Bug 708133

Summary: [RCE] NPDL device: Compression buffer overflow
Product: Ghostscript Reporter: zhutyra
Component: Security (public)Assignee: Chris Liddell (chrisl) <chris.liddell>
Status: RESOLVED FIXED    
Severity: normal CC: carnil, dr, jsmeix, ken.sharp, marc.deslauriers, robin.watts, sam, till.kamppeter, zdohnal
Priority: P2    
Version: unspecified   
Hardware: PC   
OS: Linux   
Customer: Word Size: ---
Attachments: patch
exploit

Description zhutyra 2024-11-12 03:24:42 UTC 
Created attachment 26193 [details]
patch

When the "npdl" device allocates a compression buffer, an integer overflow can occur during the multiplication of width and height, leading to allocation of a buffer that is shorter than needed, and subsequently a buffer overflow.
Comment 1 zhutyra 2024-11-12 03:25:19 UTC 
Created attachment 26194 [details]
exploit

Exploit for x64 Linux
gs -q -dNOPAUSE -sDEVICE=npdl -sOutputFile=/dev/null mhcompress.ps
Comment 2 Chris Liddell (chrisl) 2024-11-21 11:14:56 UTC 
Adopted, but "parked" until the next release.

Thanks Zdenek.
Comment 3 Chris Liddell (chrisl) 2025-03-10 09:54:10 UTC 
CVE-2025-27832