diff options
author | Zdenek Hutyra <zhutyra@centrum.cz> | 2025-01-13 09:15:01 +0000 |
---|---|---|
committer | Chris Liddell <chris.liddell@artifex.com> | 2025-03-12 09:36:57 +0000 |
commit | 8474e1d6b896e35741d3c608ea5c21deeec1078f (patch) | |
tree | 367d9cbf0498007d02dd249741365a6435a6b529 | |
parent | 8b6d19b2b4079da6863ef25f2370f25d4b054919 (diff) |
Bug 708241: Fix potential Buffer overflow with DollarBlend
During serializing a multiple master font for passing to Freetype.
Use CVE-2025-27830
-rw-r--r-- | base/write_t1.c | 9 | ||||
-rw-r--r-- | psi/zfapi.c | 9 |
2 files changed, 12 insertions, 6 deletions
diff --git a/base/write_t1.c b/base/write_t1.c index 1faaeb583..6b4482d04 100644 --- a/base/write_t1.c +++ b/base/write_t1.c @@ -1,4 +1,4 @@ -/* Copyright (C) 2001-2024 Artifex Software, Inc. +/* Copyright (C) 2001-2025 Artifex Software, Inc. All Rights Reserved. This software is provided AS-IS with no warranty, either express or @@ -628,6 +628,7 @@ write_main_dictionary(gs_fapi_font * a_fapi_font, WRF_output * a_output, int Wri WRF_wbyte(a_fapi_font->memory, a_output, '\n'); if (is_MM_font(a_fapi_font)) { short x, x2; + unsigned short ux; float x1; uint i, j, entries; char Buffer[255]; @@ -759,16 +760,16 @@ write_main_dictionary(gs_fapi_font * a_fapi_font, WRF_output * a_output, int Wri */ code = a_fapi_font->get_word(a_fapi_font, gs_fapi_font_feature_DollarBlend_length, - 0, (unsigned short *)&x); + 0, &ux); if (code < 0) return code; - if (x > 0) { + if (ux > 0) { int len; WRF_wstring(a_fapi_font->memory, a_output, "/$Blend {"); if (a_output->m_count) - a_output->m_count += x; + a_output->m_count += ux; len = a_fapi_font->get_proc(a_fapi_font, gs_fapi_font_feature_DollarBlend, 0, (char *)a_output->m_pos); diff --git a/psi/zfapi.c b/psi/zfapi.c index fc6141d6b..fc342a81e 100644 --- a/psi/zfapi.c +++ b/psi/zfapi.c @@ -694,7 +694,7 @@ FAPI_FF_get_word(gs_fapi_font *ff, gs_fapi_font_feature var_id, int index, unsig /* When reading the real proc, we add a space between each entry */ length++; if (array_get(ff->memory, DBlend, i, &Element) < 0) { - *ret = 0; + length = 0; break; } switch (r_btype(&Element)) { @@ -721,7 +721,12 @@ FAPI_FF_get_word(gs_fapi_font *ff, gs_fapi_font_feature var_id, int index, unsig default: break; } - } + + if (length > max_ushort) { + length = 0; + break; + } + } *ret = length; break; } |