Bug 698063: Bounds check Ins_JMPR

1 files changed, 6 insertions, 0 deletions

diff --git a/base/ttinterp.c b/base/ttinterp.c
index af457e89f..adf3f0c94 100644
--- a/base/ttinterp.c
+++ b/base/ttinterp.c
@@ -1794,6 +1794,12 @@ static int nInstrCount=0;
 
   static void  Ins_JMPR( INS_ARG )
   {
+    if ( BOUNDS(CUR.IP + args[0], CUR.codeSize ) )
+    {
+      CUR.error = TT_Err_Invalid_Reference;
+      return;
+    }
+
     CUR.IP      += (Int)(args[0]);
     CUR.step_ins = FALSE;