ANT-2026-HRZEDXBB: Stack-buffer-overflow in ghostscript

In Ghostscript's Sampled Function evaluator (gsfunc0.c), fn_interpolate_linear allocates a stack array uint sdata[max_Sd_n] with max_Sd_n = 64 and passes it to fn_gets_8, which writes n uint values into it. The value of n is taken directly from the PDF Function dictionary's /Range array length and is only checked for n > 0 in fn_check_mnDR, never against max_Sd_n. A crafted PDF supplying a FunctionType 0 with a 200-element /Range (n = 100) causes fn_gets_8 to write 100 uints into the 64-slot stack buffer, corrupting adjacent stack memory. Because Ghostscript routinely processes untrusted PDFs in print servers, thumbnailers, and conversion pipelines, this attacker-controlled stack write is a realistic path toward remote code execution.

Target

Project: ghostscript
Location: pdf/pdf_func.c:pdfi_build_sub_function (crash in base/gsfunc0.c fn_gets_8)

Technical Details

ASAN: stack-buffer-overflow WRITE of size 4 in fn_gets_8, overflowing the 256-byte (64 × uint) sdata stack object declared in fn_interpolate_linear. Root cause: the output-dimension count n is derived from the user-supplied /Range array and fn_check_mnDR only enforces n > 0, so any n > 64 overruns the fixed stack buffer during sample unpacking.

Crash trace:

INFO: Running with entropic power schedule (0xFF, 100).
INFO: Seed: 2775612483
INFO: Loaded 3 modules   (241643 inline 8-bit counters): 14221 [0x7603ebac62a0, 0x7603ebac9a2d), 958 [0x7603ebb67778, 0x7603ebb67b36), 226464 [0x5b23e9f2df20, 0x5b23e9f653c0), 
INFO: Loaded 3 PC tables (241643 PCs): 14221 [0x7603ebac9a30,0x7603ebb01300), 958 [0x7603ebb67b38,0x7603ebb6b718), 226464 [0x5b23e9f653c0,0x5b23ea2d9dc0), 
/out/gstoraster_pdf_fuzzer: Running 1 inputs 1 time(s) each.
Running: /tmp/poc
EXIT_CODE:1

Reproduction

Reproduce against the target as described under Technical Details.

[No reproducer or sanitizer output attached — request from security-cvd@anthropic.com if needed.]

Suggested Fix

Validate params.n against max_Sd_n when building/checking the Sampled Function (e.g., in fn_check_mnDR or the FunctionType 0 constructor) and reject functions with n > max_Sd_n, or dynamically allocate sdata based on n.

Acknowledgement

This vulnerability was discovered by Claude, Anthropic's AI assistant, and triaged by the Anthropic security team in collaboration with Anthropic Research. Please direct questions to security-cvd@anthropic.com and reference ANT-2026-HRZEDXBB.

Reference: ANT-2026-HRZEDXBB
Anthropic CVD Policy: https://www.anthropic.com/coordinated-vulnerability-disclosure