oss-fuzz 42444: Fix broken stack indexing

when creating a code space range
ArtifexSoftware · Dec 16, 2021 · 1a3c64e · 1a3c64e
1 parent 2bb92f8
commit 1a3c64e
Showing 1 changed file with 4 additions and 3 deletions.
diff --git a/pdf/pdf_cmap.c b/pdf/pdf_cmap.c
@@ -117,9 +117,10 @@ static int cmap_endcodespacerange_func(gs_memory_t *mem, pdf_ps_ctx_t *s, byte *
         }
 
         for (i = nr; i < code_space->num_ranges; i++) {
-            memcpy(code_space->ranges[i].first, s->cur[-((i * 2) + 1)].val.string, s->cur[-((i * 2) + 1)].size);
-            memcpy(code_space->ranges[i].last, s->cur[-(i * 2)].val.string, s->cur[-(i * 2)].size);
-            code_space->ranges[i].size = s->cur[-(i * 2)].size;
+            int si = i - nr;
+            memcpy(code_space->ranges[i].first, s->cur[-((si * 2) + 1)].val.string, s->cur[-((si * 2) + 1)].size);
+            memcpy(code_space->ranges[i].last, s->cur[-(si * 2)].val.string, s->cur[-(si * 2)].size);
+            code_space->ranges[i].size = s->cur[-(si * 2)].size;
         }
     }
     return pdf_ps_stack_pop(s, to_pop);