Bug 699627: Ignore CMap input ranges outside of input codespaces.

Thanks to oss-fuzz for reporting.

1 files changed, 21 insertions, 0 deletions

diff --git a/source/pdf/pdf-cmap.c b/source/pdf/pdf-cmap.c
index 6abacc56..0764e32b 100644
--- a/source/pdf/pdf-cmap.c
+++ b/source/pdf/pdf-cmap.c
@@ -485,6 +485,9 @@ add_range(fz_context *ctx, pdf_cmap *cmap, unsigned int low, unsigned int high,
 {
 	int current;
 	cmap_splay *tree;
+	int i;
+	int inrange = 0;
+	unsigned int k, count;
 
 	if (low > high)
 	{
@@ -492,6 +495,24 @@ add_range(fz_context *ctx, pdf_cmap *cmap, unsigned int low, unsigned int high,
 		return;
 	}
 
+	count = high - low + 1;
+	for (k = 0; k < count; k++) {
+		unsigned int c = low + k;
+
+		inrange = 0;
+		for (i = 0; i < cmap->codespace_len; i++) {
+			if (cmap->codespace[i].low <= c && c <= cmap->codespace[i].high)
+				inrange = 1;
+		}
+		if (!inrange)
+		{
+			fz_warn(ctx, "ignoring CMap range (%u-%u) that is outside of the codespace", low, high);
+			return;
+		}
+	}
+
+
+
 	tree = cmap->tree;
 
 	if (cmap->tlen)