1 files changed, 3 insertions, 0 deletions

diff --git a/gs/devices/vector/gdevpsf1.c b/gs/devices/vector/gdevpsf1.c
index e552fb886..370686440 100644
--- a/gs/devices/vector/gdevpsf1.c
+++ b/gs/devices/vector/gdevpsf1.c
@@ -237,6 +237,7 @@ static int CheckSubrForMM (gs_glyph_data_t *gdata, gs_font_type1 *pfont)
     byte *source = data->data, *end = source + data->size;
     int CurrentNumberIndex = 0, Stack[32];
 
+    memset(Stack, 0x00, sizeof(Stack));
     gs_type1_decrypt(source, source, data->size, &state);
 
     if(pfont->data.lenIV)
@@ -248,6 +249,8 @@ static int CheckSubrForMM (gs_glyph_data_t *gdata, gs_font_type1 *pfont)
             switch (*source) {
                 case 12:
                     if (*(source + 1) == 16) {
+                        if (CurrentNumberIndex < 1)
+                            return gs_error_rangecheck;
                         switch(Stack[CurrentNumberIndex-1]) {
                             case 18:
                                 code = 6;