Sakurai/pdf.js
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #9886 from Snuffleupagus/bug-1473809

Browse Source 
Prevent errors in `sanitizeTTProgram`, during parsing of CALL functions, when encountering invalid functions stack deltas (bug 1473809)
This commit is contained in:
Tim van der Meij 2018-07-15 17:23:52 +02:00 committed by GitHub
commit 61db85ab64
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
4 changed files with 33 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

39
src/core/fonts.js
View File

@ -2109,21 +2109,32 @@ var Font = (function FontClosure() {
if (!inFDEF && !inELSE) {
// collecting information about which functions are used
funcId = stack[stack.length - 1];
ttContext.functionsUsed[funcId] = true;
if (funcId in ttContext.functionsStackDeltas) {
stack.length += ttContext.functionsStackDeltas[funcId];
} else if (funcId in ttContext.functionsDefined &&
!functionsCalled.includes(funcId)) {
callstack.push({ data, i, stackTop: stack.length - 1, });
functionsCalled.push(funcId);
pc = ttContext.functionsDefined[funcId];
if (!pc) {
warn('TT: CALL non-existent function');
ttContext.hintsValid = false;
return;
if (isNaN(funcId)) {
info('TT: CALL empty stack (or invalid entry).');
} else {
ttContext.functionsUsed[funcId] = true;
if (funcId in ttContext.functionsStackDeltas) {
let newStackLength = stack.length +
ttContext.functionsStackDeltas[funcId];
if (newStackLength < 0) {
warn('TT: CALL invalid functions stack delta.');
ttContext.hintsValid = false;
return;
}
stack.length = newStackLength;
} else if (funcId in ttContext.functionsDefined &&
!functionsCalled.includes(funcId)) {
callstack.push({ data, i, stackTop: stack.length - 1, });
functionsCalled.push(funcId);
pc = ttContext.functionsDefined[funcId];
if (!pc) {
warn('TT: CALL non-existent function');
ttContext.hintsValid = false;
return;
}
data = pc.data;
i = pc.i;
}
data = pc.data;
i = pc.i;
}
}
} else if (op === 0x2C && !tooComplexToFollowFunctions) { // FDEF

1
test/pdfs/.gitignore vendored
View File

@ -151,6 +151,7 @@
!bug1108301.pdf
!bug1157493.pdf
!bug1250079.pdf
!bug1473809.pdf
!pdfjsbad1586.pdf
!freeculture.pdf
!issue6006.pdf

BIN
test/pdfs/bug1473809.pdf Normal file
View File

Binary file not shown.

7
test/test_manifest.json
View File

@ -143,6 +143,13 @@
"lastPage": 4,
"type": "eq"
},
{ "id": "bug1473809",
"file": "pdfs/bug1473809.pdf",
"md5": "4b1ca51cf8cad58a1ce0618667341c76",
"rounds": 1,
"link": false,
"type": "eq"
},
{ "id": "issue2531",
"file": "pdfs/issue2531.pdf",
"md5": "c58e6642d8a6e2ddd5e07a543ef8f30d",