From 176cf0188a2294bc307b8caec876f39412e58350 Mon Sep 17 00:00:00 2001
From: Ken Sharp <Ken.Sharp@artifex.com>
Date: Tue, 1 Jul 2025 10:31:17 +0100
Subject: [PATCH] PDF OCR 8 bit device - avoid overflow

Bug 708602 "Heap overflow in ocr_line8"

Make sure the calculation of the required raster size does not overflow
an int.

CVE: CVE-2025-59800
Upstream-Status: Backport [https://github.com/ArtifexSoftware/ghostpdl/commit/176cf0188a2294bc307b8caec876f39412e58350]
Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
 devices/gdevpdfocr.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/devices/gdevpdfocr.c b/devices/gdevpdfocr.c
index f27dc11db..6362f4104 100644
--- a/devices/gdevpdfocr.c
+++ b/devices/gdevpdfocr.c
@@ -521,9 +521,12 @@ ocr_line32(gx_device_pdf_image *dev, void *row)
 static int
 ocr_begin_page(gx_device_pdf_image *dev, int w, int h, int bpp)
 {
-    int raster = (w+3)&~3;
+    int64_t raster = (w + 3) & ~3;
 
-    dev->ocr.data = gs_alloc_bytes(dev->memory, raster * h, "ocr_begin_page");
+    raster = raster * (int64_t)h;
+    if (raster < 0 || raster > max_size_t)
+        return gs_note_error(gs_error_VMerror);
+    dev->ocr.data = gs_alloc_bytes(dev->memory, raster, "ocr_begin_page");
     if (dev->ocr.data == NULL)
         return_error(gs_error_VMerror);
     dev->ocr.w = w;
