From: Sebastian Rasmussen <sebras@gmail.com>
Date: Wed, 27 Jul 2016 14:19:39 +0000 (+0800)
Subject: Make sure that number of colors in mesh params is valid.
X-Git-Url: http://git.ghostscript.com/?p=mupdf.git;a=commitdiff_plain;h=39b0f07dd960f34e7e6bf230ffc3d87c41ef0f2e;hp=fa1936405b6a84e5c9bb440912c23d532772f958

Make sure that number of colors in mesh params is valid.

Fixes bug 696954.
---

diff --git a/source/pdf/pdf-shade.c b/source/pdf/pdf-shade.c
index 7815b3c..6e25efa 100644
--- a/source/pdf/pdf-shade.c
+++ b/source/pdf/pdf-shade.c
@@ -206,7 +206,7 @@ pdf_load_mesh_params(fz_context *ctx, pdf_document *doc, fz_shade *shade, pdf_ob
 	obj = pdf_dict_get(ctx, dict, PDF_NAME_Decode);
 	if (pdf_array_len(ctx, obj) >= 6)
 	{
-		n = (pdf_array_len(ctx, obj) - 4) / 2;
+		n = fz_mini(FZ_MAX_COLORS, (pdf_array_len(ctx, obj) - 4) / 2);
 		shade->u.m.x0 = pdf_to_real(ctx, pdf_array_get(ctx, obj, 0));
 		shade->u.m.x1 = pdf_to_real(ctx, pdf_array_get(ctx, obj, 1));
 		shade->u.m.y0 = pdf_to_real(ctx, pdf_array_get(ctx, obj, 2));