diff --git a/poppler/GfxState.cc b/poppler/GfxState.cc index e3413e5..2965e37 100644 --- a/poppler/GfxState.cc +++ b/poppler/GfxState.cc @@ -2161,10 +2161,16 @@ GfxColorSpace *GfxSeparationColorSpace::parse(Array *arr, Gfx *gfx, int recursio if (!(funcA = Function::parse(&obj1))) { goto err4; } + if (funcA->getInputSize() != 1) { + error(errSyntaxWarning, -1, "Bad SeparationColorSpace function"); + goto err5; + } obj1.free(); cs = new GfxSeparationColorSpace(nameA, altA, funcA); return cs; + err5: + delete funcA; err4: delete altA; err3: @@ -3084,6 +3090,10 @@ void GfxUnivariateShading::getColor(double t, GfxColor *color) { out[i] = 0; } for (i = 0; i < nFuncs; ++i) { + if (funcs[i]->getInputSize() != 1) { + error(errSyntaxWarning, -1, "Invalid shading function (input != 1)"); + break; + } funcs[i]->transform(&t, &out[i]); } }