diff options
| author | Werner Lemberg <wl@gnu.org> | 2015-09-12 08:32:55 +0200 |
|---|---|---|
| committer | Werner Lemberg <wl@gnu.org> | 2015-09-12 08:32:55 +0200 |
| commit | db5a4a9ae7b0048f033361744421da8569642f73 (patch) | |
| tree | ae58be4427d0d85448201891050a2d10f7b11392 /src/psaux/psobjs.c | |
| parent | 19b82cfbed2a269b0aae92f6dff3d40c3adccd3d (diff) | |
| download | freetype2-db5a4a9ae7b0048f033361744421da8569642f73.tar.gz | |
[psaux] Fix potential buffer overflow (#45922).
* src/psaux/psobjs.c (ps_parser_skip_PS_token): If a token is
enclosed in balanced expressions, ensure that the cursor position
doesn't get larger than the current limit.
Diffstat (limited to 'src/psaux/psobjs.c')
| -rw-r--r-- | src/psaux/psobjs.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/src/psaux/psobjs.c b/src/psaux/psobjs.c index c7cbc67..54eabe2 100644 --- a/src/psaux/psobjs.c +++ b/src/psaux/psobjs.c @@ -594,6 +594,9 @@ error = FT_THROW( Invalid_File_Format ); } + if ( cur > limit ) + cur = limit; + parser->error = error; parser->cursor = cur; } |
