\"':
-            idptr = it8->str;
-            sng = it8->ch;
-            k = 0;
-            NextCh(it8);
-
-            while (k < (MAXSTR-1) && it8->ch != sng) {
-
-                if (it8->ch == '\n'|| it8->ch == '\r') k = MAXSTR+1;
-                else {
-                    *idptr++ = (char) it8->ch;
-                    NextCh(it8);
-                    k++;
-                }
-            }
-
-            it8->sy = SSTRING;
-            *idptr = '\0';
-            NextCh(it8);
+            InStringSymbol(it8);
             break;
 
 
@@ -912,7 +931,7 @@ void InSymbol(cmsIT8* it8)
                     return;
                 }
 
-                InSymbol(it8);
+                InStringSymbol(it8);
                 if (!Check(it8, SSTRING, "Filename expected")) return;
 
                 FileNest = it8 -> FileStack[it8 -> IncludeSP + 1];