summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorSebastian Rasmussen <sebras@hotmail.com>2009-06-21 23:41:10 +0200
committerSebastian Rasmussen <sebras@hotmail.com>2009-06-21 23:41:10 +0200
commit451373e028f82fa2f1cc2a6a669df31d85c877bd (patch)
tree281472c52bb24aa11417de1d1908a4763664ed2d
parent59bf37442f9267ca2379bf7eadbf340bb38da535 (diff)
Properly check exponential function array boundaries. Fixes 690555.
-rw-r--r--mupdf/pdf_function.c2
1 files changed, 2 insertions, 0 deletions
diff --git a/mupdf/pdf_function.c b/mupdf/pdf_function.c
index 778fd038c..111cca4a5 100644
--- a/mupdf/pdf_function.c
+++ b/mupdf/pdf_function.c
@@ -1163,6 +1163,8 @@ loadexponentialfunc(pdf_function *func, fz_obj *dict)
if (fz_isarray(obj))
{
func->n = fz_arraylen(obj);
+ if (func->n >= MAXN)
+ return fz_throw("exponential function result array out of range");
for (i = 0; i < func->n; ++i)
func->u.e.c0[i] = fz_toreal(fz_arrayget(obj, i));
pdf_logrsrc("c0 %d\n", func->n);