summaryrefslogtreecommitdiff
path: root/src/psaux/psobjs.c
diff options
context:
space:
mode:
authorWerner Lemberg <wl@gnu.org>2015-09-12 08:32:55 +0200
committerWerner Lemberg <wl@gnu.org>2015-09-12 08:32:55 +0200
commitdb5a4a9ae7b0048f033361744421da8569642f73 (patch)
treeae58be4427d0d85448201891050a2d10f7b11392 /src/psaux/psobjs.c
parent19b82cfbed2a269b0aae92f6dff3d40c3adccd3d (diff)
downloadfreetype2-db5a4a9ae7b0048f033361744421da8569642f73.tar.gz
[psaux] Fix potential buffer overflow (#45922).
* src/psaux/psobjs.c (ps_parser_skip_PS_token): If a token is enclosed in balanced expressions, ensure that the cursor position doesn't get larger than the current limit.
Diffstat (limited to 'src/psaux/psobjs.c')
-rw-r--r--src/psaux/psobjs.c3
1 files changed, 3 insertions, 0 deletions
diff --git a/src/psaux/psobjs.c b/src/psaux/psobjs.c
index c7cbc67..54eabe2 100644
--- a/src/psaux/psobjs.c
+++ b/src/psaux/psobjs.c
@@ -594,6 +594,9 @@
error = FT_THROW( Invalid_File_Format );
}
+ if ( cur > limit )
+ cur = limit;
+
parser->error = error;
parser->cursor = cur;
}