From 875a0095f37626a721c7ff57d606a0f95af03913 Mon Sep 17 00:00:00 2001 From: Ken Sharp Date: Wed, 5 Oct 2016 10:10:58 +0100 Subject: [PATCH] DSC parser - validate parameters Bug #697190 ".initialize_dsc_parser doesn't validate the parameter is a dict type before using it." Regardless of any security implications, its simply wrong for a PostScript operator not to validate its parameter(s). No differences expected. Upstream-Status: Backport CVE: CVE-2016-7979 Signed-off-by: Catalin Enache --- psi/zdscpars.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/psi/zdscpars.c b/psi/zdscpars.c index c05e154..9b4b605 100644 --- a/psi/zdscpars.c +++ b/psi/zdscpars.c @@ -150,11 +150,16 @@ zinitialize_dsc_parser(i_ctx_t *i_ctx_p) ref local_ref; int code; os_ptr const op = osp; - dict * const pdict = op->value.pdict; - gs_memory_t * const mem = (gs_memory_t *)dict_memory(pdict); - dsc_data_t * const data = - gs_alloc_struct(mem, dsc_data_t, &st_dsc_data_t, "DSC parser init"); + dict *pdict; + gs_memory_t *mem; + dsc_data_t *data; + check_read_type(*op, t_dictionary); + + pdict = op->value.pdict; + mem = (gs_memory_t *)dict_memory(pdict); + + data = gs_alloc_struct(mem, dsc_data_t, &st_dsc_data_t, "DSC parser init"); if (!data) return_error(gs_error_VMerror); data->document_level = 0; -- 2.10.2