Also protect against malformed GfxPatchMeshShading

oss-fuzz/11197

1 files changed, 9 insertions, 0 deletions

diff --git a/poppler/GfxState.cc b/poppler/GfxState.cc
index 34c9e6da..e42585ed 100644
--- a/poppler/GfxState.cc
+++ b/poppler/GfxState.cc
@@ -4900,6 +4900,15 @@ GfxPatchMeshShading *GfxPatchMeshShading::parse(GfxResources *res, int typeA, Di
         }
     }
 
+    for (unsigned int k = 0; k < funcsA.size(); ++k) {
+        if (funcsA[k]->getInputSize() > 1) {
+            return nullptr;
+        }
+        if (funcsA[k]->getOutputSize() > static_cast<int>(gfxColorMaxComps - k)) {
+            return nullptr;
+        }
+    }
+
     nPatchesA = 0;
     patchesA = nullptr;
     patchesSize = 0;