diff options
| author | Alex Cherepanov <alex.cherepanov@artifex.com> | 2012-02-24 18:39:09 -0500 |
|---|---|---|
| committer | Chris Liddell <chris.liddell@artifex.com> | 2012-03-15 11:54:23 +0000 |
| commit | 2b3234a84fc41b6bb3b9743f820a2606141b38b6 (patch) | |
| tree | 22bec0413dac2f835cd56c71467d04d248d7bde4 | |
| parent | f9fceab3464349aa8c387163ed3824ac12cf9106 (diff) | |
Bug 692832: Drop setcachedevice calls with large arguments.
Reject setcachedevice arguments that are too big and, probably, invalid.
The threshold, 32000, is arbitrary. Normal fonts have the values about 1000.
| -rw-r--r-- | gs/base/gxchar.c | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/gs/base/gxchar.c b/gs/base/gxchar.c index 0fd2a7ee7..6e423e2b6 100644 --- a/gs/base/gxchar.c +++ b/gs/base/gxchar.c @@ -531,13 +531,19 @@ set_cache_device(gs_show_enum * penum, gs_state * pgs, floatp llx, floatp lly, cached_char *cc; gs_fixed_rect clip_box; int code; + gs_fixed_point cll, clr, cul, cur, cdim; + + /* Reject setcachedevice arguments that are too big and, probably, invalid */ + /* The threshold is arbitrary. A font from bug 692832 has a 1237340, */ + /* normal fonts should have about 1000. */ + if (fabs(llx) > 32000. || fabs(lly) > 32000. || fabs(urx) > 32000. || fabs(ury) >= 32000.) + return 0; /* don't cache */ /* Compute the bounding box of the transformed character. */ /* Since we accept arbitrary transformations, the extrema */ /* may occur in any order; however, we can save some work */ /* by observing that opposite corners before transforming */ /* are still opposite afterwards. */ - gs_fixed_point cll, clr, cul, cur, cdim; if ((code = gs_distance_transform2fixed(&pgs->ctm, llx, lly, &cll)) < 0 || (code = gs_distance_transform2fixed(&pgs->ctm, llx, ury, &clr)) < 0 || |