Brad Bishop | 6e60e8b | 2018-02-01 10:27:11 -0500 | [diff] [blame^] | 1 | From f5c7555c30393e64ec1f5ab0dfae5b55b3b3fc78 Mon Sep 17 00:00:00 2001 |
| 2 | From: Chris Liddell <chris.liddell@artifex.com> |
| 3 | Date: Sat, 8 Oct 2016 16:10:27 +0100 |
| 4 | Subject: [PATCH] Bug 697203: check for sufficient params in .sethalftone5 |
| 5 | |
| 6 | and param types |
| 7 | |
| 8 | Upstream-Status: Backport |
| 9 | CVE: CVE-2016-8602 |
| 10 | |
| 11 | Signed-off-by: Catalin Enache <catalin.enache@windriver.com> |
| 12 | --- |
| 13 | psi/zht2.c | 12 ++++++++++-- |
| 14 | 1 file changed, 10 insertions(+), 2 deletions(-) |
| 15 | |
| 16 | diff --git a/psi/zht2.c b/psi/zht2.c |
| 17 | index fb4a264..dfa27a4 100644 |
| 18 | --- a/psi/zht2.c |
| 19 | +++ b/psi/zht2.c |
| 20 | @@ -82,14 +82,22 @@ zsethalftone5(i_ctx_t *i_ctx_p) |
| 21 | gs_memory_t *mem; |
| 22 | uint edepth = ref_stack_count(&e_stack); |
| 23 | int npop = 2; |
| 24 | - int dict_enum = dict_first(op); |
| 25 | + int dict_enum; |
| 26 | ref rvalue[2]; |
| 27 | int cname, colorant_number; |
| 28 | byte * pname; |
| 29 | uint name_size; |
| 30 | int halftonetype, type = 0; |
| 31 | gs_gstate *pgs = igs; |
| 32 | - int space_index = r_space_index(op - 1); |
| 33 | + int space_index; |
| 34 | + |
| 35 | + if (ref_stack_count(&o_stack) < 2) |
| 36 | + return_error(gs_error_stackunderflow); |
| 37 | + check_type(*op, t_dictionary); |
| 38 | + check_type(*(op - 1), t_dictionary); |
| 39 | + |
| 40 | + dict_enum = dict_first(op); |
| 41 | + space_index = r_space_index(op - 1); |
| 42 | |
| 43 | mem = (gs_memory_t *) idmemory->spaces_indexed[space_index]; |
| 44 | |
| 45 | -- |
| 46 | 2.10.2 |
| 47 | |