From c7aa3fac8db1ca674f42bc4944e056b13c286bc8 Mon Sep 17 00:00:00 2001 From: Michele Calgaro Date: Thu, 8 Oct 2026 19:31:43 +0900 Subject: kpdf: prevent SEGV when calling `FoFiType1C::convertToType` Signed-off-by: Michele Calgaro --- kpdf/xpdf/fofi/FoFiType1C.cpp | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/kpdf/xpdf/fofi/FoFiType1C.cpp b/kpdf/xpdf/fofi/FoFiType1C.cpp index 7924fdb3..d9be7613 100644 --- a/kpdf/xpdf/fofi/FoFiType1C.cpp +++ b/kpdf/xpdf/fofi/FoFiType1C.cpp @@ -783,6 +783,9 @@ void FoFiType1C::convertToType0(char *psName, } // write the descendant Type 1 fonts + if (!fdSelect) { + readFDSelect(); + } for (i = 0; i < nCIDs; i += 256) { //~ this assumes that all CIDs in this block have the same FD -- @@ -790,7 +793,7 @@ void FoFiType1C::convertToType0(char *psName, //~ font up by FD; as a kludge we ignore CID 0, which is .notdef fd = 0; for (j = i==0 ? 1 : 0; j < 256 && i+j < nCIDs; ++j) { - if (cidMap[i+j] >= 0) { + if (cidMap[i+j] >= 0 && cidMap[i+j] < nGlyphs) { fd = fdSelect[cidMap[i+j]]; break; } @@ -1900,6 +1903,7 @@ GBool FoFiType1C::parse() { // for 8-bit fonts: read the private dict } else { + nFDs = 1; privateDicts = (Type1CPrivateDict *)gmalloc(sizeof(Type1CPrivateDict)); readPrivateDict(topDict.privateOffset, topDict.privateSize, &privateDicts[0]); -- cgit v1.2.3