Skip to content

Commit

Permalink
raster-interpret.c: Fix CVE-2023-4504
Browse files Browse the repository at this point in the history
We didn't check for end of buffer if it looks there is an escaped
character - check for NULL terminator there and if found, return NULL
as return value and in `ptr`, because a lone backslash is not
a valid PostScript character.
  • Loading branch information
zdohnal committed Sep 4, 2023
1 parent 30b35cc commit 262c909
Showing 1 changed file with 13 additions and 1 deletion.
14 changes: 13 additions & 1 deletion ppd/raster-interpret.c
Expand Up @@ -1270,7 +1270,19 @@ ppd_scan_ps(_ppd_ps_stack_t *st, // I - Stack

cur ++;

if (*cur == 'b')
/*
* Return NULL if we reached NULL terminator, a lone backslash
* is not a valid character in PostScript.
*/

if (!*cur)
{
*ptr = NULL;

return (NULL);
}

if (*cur == 'b')
*valptr++ = '\b';
else if (*cur == 'f')
*valptr++ = '\f';
Expand Down

0 comments on commit 262c909

Please sign in to comment.