Bug 693290: Avoid potential infinite loop in xps path parsing.

Another patch from zeniko; if we read an unknown cmd while parsing
a path string, ensure that we skip over any subsequent numbers to
avoid going into an infinite loop.

1 files changed, 4 insertions, 0 deletions

diff --git a/xps/xps_path.c b/xps/xps_path.c
index 3bc92ff3..54acc114 100644
--- a/xps/xps_path.c
+++ b/xps/xps_path.c
@@ -454,6 +454,10 @@ xps_parse_abbreviated_geometry(xps_document *doc, char *geom, int *fill_rule)
 
 		default:
 			/* eek */
+			fz_warn(doc->ctx, "ignoring invalid command '%c'", cmd);
+			/* Skip any trailing numbers to avoid an infinite loop */
+			while (i < n && (args[i][0] == '+' || args[i][0] == '.' || args[i][0] == '-' || (args[i][0] >= '0' && args[i][0] <= '9')))
+				i ++;
 			break;
 		}