Segfault scanning non-font files. Disallow scan edit of user vars. (#8767)

[fontconfig.git] / src / fcxml.c

diff --git a/src/fcxml.c b/src/fcxml.c
index a9453ebc0b01b31187320bcd5b08057836affe86..156599ca2fd5d8b5a94763664febc32920d7a826 100644 (file)
--- a/src/fcxml.c
+++ b/src/fcxml.c
@@ -1845,6 +1845,12 @@ FcParseMatch (FcConfigParse *parse)
            vstack->u.edit->next = edit;
            edit = vstack->u.edit;
            vstack->tag = FcVStackNone;
+           if (kind == FcMatchScan && edit->object > FC_MAX_BASE_OBJECT)
+           {
+               FcConfigMessage (parse, FcSevereError, 
+                                "<match target=\"scan\"> cannot edit user-defined object \"%s\"",
+                                FcObjectName(edit->object));
+           }
            break;
        default:
            FcConfigMessage (parse, FcSevereWarning, "invalid match element");