diff options
| author | Zdenek Hutyra <zhutyra@centrum.cz> | 2024-11-20 11:27:52 +0000 |
|---|---|---|
| committer | Chris Liddell <chris.liddell@artifex.com> | 2025-03-12 08:41:18 +0000 |
| commit | 920fae688705b3a25a1f8925f3837219a6243565 (patch) | |
| tree | a2c5f3db145ca9445e71e7285ef10b05b6c27875 | |
| parent | c370d28e079935f64f93f73f1a968cd51bb1c16e (diff) | |
Bug 708131: Fix confusion between bytes and shorts
We were copying data from a string in multiple of shorts, rather than multiple
of bytes, leading to both an read (probably benign, given the memory manager)
and write buffer overflow.
CVE-2025-27835
| -rw-r--r-- | psi/zbfont.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/psi/zbfont.c b/psi/zbfont.c index acffb39ef..5850ab54d 100644 --- a/psi/zbfont.c +++ b/psi/zbfont.c @@ -253,7 +253,7 @@ gs_font_map_glyph_to_unicode(gs_font *font, gs_glyph glyph, int ch, ushort *u, u if (l > length) return l; - memcpy(unicode_return, v->value.const_bytes, l * sizeof(short)); + memcpy(unicode_return, v->value.const_bytes, l); return l; } if (r_type(v) == t_integer) { |
