From c96827da04f78d51823b9cf5922b071e62d7d4a3 Mon Sep 17 00:00:00 2001 From: Sebastião Guerra Date: Sat, 3 Oct 2026 10:37:31 -0300 Subject: KPDF: prevent invalid Type1C font dictionary access MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The FDSelect value used while converting embedded CID Type1C fonts is used as an index into privateDicts. Malformed font data can select an FD outside nFDs, causing an out-of-bounds access while KPDF generates PostScript for printing. Skip entries with an invalid FD before accessing the corresponding private dictionary. This is a backport of Poppler commit da63c35549e8852a410946ab016a3f25ac701bdf, which fixes CVE-2017-14976 / freedesktop.org Bug 102724. Original fix by: Albert Astals Cid Reported-by: Thierry de Coulon Report: https://mail.trinitydesktop.org/mailman3/hyperkitty/list/users@trinitydesktop.org/thread/2HTON7NW5XMOZLL3UJQ7OTLR26LN32GW/ Upstream: https://cgit.freedesktop.org/poppler/poppler/commit/?id=da63c35549e8852a410946ab016a3f25ac701bdf Signed-off-by: Sebastião Guerra --- kpdf/xpdf/fofi/FoFiType1C.cpp | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/kpdf/xpdf/fofi/FoFiType1C.cpp b/kpdf/xpdf/fofi/FoFiType1C.cpp index f2ca88dc..7924fdb3 100644 --- a/kpdf/xpdf/fofi/FoFiType1C.cpp +++ b/kpdf/xpdf/fofi/FoFiType1C.cpp @@ -796,6 +796,10 @@ void FoFiType1C::convertToType0(char *psName, } } + if (fd >= nFDs) { + continue; + } + // font dictionary (unencrypted section) (*outputFunc)(outputStream, "16 dict begin\n", 14); (*outputFunc)(outputStream, "/FontName /", 11); -- cgit v1.2.3