summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorZdenek Hutyra <zhutyra@centrum.cz>2024-11-20 11:27:52 +0000
committerChris Liddell <chris.liddell@artifex.com>2025-03-12 09:36:57 +0000
commitde900010a6f2310d1fd54e99eeba466693da0e13 (patch)
tree41db3a6e6f94f3d2978bc4afc20bc1878606a49d
parentf97b4f82336ea1fbf42c0769518cd62ebe1ad0fb (diff)
Bug 708131: Fix confusion between bytes and shorts
We were copying data from a string in multiple of shorts, rather than multiple of bytes, leading to both an read (probably benign, given the memory manager) and write buffer overflow. CVE-2025-27835
-rw-r--r--psi/zbfont.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/psi/zbfont.c b/psi/zbfont.c
index acffb39ef..5850ab54d 100644
--- a/psi/zbfont.c
+++ b/psi/zbfont.c
@@ -253,7 +253,7 @@ gs_font_map_glyph_to_unicode(gs_font *font, gs_glyph glyph, int ch, ushort *u, u
if (l > length)
return l;
- memcpy(unicode_return, v->value.const_bytes, l * sizeof(short));
+ memcpy(unicode_return, v->value.const_bytes, l);
return l;
}
if (r_type(v) == t_integer) {