[poppler] Branch 'poppler-0.22' - poppler/Function.cc

[Albert Astals Cid]

 poppler/Function.cc |    6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

New commits:
commit e14b6e9c13d35c9bd1e0c50906ace8e707816888
Author: Albert Astals Cid <aacid at kde.org>
Date:   Thu Jan 10 20:52:02 2013 +0100

    Fix invalid memory access in 2030.pdf.asan.69.463

diff --git a/poppler/Function.cc b/poppler/Function.cc
index 1dece2d..2f94a54 100644
--- a/poppler/Function.cc
+++ b/poppler/Function.cc
@@ -13,7 +13,7 @@
 // All changes made under the Poppler project to this file are licensed
 // under GPL version 2 or later
 //
-// Copyright (C) 2006, 2008-2010 Albert Astals Cid <aacid at kde.org>
+// Copyright (C) 2006, 2008-2010, 2013 Albert Astals Cid <aacid at kde.org>
 // Copyright (C) 2006 Jeff Muizelaar <jeff at infidigm.net>
 // Copyright (C) 2010 Christian Feuersänger <cfeuersaenger at googlemail.com>
 // Copyright (C) 2011 Andrea Canciani <ranma42 at gmail.com>
@@ -1111,6 +1111,10 @@ void PSStack::copy(int n) {
     error(errSyntaxError, -1, "Stack underflow in PostScript function");
     return;
   }
+  if (unlikely(sp - n > psStackSize)) {
+    error(errSyntaxError, -1, "Stack underflow in PostScript function");
+    return;
+  }
   if (!checkOverflow(n)) {
     return;
   }