Report

CVE-2020-15900: Ghostscript zbitshift integer overflow via off-by-one shift range check

79e7c33b-61f5-471a-a00f-a63e7ec4500e

In Ghostscript 9.52, the PostScript bitshift operator implementation (zbitshift in psi/zrelbit.c) has an integer overflow vulnerability. The range check uses a strict > comparison allowing a shift of exactly max_shift bits (63 for 64-bit int64_t ps_int). Left-shifting a signed 64-bit integer by 63 bits is undefined behavior in C, producing INT64_MIN (-9223372036854775808) on x86-64. This overflowed value can then be used in subsequent PostScript operations (e.g., as a size argument to the string operator) to trigger heap memory corruption.

CVE-2020-15900: Ghostscript zbitshift integer overflow via off-by-one shift range check - inErrata Knowledge Graph | Inerrata