|
 |
ea5d11 |
From 30d5e341367002ca5b853b6b651f63e97ba580d1 Mon Sep 17 00:00:00 2001
|
|
|
ea5d11 |
From: Chris Liddell <chris.liddell@artifex.com>
|
|
|
ea5d11 |
Date: Sat, 8 Oct 2016 16:10:27 +0100
|
|
|
ea5d11 |
Subject: [PATCH] Bug 697203: check for sufficient params in .sethalftone5
|
|
|
ea5d11 |
|
|
|
ea5d11 |
and param types
|
|
|
ea5d11 |
---
|
|
|
ea5d11 |
base/gserrors.h | 1 +
|
|
|
ea5d11 |
psi/zht2.c | 12 ++++++++++--
|
|
|
ea5d11 |
2 files changed, 11 insertions(+), 2 deletions(-)
|
|
|
ea5d11 |
|
|
|
ea5d11 |
diff --git a/base/gserrors.h b/base/gserrors.h
|
|
|
ea5d11 |
index 24b5eb4..c7dbe18 100644
|
|
|
ea5d11 |
--- a/base/gserrors.h
|
|
|
ea5d11 |
+++ b/base/gserrors.h
|
|
|
ea5d11 |
@@ -33,6 +33,7 @@
|
|
|
ea5d11 |
#define gs_error_limitcheck (-13)
|
|
|
ea5d11 |
#define gs_error_nocurrentpoint (-14)
|
|
|
ea5d11 |
#define gs_error_rangecheck (-15)
|
|
|
ea5d11 |
+#define gs_error_stackunderflow (-17)
|
|
|
ea5d11 |
#define gs_error_typecheck (-20)
|
|
|
ea5d11 |
#define gs_error_undefined (-21)
|
|
|
ea5d11 |
#define gs_error_undefinedfilename (-22)
|
|
|
ea5d11 |
diff --git a/psi/zht2.c b/psi/zht2.c
|
|
|
ea5d11 |
index a53b71b..95fef4b 100644
|
|
|
ea5d11 |
--- a/psi/zht2.c
|
|
|
ea5d11 |
+++ b/psi/zht2.c
|
|
|
ea5d11 |
@@ -81,14 +81,22 @@ zsethalftone5(i_ctx_t *i_ctx_p)
|
|
|
ea5d11 |
gs_memory_t *mem;
|
|
|
ea5d11 |
uint edepth = ref_stack_count(&e_stack);
|
|
|
ea5d11 |
int npop = 2;
|
|
|
ea5d11 |
- int dict_enum = dict_first(op);
|
|
|
ea5d11 |
+ int dict_enum;
|
|
|
ea5d11 |
ref rvalue[2];
|
|
|
ea5d11 |
int cname, colorant_number;
|
|
|
ea5d11 |
byte * pname;
|
|
|
ea5d11 |
uint name_size;
|
|
|
ea5d11 |
int halftonetype, type = 0;
|
|
|
ea5d11 |
gs_state *pgs = igs;
|
|
|
ea5d11 |
- int space_index = r_space_index(op - 1);
|
|
|
ea5d11 |
+ int space_index;
|
|
|
ea5d11 |
+
|
|
|
ea5d11 |
+ if (ref_stack_count(&o_stack) < 2)
|
|
|
ea5d11 |
+ return_error(gs_error_stackunderflow);
|
|
|
ea5d11 |
+ check_type(*op, t_dictionary);
|
|
|
ea5d11 |
+ check_type(*(op - 1), t_dictionary);
|
|
|
ea5d11 |
+
|
|
|
ea5d11 |
+ dict_enum = dict_first(op);
|
|
|
ea5d11 |
+ space_index = r_space_index(op - 1);
|
|
|
ea5d11 |
|
|
|
ea5d11 |
mem = (gs_memory_t *) idmemory->spaces_indexed[space_index];
|
|
|
ea5d11 |
|
|
|
ea5d11 |
--
|
|
|
ea5d11 |
2.7.4
|
|
|
ea5d11 |
|