b2f6fbd9dd
fixes CVE-2017-7885, CVE-2017-7975 and CVE-2017-7976. Patches taken from the upstream ghostpdl git repository, http://git.ghostscript.com/?p=ghostpdl.git git revisions b184e783702246e154294326d03d9abda669fcfa ed6c5133a1004ce8d38f1b44de85a7186feda95e 5e57e483298dae8b8d4ec9aab37a526736ac2e97 and 73060a27e554f8e64ae2aba4a1b03822207346c7
13 lines
790 B
Diff
13 lines
790 B
Diff
diff --git a/jbig2dec/jbig2_symbol_dict.c b/jbig2dec/jbig2_symbol_dict.c
|
|
index 4acaba9..36225cb 100644 (file)
|
|
--- jbig2_symbol_dict.c
|
|
+++ jbig2_symbol_dict.c
|
|
@@ -629,7 +629,7 @@ jbig2_decode_symbol_dict(Jbig2Ctx *ctx,
|
|
byte *dst = image->data;
|
|
|
|
/* SumatraPDF: prevent read access violation */
|
|
- if (size - jbig2_huffman_offset(hs) < image->height * stride) {
|
|
+ if ((size - jbig2_huffman_offset(hs) < image->height * stride) || (size < jbig2_huffman_offset(hs))) {
|
|
jbig2_error(ctx, JBIG2_SEVERITY_FATAL, segment->number, "not enough data for decoding (%d/%d)", image->height * stride,
|
|
size - jbig2_huffman_offset(hs));
|
|
jbig2_image_release(ctx, image);
|