summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorZdenek Hutyra <zhutyra@centrum.cz>2025-01-20 16:13:46 +0000
committerChris Liddell <chris.liddell@artifex.com>2025-03-12 09:36:57 +0000
commitef42ff180a04926e187d40faea40d4a43e304e3b (patch)
treed16239335ff8ff7b09de48dd6ea876531722a663
parentdbb9f2b11f820697e77863523a8d835ab040e5d1 (diff)
PDF interpreter - Guard against unsigned int overflow
Bug #708253 - see bug report for details. CVE-2025-27834
-rw-r--r--pdf/pdf_func.c13
1 files changed, 13 insertions, 0 deletions
diff --git a/pdf/pdf_func.c b/pdf/pdf_func.c
index 635fdac54..93492c783 100644
--- a/pdf/pdf_func.c
+++ b/pdf/pdf_func.c
@@ -153,6 +153,9 @@ pdfi_parse_type4_func_stream(pdf_context *ctx, pdf_c_stream *function_stream, in
byte *p = (ops ? ops + *size : NULL);
while (1) {
+ if (*size > max_uint / 2)
+ return gs_note_error(gs_error_VMerror);
+
c = pdfi_read_byte(ctx, function_stream);
if (c < 0)
break;
@@ -321,6 +324,11 @@ pdfi_build_function_4(pdf_context *ctx, gs_function_params_t * mnDR,
if (code < 0)
goto function_4_error;
+ if (size > max_uint - 1) {
+ code = gs_note_error(gs_error_VMerror);
+ goto function_4_error;
+ }
+
ops = gs_alloc_string(ctx->memory, size + 1, "pdfi_build_function_4(ops)");
if (ops == NULL) {
code = gs_error_VMerror;
@@ -825,6 +833,11 @@ int pdfi_build_halftone_function(pdf_context *ctx, gs_function_t ** ppfn, byte *
if (code < 0)
goto halftone_function_error;
+ if (size > max_uint - 1) {
+ code = gs_note_error(gs_error_VMerror);
+ goto halftone_function_error;
+ }
+
ops = gs_alloc_string(ctx->memory, size + 1, "pdfi_build_halftone_function(ops)");
if (ops == NULL) {
code = gs_error_VMerror;