summaryrefslogtreecommitdiff
authorAlbert Astals Cid <aacid@kde.org>2013-01-10 21:31:52 (GMT)
committer Albert Astals Cid <aacid@kde.org>2013-01-10 21:31:52 (GMT)
commit8b6dc55e530b2f5ede6b9dfb64aafdd1d5836492 (patch) (side-by-side diff)
treee413de926cc19171d5f74ca4ab25ddfbee6a571f
parente14b6e9c13d35c9bd1e0c50906ace8e707816888 (diff)
downloadpoppler-8b6dc55e530b2f5ede6b9dfb64aafdd1d5836492.zip
poppler-8b6dc55e530b2f5ede6b9dfb64aafdd1d5836492.tar.gz
Fix invalid memory access in 1150.pdf.asan.8.69
Diffstat (more/less context) (ignore whitespace changes)
-rw-r--r--splash/Splash.cc5
1 files changed, 4 insertions, 1 deletions
diff --git a/splash/Splash.cc b/splash/Splash.cc
index af609b4..d0d986e 100644
--- a/splash/Splash.cc
+++ b/splash/Splash.cc
@@ -2252,11 +2252,14 @@ SplashPath *Splash::makeDashedPath(SplashPath *path) {
lineDashStartOn = gTrue;
lineDashStartIdx = 0;
if (lineDashStartPhase > 0) {
- while (lineDashStartPhase >= state->lineDash[lineDashStartIdx]) {
+ while (lineDashStartIdx < state->lineDashLength && lineDashStartPhase >= state->lineDash[lineDashStartIdx]) {
lineDashStartOn = !lineDashStartOn;
lineDashStartPhase -= state->lineDash[lineDashStartIdx];
++lineDashStartIdx;
}
+ if (unlikely(lineDashStartIdx == state->lineDashLength)) {
+ return new SplashPath();
+ }
}
dPath = new SplashPath();