52 lines
2.2 KiB
Diff
52 lines
2.2 KiB
Diff
|
diff -up ghostscript-9.06/base/gdevpdtd.c.pdfwrite-segfault ghostscript-9.06/base/gdevpdtd.c
|
||
|
|
--- ghostscript-9.06/base/gdevpdtd.c.pdfwrite-segfault 2012-08-08 09:01:36.000000000 +0100
|
||
|
|
+++ ghostscript-9.06/base/gdevpdtd.c 2013-05-16 09:28:07.410407852 +0100
|
||
|
|
@@ -699,7 +699,7 @@ pdf_write_FontDescriptor(gx_device_pdf *
|
||
|
|
if (code < 0)
|
||
|
|
return code;
|
||
|
|
}
|
||
|
|
- if (pfd->embed) {
|
||
|
|
+ if (pfd->embed && pfd->base_font->FontFile) {
|
||
|
|
code = pdf_write_FontFile_entry(pdev, pfd->base_font);
|
||
|
|
if (code < 0)
|
||
|
|
return code;
|
||
|
|
diff -up ghostscript-9.06/base/gxtype1.c.pdfwrite-segfault ghostscript-9.06/base/gxtype1.c
|
||
|
|
--- ghostscript-9.06/base/gxtype1.c.pdfwrite-segfault 2012-08-08 09:01:36.000000000 +0100
|
||
|
|
+++ ghostscript-9.06/base/gxtype1.c 2013-05-16 09:28:07.409407814 +0100
|
||
|
|
@@ -371,7 +371,7 @@ gs_type1_piece_codes(/*const*/ gs_font_t
|
||
|
|
const byte *cip, *end;
|
||
|
|
crypt_state state;
|
||
|
|
int c, hhints = 0, vhints = 0;
|
||
|
|
- int code;
|
||
|
|
+ int code, call_depth = 0;
|
||
|
|
|
||
|
|
CLEAR_CSTACK(cstack, csp);
|
||
|
|
cip = pgd->bits.data;
|
||
|
|
@@ -450,6 +450,7 @@ gs_type1_piece_codes(/*const*/ gs_font_t
|
||
|
|
}
|
||
|
|
break;
|
||
|
|
case c2_callgsubr:
|
||
|
|
+ call_depth++;
|
||
|
|
c = fixed2int_var(*csp) + pdata->gsubrNumberBias;
|
||
|
|
code = pdata->procs.subr_data
|
||
|
|
(pfont, c, true, &ipsp[1].cs_data);
|
||
|
|
@@ -462,6 +463,7 @@ gs_type1_piece_codes(/*const*/ gs_font_t
|
||
|
|
end = ipsp->cs_data.bits.data + ipsp->cs_data.bits.size;
|
||
|
|
goto call;
|
||
|
|
case c_callsubr:
|
||
|
|
+ call_depth++;
|
||
|
|
c = fixed2int_var(*csp) + pdata->subroutineNumberBias;
|
||
|
|
code = pdata->procs.subr_data
|
||
|
|
(pfont, c, false, &ipsp[1].cs_data);
|
||
|
|
@@ -474,6 +476,10 @@ gs_type1_piece_codes(/*const*/ gs_font_t
|
||
|
|
end = ipsp->cs_data.bits.data + ipsp->cs_data.bits.size;
|
||
|
|
goto call;
|
||
|
|
case c_return:
|
||
|
|
+ if (call_depth == 0)
|
||
|
|
+ return (gs_note_error(gs_error_invalidfont));
|
||
|
|
+ else
|
||
|
|
+ call_depth--;
|
||
|
|
gs_glyph_data_free(&ipsp->cs_data, "gs_type1_piece_codes");
|
||
|
|
--ipsp;
|
||
|
|
if (ipsp < ipstack)
|