Fix invalid memory access in 1150.pdf.asan.8.69

1 files changed, 4 insertions, 1 deletions

diff --git a/splash/Splash.cc b/splash/Splash.cc
index af609b46..d0d986ef 100644
--- a/splash/Splash.cc
+++ b/splash/Splash.cc
@@ -2249,17 +2249,20 @@ SplashPath *Splash::makeDashedPath(SplashPath *path) {
   lineDashStartPhase = state->lineDashPhase;
   i = splashFloor(lineDashStartPhase / lineDashTotal);
   lineDashStartPhase -= (SplashCoord)i * lineDashTotal;
   lineDashStartOn = gTrue;
   lineDashStartIdx = 0;
   if (lineDashStartPhase > 0) {
-    while (lineDashStartPhase >= state->lineDash[lineDashStartIdx]) {
+    while (lineDashStartIdx < state->lineDashLength && lineDashStartPhase >= state->lineDash[lineDashStartIdx]) {
       lineDashStartOn = !lineDashStartOn;
       lineDashStartPhase -= state->lineDash[lineDashStartIdx];
       ++lineDashStartIdx;
     }
+    if (unlikely(lineDashStartIdx == state->lineDashLength)) {
+      return new SplashPath();
+    }
   }
 
   dPath = new SplashPath();
 
   // process each subpath
   i = 0;