[psaux] Avoid slow PS font parsing in case of error. Reported as https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9955 * src/psaux/psobjs.c (ps_parser_to_bytes): Set `parser->cursor' even in case of error to avoid potential re-scanning.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47
diff --git a/ChangeLog b/ChangeLog
index 4e30cdc..7b7c7cf 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,4 +1,15 @@
-2018-08-14 Werner Lemberg <wl@gnu.org>
+2018-08-18 Werner Lemberg <wl@gnu.org>
+
+ [psaux] Avoid slow PS font parsing in case of error.
+
+ Reported as
+
+ https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9955
+
+ * src/psaux/psobjs.c (ps_parser_to_bytes): Set `parser->cursor' even
+ in case of error to avoid potential re-scanning.
+
+2018-08-18 Werner Lemberg <wl@gnu.org>
[cff] Fix heap buffer overflow in old engine.
diff --git a/src/psaux/psobjs.c b/src/psaux/psobjs.c
index 97c9cb1..906c008 100644
--- a/src/psaux/psobjs.c
+++ b/src/psaux/psobjs.c
@@ -1447,6 +1447,8 @@
bytes,
max_bytes );
+ parser->cursor = cur;
+
if ( delimiters )
{
if ( cur < parser->limit && *cur != '>' )
@@ -1456,11 +1458,9 @@
goto Exit;
}
- cur++;
+ parser->cursor++;
}
- parser->cursor = cur;
-
Exit:
return error;
}