Fix another potential use of pages array without checking (Issue #483)

michaelrsweet · Mar 28, 2022 · 3b44975 · 3b44975
1 parent 614fcba
commit 3b44975
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 2 deletions.
diff --git a/CHANGES.md b/CHANGES.md
@@ -2,7 +2,7 @@
 
 - Fixed a potential image overflow bug with JPEG and PNG images (Issue #471)
 - Fixed potential heap overflow bugs with pages (Issue #477, Issue #478,
-  Issue #480)
+  Issue #480, Issue #483)
 - Fixed potential use-after-free in blocks (Issue #484)
 - Fixed some minor Coverity warnings.
 - Updated the GUI interface for current display fonts.

diff --git a/htmldoc/ps-pdf.cxx b/htmldoc/ps-pdf.cxx
@@ -7198,26 +7198,28 @@ parse_table(tree_t *t,			// I - Tree to parse
       // Draw background on multiple pages...
 
       // Bottom of first page...
+      check_pages(table_page);
       new_render(table_page, RENDER_BOX, table.border_left, bottom,
 	         width, table_y - bottom, bgrgb,
 		 pages[table_page].start);
 
       // Intervening pages...
       for (temp_page = table_page + 1; temp_page < *page; temp_page ++)
       {
+        check_pages(temp_page);
         new_render(temp_page, RENDER_BOX, table.border_left, bottom,
                    width, top - bottom, bgrgb, pages[temp_page].start);
       }
 
       // Top of last page...
       check_pages(*page);
-
       new_render(*page, RENDER_BOX, table.border_left, *y,
 	         width, top - *y, bgrgb, pages[*page].start);
     }
     else
     {
       // Draw background in row...
+      check_pages(table_page);
       new_render(table_page, RENDER_BOX, table.border_left, *y,
 	         width, table_y - *y, bgrgb, pages[table_page].start);
     }