diff options
author | Chris Liddell <chris.liddell@artifex.com> | 2017-06-12 13:15:17 +0100 |
---|---|---|
committer | Chris Liddell <chris.liddell@artifex.com> | 2017-06-12 18:00:21 +0100 |
commit | 98f6da60b9d463c617e631fc254cf6d66f2e8e3c (patch) | |
tree | 8fd8668cca51617d981482acdede2183a7793100 | |
parent | c7c55972758a93350882c32147801a3485b010fe (diff) |
Bug 698026: bounds check zone pointers in Ins_IP()
-rw-r--r-- | base/ttinterp.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/base/ttinterp.c b/base/ttinterp.c index f6a6d95fe..e7c9d68f7 100644 --- a/base/ttinterp.c +++ b/base/ttinterp.c | |||
@@ -4129,7 +4129,9 @@ static int nInstrCount=0; | |||
4129 | Int point; | 4129 | Int point; |
4130 | (void)args; | 4130 | (void)args; |
4131 | 4131 | ||
4132 | if ( CUR.top < CUR.GS.loop ) | 4132 | if ( CUR.top < CUR.GS.loop || |
4133 | BOUNDS(CUR.GS.rp1, CUR.zp0.n_points) || | ||
4134 | BOUNDS(CUR.GS.rp2, CUR.zp1.n_points)) | ||
4133 | { | 4135 | { |
4134 | CUR.error = TT_Err_Invalid_Reference; | 4136 | CUR.error = TT_Err_Invalid_Reference; |
4135 | return; | 4137 | return; |