Partial backport of:

From bf79b61cb1677d6865c45d397435848a21e8a647 Mon Sep 17 00:00:00 2001
From: Ken Sharp <ken.sharp@artifex.com>
Date: Tue, 27 Sep 2022 13:03:57 +0100
Subject: [PATCH] PCL interpreter - fix decode_glyph for Unicode

The text extraction (and pdfwrite family) expect that decode_glyph
should always return pairs of bytes (an assumption that Unicode code
points are 2 bytes), and the return value from the routine should be
the number of bytes required to hold the value.

The PCL decode_glyph routine however was simply returning 1, which
caused the text extraction code some difficulty since it wasn't
expecting that.

This commit firstly alters the text extraction code to cope 'better'
with a decode_glyph routine which returns an odd value (basically
ignore it and fall back to using the character code).

We also alter the pl_decode_glyph routine to return 2 instead of 1,
so that it correctly tells the caller that it is returning 2 bytes.
Finally we make sure that the returned value is big-endian, because the
text extraction code assumes it will be.

Upstream-Status: Backport [https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=bf79b61cb1677d6865c45d397435848a21e8a647]
CVE: CVE-2025-27831 #Dependency Patch
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
---
 devices/vector/doc_common.c |  8 ++++++++
 pcl/pl/plfont.c             | 12 +++++++++---
 2 files changed, 17 insertions(+), 3 deletions(-)

--- a/devices/vector/doc_common.c
+++ b/devices/vector/doc_common.c
@@ -513,6 +513,14 @@ int txt_get_unicode(gx_device *dev, gs_f
         char *b, *u;
         int l = length - 1;
 
+        /* Real Unicode values should be at least 2 bytes. In fact I think the code assumes exactly
+         * 2 bytes. If we got an odd number, give up and return the character code.
+         */
+        if (length & 1) {
+            *Buffer = fallback;
+            return 1;
+        }
+
         unicode = (ushort *)gs_alloc_bytes(dev->memory, length, "temporary Unicode array");
         length = font->procs.decode_glyph((gs_font *)font, glyph, ch, unicode, length);
 #if ARCH_IS_BIG_ENDIAN
