summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorZdenek Hutyra <zhutyra@centrum.cz>2024-11-20 11:27:52 +0000
committerChris Liddell <chris.liddell@artifex.com>2025-03-12 08:41:18 +0000
commit920fae688705b3a25a1f8925f3837219a6243565 (patch)
treea2c5f3db145ca9445e71e7285ef10b05b6c27875
parentc370d28e079935f64f93f73f1a968cd51bb1c16e (diff)
Bug 708131: Fix confusion between bytes and shorts
We were copying data from a string in multiple of shorts, rather than multiple of bytes, leading to both an read (probably benign, given the memory manager) and write buffer overflow. CVE-2025-27835
-rw-r--r--psi/zbfont.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/psi/zbfont.c b/psi/zbfont.c
index acffb39ef..5850ab54d 100644
--- a/psi/zbfont.c
+++ b/psi/zbfont.c
@@ -253,7 +253,7 @@ gs_font_map_glyph_to_unicode(gs_font *font, gs_glyph glyph, int ch, ushort *u, u
if (l > length)
return l;
- memcpy(unicode_return, v->value.const_bytes, l * sizeof(short));
+ memcpy(unicode_return, v->value.const_bytes, l);
return l;
}
if (r_type(v) == t_integer) {