oss-fuzz 30715: Check stack limits after function evaluation.

During function result sampling, after the callout to the Postscript
interpreter, make sure there is enough stack space available before pushing
or popping entries.

In thise case, the Postscript procedure for the "function" is totally invalid
(as a function), and leaves the op stack in an unrecoverable state (as far as
function evaluation is concerned). We end up popping more entries off the
stack than are available.

To cope, add in stack limit checking to throw an appropriate error when this
happens.

1 files changed, 11 insertions, 3 deletions

diff --git a/psi/zfsample.c b/psi/zfsample.c
index 290809405..652ae02c6 100644
--- a/psi/zfsample.c
+++ b/psi/zfsample.c
@@ -551,9 +551,17 @@ sampled_data_continue(i_ctx_t *i_ctx_p)
     } else {
         if (stack_depth_adjust) {
             stack_depth_adjust -= num_out;
-            push(O_STACK_PAD - stack_depth_adjust);
-            for (i=0;i<O_STACK_PAD - stack_depth_adjust;i++)
-                make_null(op - i);
+            if ((O_STACK_PAD - stack_depth_adjust) < 0) {
+                stack_depth_adjust = -(O_STACK_PAD - stack_depth_adjust);
+                check_op(stack_depth_adjust);
+                pop(stack_depth_adjust);
+            }
+            else {
+                check_ostack(O_STACK_PAD - stack_depth_adjust);
+                push(O_STACK_PAD - stack_depth_adjust);
+                for (i=0;i<O_STACK_PAD - stack_depth_adjust;i++)
+                    make_null(op - i);
+            }
         }
     }