diff options
| author | Alex Cherepanov <alex.cherepanov@artifex.com> | 2009-06-17 03:25:25 +0000 |
|---|---|---|
| committer | Alex Cherepanov <alex.cherepanov@artifex.com> | 2009-06-17 03:25:25 +0000 |
| commit | 6109dfab012040b68b1f560dd321d691a431c8ba (patch) | |
| tree | bf9a1233dd3f01c69cdd5428598fc05a4ae4fac9 | |
| parent | 70017d927c8cb7a0f5f2ab3a0ecb2be4dde6f8db (diff) | |
Fix memory corruption caused by long names. The length of name in the scanner
buffer may exceed the maximum name size and should be checked. Bug 690523.
DIFFERENCES:
None
git-svn-id: http://svn.ghostscript.com/ghostscript/trunk@9797 a1074d23-0009-0410-80fe-cf8c14f379e6
| -rw-r--r-- | gs/psi/iscan.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/gs/psi/iscan.c b/gs/psi/iscan.c index 0f997dda2..4dffac23e 100644 --- a/gs/psi/iscan.c +++ b/gs/psi/iscan.c @@ -127,7 +127,7 @@ dynamic_grow(da_ptr pda, byte * next, uint max_size) int code; pda->next = next; - if (old_size == max_size) + if (old_size >= max_size) return_error(e_limitcheck); while ((code = dynamic_resize(pda, new_size)) < 0 && new_size > old_size |