diff options
| author | Sebastian Rasmussen <sebras@gmail.com> | 2016-07-27 22:19:39 +0800 |
|---|---|---|
| committer | Sebastian Rasmussen <sebras@gmail.com> | 2016-07-31 13:04:13 +0800 |
| commit | 39b0f07dd960f34e7e6bf230ffc3d87c41ef0f2e (patch) | |
| tree | dcef469b09fbb1e5382d2c2fdb3da40a345e596c /source/pdf | |
| parent | fa1936405b6a84e5c9bb440912c23d532772f958 (diff) | |
| download | mupdf-39b0f07dd960f34e7e6bf230ffc3d87c41ef0f2e.tar.xz | |
Make sure that number of colors in mesh params is valid.
Fixes bug 696954.
Diffstat (limited to 'source/pdf')
| -rw-r--r-- | source/pdf/pdf-shade.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/source/pdf/pdf-shade.c b/source/pdf/pdf-shade.c index 7815b3ce..6e25efa8 100644 --- a/source/pdf/pdf-shade.c +++ b/source/pdf/pdf-shade.c @@ -206,7 +206,7 @@ pdf_load_mesh_params(fz_context *ctx, pdf_document *doc, fz_shade *shade, pdf_ob obj = pdf_dict_get(ctx, dict, PDF_NAME_Decode); if (pdf_array_len(ctx, obj) >= 6) { - n = (pdf_array_len(ctx, obj) - 4) / 2; + n = fz_mini(FZ_MAX_COLORS, (pdf_array_len(ctx, obj) - 4) / 2); shade->u.m.x0 = pdf_to_real(ctx, pdf_array_get(ctx, obj, 0)); shade->u.m.x1 = pdf_to_real(ctx, pdf_array_get(ctx, obj, 1)); shade->u.m.y0 = pdf_to_real(ctx, pdf_array_get(ctx, obj, 2)); |