summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorZdenek Hutyra <zhutyra@centrum.cz>2024-08-30 13:16:39 +0100
committerChris Liddell <chris.liddell@artifex.com>2024-09-17 14:40:10 +0100
commitada21374f0c90cc3acf7ce0e96302394560c7aee (patch)
treea7fd3921e81a0c78ac3e77ce072e0f33cb5d68e7
parentca1fc2aefe9796e321d0589afe7efb35063c8b2a (diff)
PS interpreter - check the type of the Pattern Implementation
Bug #707991 See bug report for details. CVE-2024-46951
-rw-r--r--psi/zcolor.c3
1 files changed, 3 insertions, 0 deletions
diff --git a/psi/zcolor.c b/psi/zcolor.c
index d4e7a4438..d3384d75d 100644
--- a/psi/zcolor.c
+++ b/psi/zcolor.c
@@ -5276,6 +5276,9 @@ static int patterncomponent(i_ctx_t * i_ctx_p, ref *space, int *n)
code = array_get(imemory, pImpl, 0, &pPatInst);
if (code < 0)
return code;
+
+ if (!r_is_struct(&pPatInst) || (!r_has_stype(&pPatInst, imemory, st_pattern1_instance) && !r_has_stype(&pPatInst, imemory, st_pattern2_instance)))
+ return_error(gs_error_typecheck);
cc.pattern = r_ptr(&pPatInst, gs_pattern_instance_t);
if (pattern_instance_uses_base_space(cc.pattern))
*n = n_comps;