Bug 705772 XPS Ensure cff pointer offsets are not negative

1 files changed, 6 insertions, 0 deletions

diff --git a/xps/xpscff.c b/xps/xpscff.c
index 8d9f6367b..0978d80de 100644
--- a/xps/xpscff.c
+++ b/xps/xpscff.c
@@ -204,17 +204,23 @@ xps_read_cff_dict(byte *p, byte *e, xps_font_t *font, gs_font_type1 *pt1)
 
             if (b0 == 17)
             {
+                if (args[0].ival < 0)
+                    return gs_throw(-1, "corrupt cff file offset");
                 font->charstrings = font->cffdata + args[0].ival;
             }
 
             if (b0 == 18)
             {
+                if (args[0].ival < 0 || args[1].ival < 0)
+                    return gs_throw(-1, "corrupt cff file offset");
                 privatelen = args[0].ival;
                 privateofs = args[1].ival;
             }
 
             if (b0 == 19)
             {
+                if (args[0].ival < 0)
+                    return gs_throw(-1, "corrupt cff file offset");
                 font->subrs = font->cffdata + offset + args[0].ival;
             }