Bug 705552 : XPS interpreter

Fixed an issue in which deobfuscating a font file that was less than
32 bytes would cause buffer overflow. A warning is now signaled when
this happens.

1 files changed, 8 insertions, 1 deletions

diff --git a/xps/xpsglyphs.c b/xps/xpsglyphs.c
index 76e17e7fe..59b3427dd 100644
--- a/xps/xpsglyphs.c
+++ b/xps/xpsglyphs.c
@@ -1,4 +1,4 @@
-/* Copyright (C) 2001-2021 Artifex Software, Inc.
+/* Copyright (C) 2001-2022 Artifex Software, Inc.
    All Rights Reserved.
 
    This software is provided AS-IS with no warranty, either express or
@@ -91,6 +91,13 @@ xps_deobfuscate_font_resource(xps_context_t *ctx, xps_part_t *part)
     char *p;
     int i;
 
+    /* Ensure the part has at least 32 bytes we can write */
+    if (part->size < 32)
+    {
+        gs_warn("obfuscated font part is too small");
+        return;
+    }
+
     p = strrchr(part->name, '/');
     if (!p)
         p = part->name;