|
 |
b21b1b |
From 544b68a3436e72f138e283af26b168ac46dda4c5 Mon Sep 17 00:00:00 2001
|
|
|
b21b1b |
From: Ken Sharp <ken.sharp@artifex.com>
|
|
|
b21b1b |
Date: Wed, 18 Apr 2018 15:46:32 +0100
|
|
|
b21b1b |
Subject: [PATCH] pdfwrite - Guard against trying to output an infinite number
|
|
|
b21b1b |
|
|
|
b21b1b |
Bug #699255 " Buffer overflow on pprintg1 due to mishandle postscript file data to pdf"
|
|
|
b21b1b |
|
|
|
b21b1b |
The file uses an enormous parameter to xyxhow, causing an overflow in
|
|
|
b21b1b |
the calculation of text positioning (value > 1e39).
|
|
|
b21b1b |
|
|
|
b21b1b |
Since this is basically a nonsense value, and PostScript only supports
|
|
|
b21b1b |
real values up to 1e38, this patch follows the same approach as for
|
|
|
b21b1b |
a degenerate CTM, and treats it as 0.
|
|
|
b21b1b |
|
|
|
b21b1b |
Adobe Acrobat Distiller throws a limitcheck error, so we could do that
|
|
|
b21b1b |
instead if this approach proves to be a problem.
|
|
|
b21b1b |
---
|
|
|
b21b1b |
base/gdevpdts.c | 7 ++++++-
|
|
|
b21b1b |
1 file changed, 6 insertions(+), 1 deletion(-)
|
|
|
b21b1b |
|
|
|
b21b1b |
diff --git a/base/gdevpdts.c b/base/gdevpdts.c
|
|
|
b21b1b |
index f9321a3..fff6c17 100644
|
|
|
b21b1b |
--- a/base/gdevpdts.c
|
|
|
b21b1b |
+++ b/base/gdevpdts.c
|
|
|
b21b1b |
@@ -152,9 +152,14 @@ append_text_move(pdf_text_state_t *pts, floatp dw)
|
|
|
b21b1b |
static int
|
|
|
b21b1b |
set_text_distance(gs_point *pdist, floatp dx, floatp dy, const gs_matrix *pmat)
|
|
|
b21b1b |
{
|
|
|
b21b1b |
- int code = gs_distance_transform_inverse(dx, dy, pmat, pdist);
|
|
|
b21b1b |
+ int code;
|
|
|
b21b1b |
double rounded;
|
|
|
b21b1b |
|
|
|
b21b1b |
+ if (dx > 1e38 || dy > 1e38)
|
|
|
b21b1b |
+ code = gs_error_undefinedresult;
|
|
|
b21b1b |
+ else
|
|
|
b21b1b |
+ code = gs_distance_transform_inverse(dx, dy, pmat, pdist);
|
|
|
b21b1b |
+
|
|
|
b21b1b |
if (code == gs_error_undefinedresult) {
|
|
|
b21b1b |
/* The CTM is degenerate.
|
|
|
b21b1b |
Can't know the distance in user space.
|
|
|
b21b1b |
--
|
|
|
b21b1b |
2.14.3
|
|
|
b21b1b |
|