diff options
| author | Zdenek Hutyra <zhutyra@centrum.cz> | 2024-11-20 11:27:52 +0000 |
|---|---|---|
| committer | Chris Liddell <chris.liddell@artifex.com> | 2025-03-12 09:36:57 +0000 |
| commit | de900010a6f2310d1fd54e99eeba466693da0e13 (patch) | |
| tree | 41db3a6e6f94f3d2978bc4afc20bc1878606a49d | |
| parent | f97b4f82336ea1fbf42c0769518cd62ebe1ad0fb (diff) | |
Bug 708131: Fix confusion between bytes and shorts
We were copying data from a string in multiple of shorts, rather than multiple
of bytes, leading to both an read (probably benign, given the memory manager)
and write buffer overflow.
CVE-2025-27835
| -rw-r--r-- | psi/zbfont.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/psi/zbfont.c b/psi/zbfont.c index acffb39ef..5850ab54d 100644 --- a/psi/zbfont.c +++ b/psi/zbfont.c @@ -253,7 +253,7 @@ gs_font_map_glyph_to_unicode(gs_font *font, gs_glyph glyph, int ch, ushort *u, u if (l > length) return l; - memcpy(unicode_return, v->value.const_bytes, l * sizeof(short)); + memcpy(unicode_return, v->value.const_bytes, l); return l; } if (r_type(v) == t_integer) { |
