diff options
author | Robin Watts <robin.watts@artifex.com> | 2012-12-13 17:51:07 +0000 |
---|---|---|
committer | Robin Watts <robin.watts@artifex.com> | 2012-12-13 17:53:49 +0000 |
commit | df835b0f23b4976b453d3bdd63c60804b2376c16 (patch) | |
tree | 3bc497e032e8e2fb190ed58f516f1168b76befff /xps | |
parent | 38f7744fb201f07db6035a55cfadfc7f55a41f57 (diff) | |
download | mupdf-df835b0f23b4976b453d3bdd63c60804b2376c16.tar.xz |
Bug 693290: Avoid potential infinite loop in xps path parsing.
Another patch from zeniko; if we read an unknown cmd while parsing
a path string, ensure that we skip over any subsequent numbers to
avoid going into an infinite loop.
Diffstat (limited to 'xps')
-rw-r--r-- | xps/xps_path.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/xps/xps_path.c b/xps/xps_path.c index 3bc92ff3..54acc114 100644 --- a/xps/xps_path.c +++ b/xps/xps_path.c @@ -454,6 +454,10 @@ xps_parse_abbreviated_geometry(xps_document *doc, char *geom, int *fill_rule) default: /* eek */ + fz_warn(doc->ctx, "ignoring invalid command '%c'", cmd); + /* Skip any trailing numbers to avoid an infinite loop */ + while (i < n && (args[i][0] == '+' || args[i][0] == '.' || args[i][0] == '-' || (args[i][0] >= '0' && args[i][0] <= '9'))) + i ++; break; } |