Bug 105206 - Fix a buffer overflow in the PS Handler

1 files changed, 3 insertions, 1 deletions

diff --git a/XMPFiles/source/FileHandlers/PostScript_Handler.cpp b/XMPFiles/source/FileHandlers/PostScript_Handler.cpp
index d21ab8d..9ed0071 100644
--- a/XMPFiles/source/FileHandlers/PostScript_Handler.cpp
+++ b/XMPFiles/source/FileHandlers/PostScript_Handler.cpp
@@ -885,7 +885,9 @@ void PostScript_MetaHandler::ParsePSFile()
 					if (CheckBytes ( ioBuf.ptr, Uns8Ptr("iler"), 4 ))
 					{
 						ioBuf.ptr+=4;
-						while(!IsNewline(*ioBuf.ptr)) ++ioBuf.ptr;
+						while(ioBuf.ptr < ioBuf.limit &&
+                                                      !IsNewline(*ioBuf.ptr))
+                                                    ++ioBuf.ptr;
 						setTokenInfo(kPS_Trailer,begStartpos,ioBuf.filePos+ioBuf.ptr-ioBuf.data-begStartpos);
 					}
 				}