From 30d5e341367002ca5b853b6b651f63e97ba580d1 Mon Sep 17 00:00:00 2001 From: Chris Liddell Date: Sat, 8 Oct 2016 16:10:27 +0100 Subject: [PATCH] Bug 697203: check for sufficient params in .sethalftone5 and param types --- base/gserrors.h | 1 + psi/zht2.c | 12 ++++++++++-- 2 files changed, 11 insertions(+), 2 deletions(-) diff --git a/base/gserrors.h b/base/gserrors.h index 24b5eb4..c7dbe18 100644 --- a/base/gserrors.h +++ b/base/gserrors.h @@ -33,6 +33,7 @@ #define gs_error_limitcheck (-13) #define gs_error_nocurrentpoint (-14) #define gs_error_rangecheck (-15) +#define gs_error_stackunderflow (-17) #define gs_error_typecheck (-20) #define gs_error_undefined (-21) #define gs_error_undefinedfilename (-22) diff --git a/psi/zht2.c b/psi/zht2.c index a53b71b..95fef4b 100644 --- a/psi/zht2.c +++ b/psi/zht2.c @@ -81,14 +81,22 @@ zsethalftone5(i_ctx_t *i_ctx_p) gs_memory_t *mem; uint edepth = ref_stack_count(&e_stack); int npop = 2; - int dict_enum = dict_first(op); + int dict_enum; ref rvalue[2]; int cname, colorant_number; byte * pname; uint name_size; int halftonetype, type = 0; gs_state *pgs = igs; - int space_index = r_space_index(op - 1); + int space_index; + + if (ref_stack_count(&o_stack) < 2) + return_error(gs_error_stackunderflow); + check_type(*op, t_dictionary); + check_type(*(op - 1), t_dictionary); + + dict_enum = dict_first(op); + space_index = r_space_index(op - 1); mem = (gs_memory_t *) idmemory->spaces_indexed[space_index]; -- 2.7.4