diff options
| author | Chris Liddell <chris.liddell@artifex.com> | 2017-06-12 13:08:40 +0100 |
|---|---|---|
| committer | Chris Liddell <chris.liddell@artifex.com> | 2017-06-12 18:00:21 +0100 |
| commit | c7c55972758a93350882c32147801a3485b010fe (patch) | |
| tree | 6620cf0ae051cbdb9e38113a4e998f9570c5531e | |
| parent | d2ab84732936b6e7e5a461dc94344902965e9a06 (diff) | |
Bug 698024: bounds check zone pointer in Ins_MIRP()
| -rw-r--r-- | base/ttinterp.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/base/ttinterp.c b/base/ttinterp.c index e56aec68d..f6a6d95fe 100644 --- a/base/ttinterp.c +++ b/base/ttinterp.c | |||
| @@ -3858,7 +3858,8 @@ static int nInstrCount=0; | |||
| 3858 | /* XXX: UNDOCUMENTED! cvt[-1] = 0 always */ | 3858 | /* XXX: UNDOCUMENTED! cvt[-1] = 0 always */ |
| 3859 | 3859 | ||
| 3860 | if ( BOUNDS( args[0], CUR.zp1.n_points ) || | 3860 | if ( BOUNDS( args[0], CUR.zp1.n_points ) || |
| 3861 | BOUNDS( args[1]+1, CUR.cvtSize+1 ) ) | 3861 | BOUNDS( args[1]+1, CUR.cvtSize+1 ) || |
| 3862 | BOUNDS(CUR.GS.rp0, CUR.zp0.n_points) ) | ||
| 3862 | { | 3863 | { |
| 3863 | CUR.error = TT_Err_Invalid_Reference; | 3864 | CUR.error = TT_Err_Invalid_Reference; |
| 3864 | return; | 3865 | return; |