From 6dab38fb211f15226c242ab7a83fa53e4b0ff781 Mon Sep 17 00:00:00 2001
From: Piotr Kajda <petermasterperfect@gmail.com>
Date: Thu, 8 May 2025 11:37:09 +0100
Subject: [PATCH] pdfwrite - bounds check some strings

Bug #708517

This differs very slightly from the proposed patch in the bug report, I
had a quick scout through the C file and found another similar case.

Both fixed here.

CVE: CVE-2025-59799
Upstream-Status: Backport [https://github.com/ArtifexSoftware/ghostpdl/commit/6dab38fb211f15226c242ab7a83fa53e4b0ff781]
Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
 devices/vector/gdevpdfm.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/devices/vector/gdevpdfm.c b/devices/vector/gdevpdfm.c
index 5aa3644e2..4b1d7d89c 100644
--- a/devices/vector/gdevpdfm.c
+++ b/devices/vector/gdevpdfm.c
@@ -199,6 +199,8 @@ pdfmark_coerce_dest(gs_param_string *dstr, char dest[MAX_DEST_STRING])
 {
     const byte *data = dstr->data;
     uint size = dstr->size;
+    if (size > MAX_DEST_STRING)
+        return_error(gs_error_limitcheck);
     if (size == 0 || data[0] != '(')
         return 0;
     /****** HANDLE ESCAPES ******/
@@ -848,6 +850,8 @@ pdfmark_put_ao_pairs(gx_device_pdf * pdev, cos_dict_t *pcd,
             char buf[30];
             int d0, d1;
 
+            if (Action[1].size > 29)
+                return_error(gs_error_rangecheck);
             memcpy(buf, Action[1].data, Action[1].size);
             buf[Action[1].size] = 0;
             if (sscanf(buf, "%d %d R", &d0, &d1) == 2)
