summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorAlbert Astals Cid <aacid@kde.org>2017-06-21 00:56:38 +0200
committerAlbert Astals Cid <aacid@kde.org>2017-06-21 22:31:20 +0200
commitd9c88e1c8892c79b8865a0dabdcc0d3ffd55c195 (patch)
tree568e93d49c7d9ccc784be29f661e3d9792d4f4b6
parent55db66c69fd56826b8523710046deab1a8d14ba2 (diff)
Fix crash in malformed documents
-rw-r--r--poppler/GfxState.cc12
1 files changed, 6 insertions, 6 deletions
diff --git a/poppler/GfxState.cc b/poppler/GfxState.cc
index e6cd329b..f61f8124 100644
--- a/poppler/GfxState.cc
+++ b/poppler/GfxState.cc
@@ -4034,18 +4034,18 @@ GfxUnivariateShading::~GfxUnivariateShading() {
void GfxUnivariateShading::getColor(double t, GfxColor *color) {
double out[gfxColorMaxComps];
- int i, nComps;
+ int i;
+
+ // NB: there can be one function with n outputs or n functions with
+ // one output each (where n = number of color components)
+ const int nComps = nFuncs * funcs[0]->getOutputSize();
- if (unlikely(nFuncs < 1)) {
+ if (unlikely(nFuncs < 1 || nComps > gfxColorMaxComps)) {
for (int i = 0; i < gfxColorMaxComps; i++)
color->c[i] = 0;
return;
}
- // NB: there can be one function with n outputs or n functions with
- // one output each (where n = number of color components)
- nComps = nFuncs * funcs[0]->getOutputSize();
-
if (cacheSize > 0) {
double x, ix, *l, *u, *upper;