summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorZdenek Hutyra <zhutyra@centrum.cz>2025-01-20 09:38:59 +0000
committerChris Liddell <chris.liddell@artifex.com>2025-03-12 09:36:57 +0000
commita82738e387bbb44c7c4698404776dca53f62b158 (patch)
tree9bcfa8e8a0a83751b1e1ed5421e8b1ae4e296953
parent8474e1d6b896e35741d3c608ea5c21deeec1078f (diff)
Bug 708259: Check TTF name size before copying to buffer.
CVE-2025-27833
-rw-r--r--pdf/pdf_fmap.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/pdf/pdf_fmap.c b/pdf/pdf_fmap.c
index 73af9771d..63e61d003 100644
--- a/pdf/pdf_fmap.c
+++ b/pdf/pdf_fmap.c
@@ -749,7 +749,7 @@ static int pdfi_ttf_add_to_native_map(pdf_context *ctx, stream *f, byte magic[4]
int nl = u16(rec + 8);
int noffs = u16(rec + 10);
- if (nl + noffs + storageOffset > table_len) {
+ if (nl + noffs + storageOffset > table_len || nl >= pname_size) {
break;
}
memcpy(pname, namet + storageOffset + noffs, nl);
@@ -787,7 +787,7 @@ static int pdfi_ttf_add_to_native_map(pdf_context *ctx, stream *f, byte magic[4]
int nl = u16(rec + 8);
int noffs = u16(rec + 10);
- if (nl + noffs + storageOffset > table_len) {
+ if (nl + noffs + storageOffset > table_len || nl >= pname_size) {
break;
}
memcpy(pname, namet + storageOffset + noffs, nl);