summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorZdenek Hutyra <zhutyra@centrum.cz>2025-01-13 09:15:01 +0000
committerChris Liddell <chris.liddell@artifex.com>2025-03-12 09:36:57 +0000
commit8474e1d6b896e35741d3c608ea5c21deeec1078f (patch)
tree367d9cbf0498007d02dd249741365a6435a6b529
parent8b6d19b2b4079da6863ef25f2370f25d4b054919 (diff)
Bug 708241: Fix potential Buffer overflow with DollarBlend
During serializing a multiple master font for passing to Freetype. Use CVE-2025-27830
-rw-r--r--base/write_t1.c9
-rw-r--r--psi/zfapi.c9
2 files changed, 12 insertions, 6 deletions
diff --git a/base/write_t1.c b/base/write_t1.c
index 1faaeb583..6b4482d04 100644
--- a/base/write_t1.c
+++ b/base/write_t1.c
@@ -1,4 +1,4 @@
-/* Copyright (C) 2001-2024 Artifex Software, Inc.
+/* Copyright (C) 2001-2025 Artifex Software, Inc.
All Rights Reserved.
This software is provided AS-IS with no warranty, either express or
@@ -628,6 +628,7 @@ write_main_dictionary(gs_fapi_font * a_fapi_font, WRF_output * a_output, int Wri
WRF_wbyte(a_fapi_font->memory, a_output, '\n');
if (is_MM_font(a_fapi_font)) {
short x, x2;
+ unsigned short ux;
float x1;
uint i, j, entries;
char Buffer[255];
@@ -759,16 +760,16 @@ write_main_dictionary(gs_fapi_font * a_fapi_font, WRF_output * a_output, int Wri
*/
code = a_fapi_font->get_word(a_fapi_font,
gs_fapi_font_feature_DollarBlend_length,
- 0, (unsigned short *)&x);
+ 0, &ux);
if (code < 0)
return code;
- if (x > 0) {
+ if (ux > 0) {
int len;
WRF_wstring(a_fapi_font->memory, a_output, "/$Blend {");
if (a_output->m_count)
- a_output->m_count += x;
+ a_output->m_count += ux;
len = a_fapi_font->get_proc(a_fapi_font,
gs_fapi_font_feature_DollarBlend, 0,
(char *)a_output->m_pos);
diff --git a/psi/zfapi.c b/psi/zfapi.c
index fc6141d6b..fc342a81e 100644
--- a/psi/zfapi.c
+++ b/psi/zfapi.c
@@ -694,7 +694,7 @@ FAPI_FF_get_word(gs_fapi_font *ff, gs_fapi_font_feature var_id, int index, unsig
/* When reading the real proc, we add a space between each entry */
length++;
if (array_get(ff->memory, DBlend, i, &Element) < 0) {
- *ret = 0;
+ length = 0;
break;
}
switch (r_btype(&Element)) {
@@ -721,7 +721,12 @@ FAPI_FF_get_word(gs_fapi_font *ff, gs_fapi_font_feature var_id, int index, unsig
default:
break;
}
- }
+
+ if (length > max_ushort) {
+ length = 0;
+ break;
+ }
+ }
*ret = length;
break;
}