diff options
author | Zdenek Hutyra <zhutyra@centrum.cz> | 2025-01-20 09:38:59 +0000 |
---|---|---|
committer | Chris Liddell <chris.liddell@artifex.com> | 2025-03-12 09:36:57 +0000 |
commit | a82738e387bbb44c7c4698404776dca53f62b158 (patch) | |
tree | 9bcfa8e8a0a83751b1e1ed5421e8b1ae4e296953 | |
parent | 8474e1d6b896e35741d3c608ea5c21deeec1078f (diff) |
Bug 708259: Check TTF name size before copying to buffer.
CVE-2025-27833
-rw-r--r-- | pdf/pdf_fmap.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/pdf/pdf_fmap.c b/pdf/pdf_fmap.c index 73af9771d..63e61d003 100644 --- a/pdf/pdf_fmap.c +++ b/pdf/pdf_fmap.c @@ -749,7 +749,7 @@ static int pdfi_ttf_add_to_native_map(pdf_context *ctx, stream *f, byte magic[4] int nl = u16(rec + 8); int noffs = u16(rec + 10); - if (nl + noffs + storageOffset > table_len) { + if (nl + noffs + storageOffset > table_len || nl >= pname_size) { break; } memcpy(pname, namet + storageOffset + noffs, nl); @@ -787,7 +787,7 @@ static int pdfi_ttf_add_to_native_map(pdf_context *ctx, stream *f, byte magic[4] int nl = u16(rec + 8); int noffs = u16(rec + 10); - if (nl + noffs + storageOffset > table_len) { + if (nl + noffs + storageOffset > table_len || nl >= pname_size) { break; } memcpy(pname, namet + storageOffset + noffs, nl); |