From f21dc6f83de0db8f585d540974d756dc327c14d2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolan.mcnamara@collabora.com>
Date: Fri, 15 May 2026 11:37:21 +0000
Subject: [PATCH] ofz: check buffer bounds before reading multi-byte CFF dict
 operators
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: I434749e74e29f0aa3cda76746440af64cc2965dd
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/2693
Reviewed-by: Noel Grandin <noel.grandin@collabora.com>
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
(cherry picked from commit 7263a6b61264ebf1bdfe01c27e2e6c53bee7687b)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/207732
Tested-by: Jenkins
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
---
 vcl/source/fontsubset/cff.cxx | 29 +++++++++++++++++++++++++++++
 1 file changed, 29 insertions(+)

diff --git a/vcl/source/fontsubset/cff.cxx b/vcl/source/fontsubset/cff.cxx
index 93ca9dd67ac4..c1f5940cc057 100644
--- a/vcl/source/fontsubset/cff.cxx
+++ b/vcl/source/fontsubset/cff.cxx
@@ -1519,6 +1519,12 @@ void CffContext::readDictOp()
             pCmdName = pDictOps[nOpId];
         else
         {
+            if (mpReadPtr >= mpReadEnd)
+            {
+                SAL_WARN("vcl.fonts.cff", "truncated CFF dict op 12 escape");
+                abandonDictParse();
+                return;
+            }
             const U8 nExtId = *(mpReadPtr++);
             if (nExtId < 39)
                 pCmdName = pDictEscs[nExtId];
@@ -1702,6 +1708,12 @@ void CffContext::readDictOp()
     else if (c == 29)
     { // longint
         ++mpReadPtr; // skip 29
+        if (mpReadPtr + 4 > mpReadEnd)
+        {
+            SAL_WARN("vcl.fonts.cff", "truncated CFF dict longint");
+            abandonDictParse();
+            return;
+        }
         sal_Int32 nS32 = mpReadPtr[0] << 24;
         nS32 += mpReadPtr[1] << 16;
         nS32 += mpReadPtr[2] << 8;
@@ -1735,6 +1747,23 @@ void CffContext::read2push()
 
     const U8*& p = mpReadPtr;
     const U8 c = *p;
+    // total bytes consumed by this integer encoding, including the first
+    int nLen;
+    if (c == 28)
+        nLen = 3;
+    else if (c <= 246)
+        nLen = 1;
+    else if (c <= 254)
+        nLen = 2;
+    else
+        nLen = 5;
+    if (p + nLen > mpReadEnd)
+    {
+        SAL_WARN("vcl.fonts.cff", "truncated CFF dict integer (c=" << int(c) << ")");
+        abandonDictParse();
+        push(0);
+        return;
+    }
     if (c == 28)
     {
         sal_Int16 nS16 = (p[1] << 8) + p[2];