diff options
| author | Sebastian Rasmussen <sebras@hotmail.com> | 2009-06-21 23:41:10 +0200 |
|---|---|---|
| committer | Sebastian Rasmussen <sebras@hotmail.com> | 2009-06-21 23:41:10 +0200 |
| commit | 451373e028f82fa2f1cc2a6a669df31d85c877bd (patch) | |
| tree | 281472c52bb24aa11417de1d1908a4763664ed2d | |
| parent | 59bf37442f9267ca2379bf7eadbf340bb38da535 (diff) | |
Properly check exponential function array boundaries. Fixes 690555.
| -rw-r--r-- | mupdf/pdf_function.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/mupdf/pdf_function.c b/mupdf/pdf_function.c index 778fd038c..111cca4a5 100644 --- a/mupdf/pdf_function.c +++ b/mupdf/pdf_function.c @@ -1163,6 +1163,8 @@ loadexponentialfunc(pdf_function *func, fz_obj *dict) if (fz_isarray(obj)) { func->n = fz_arraylen(obj); + if (func->n >= MAXN) + return fz_throw("exponential function result array out of range"); for (i = 0; i < func->n; ++i) func->u.e.c0[i] = fz_toreal(fz_arrayget(obj, i)); pdf_logrsrc("c0 %d\n", func->n); |
