summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorAlbert Astals Cid <aacid@kde.org>2013-01-10 19:52:02 (GMT)
committerAlbert Astals Cid <aacid@kde.org>2013-01-10 19:52:02 (GMT)
commite14b6e9c13d35c9bd1e0c50906ace8e707816888 (patch)
tree7c17bb545c3ae9601df21eeb22388e132818991b
parent0388837f01bc467045164f9ddaff787000a8caaa (diff)
Fix invalid memory access in 2030.pdf.asan.69.463
-rw-r--r--poppler/Function.cc6
1 files changed, 5 insertions, 1 deletions
diff --git a/poppler/Function.cc b/poppler/Function.cc
index 1dece2d..2f94a54 100644
--- a/poppler/Function.cc
+++ b/poppler/Function.cc
@@ -13,7 +13,7 @@
// All changes made under the Poppler project to this file are licensed
// under GPL version 2 or later
//
-// Copyright (C) 2006, 2008-2010 Albert Astals Cid <aacid@kde.org>
+// Copyright (C) 2006, 2008-2010, 2013 Albert Astals Cid <aacid@kde.org>
// Copyright (C) 2006 Jeff Muizelaar <jeff@infidigm.net>
// Copyright (C) 2010 Christian Feuersänger <cfeuersaenger@googlemail.com>
// Copyright (C) 2011 Andrea Canciani <ranma42@gmail.com>
@@ -1111,6 +1111,10 @@ void PSStack::copy(int n) {
error(errSyntaxError, -1, "Stack underflow in PostScript function");
return;
}
+ if (unlikely(sp - n > psStackSize)) {
+ error(errSyntaxError, -1, "Stack underflow in PostScript function");
+ return;
+ }
if (!checkOverflow(n)) {
return;
}