diff options
| author | Henry Stiles <henry.stiles@artifex.com> | 2009-10-28 14:34:33 +0000 |
|---|---|---|
| committer | Henry Stiles <henry.stiles@artifex.com> | 2009-10-28 14:34:33 +0000 |
| commit | ed277bde45e174e00ed7b1b9375bdb410b901afd (patch) | |
| tree | 26daa1cabc2c6032122b46e08c92a025f6050160 /pxl | |
| parent | d42dda63f1c3081df48be8e1e565fbdfcfc95390 (diff) | |
Prevent overflow in delta row compression, bug #690844. We use a
generic graphics error instead of an HP error because the HP error is
not documented and is not in the standard error format of single word
camel case, so we suspect it will change in the future.
git-svn-id: http://svn.ghostscript.com/ghostscript/trunk@10238 a1074d23-0009-0410-80fe-cf8c14f379e6
Diffstat (limited to 'pxl')
| -rw-r--r-- | pxl/pximage.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/pxl/pximage.c b/pxl/pximage.c index 068cddf9b..8cb91910c 100644 --- a/pxl/pximage.c +++ b/pxl/pximage.c @@ -466,6 +466,9 @@ read_deltarow_bitmap_data(px_bitmap_enum_t *benum, byte **pdata, px_args_t *par) } case partial_cnt: { + /* check for possible row overflow */ + if (pout >= *pdata + benum->data_per_row) + return -1; *pout++ = *pin++; /* copy new data into row */ avail--; deltarow->row_byte_count--; |