From: Chris Liddell Date: Tue, 21 Aug 2018 19:36:52 +0000 (+0100) Subject: Bug 699659: Don't just assume an object is a t_(a)struct Bug 699659: Don't just assume an object is a t_(a)struct https://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=0edd3d6c634a577db261615a9dc2719bca7f6e01 --- diff -up a/psi/ztype.c.cve-2018-16511 b/psi/ztype.c --- a/psi/ztype.c.cve-2018-16511 2018-11-14 09:52:09.491518742 +0100 +++ b/psi/ztype.c 2018-11-14 10:14:02.238279799 +0100 @@ -76,6 +76,7 @@ ztype(i_ctx_t *i_ctx_p) /* Must be either a stack underflow or a t_[a]struct. */ check_op(2); { /* Get the type name from the structure. */ + if ((r_has_type(&op[-1], t_struct) || r_has_type(&op[-1], t_astruct)) && op[-1].value.pstruct != 0x00) { const char *sname = gs_struct_type_name_string(gs_object_type(imemory, op[-1].value.pstruct)); @@ -84,6 +85,8 @@ ztype(i_ctx_t *i_ctx_p) if (code < 0) return code; + } else + return_error(gs_error_stackunderflow); } r_set_attrs(op - 1, a_executable); } else {