ghostpdl-10.07.0rc1_test004
tagged this
13 Mar 09:02
The function t1_hinter__flex_end assumes that when flex_count equals 8, pole_count is also at least 8, which may not be true, and it then modifies the contents of the pole array without checking it. Ensure we have at least 8 in the pole count before using.