diff options
| author | Sebastian Rasmussen <sebras@gmail.com> | 2017-10-04 21:12:13 +0200 |
|---|---|---|
| committer | Sebastian Rasmussen <sebras@gmail.com> | 2017-10-05 13:07:43 +0200 |
| commit | 1246b9c7fa031c3db8f0bfaeb7be367636d7cdec (patch) | |
| tree | 5d1cec4ef1c6884f10f30c970d143abedafb4198 | |
| parent | 298f9f29c9e3ca4ff056320a23584f16be614c81 (diff) | |
| download | mupdf-1246b9c7fa031c3db8f0bfaeb7be367636d7cdec.tar.xz | |
Fix out of bounds check in pnm parser.
| -rw-r--r-- | source/fitz/load-pnm.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/source/fitz/load-pnm.c b/source/fitz/load-pnm.c index c30d0688..f0865e51 100644 --- a/source/fitz/load-pnm.c +++ b/source/fitz/load-pnm.c @@ -137,7 +137,7 @@ pnm_read_number(fz_context *ctx, unsigned char *p, unsigned char *e, int *number { if (e - p < 1) fz_throw(ctx, FZ_ERROR_GENERIC, "cannot parse number in pnm image"); - if (*p < '0' && *p > '9') + if (*p < '0' || *p > '9') fz_throw(ctx, FZ_ERROR_GENERIC, "expected numeric field in pnm image"); while (p < e && *p >= '0' && *p <= '9') |