Use charstring as plain text when lengthIV is -1.

Fixes #7769

src/core/type1_parser.js

@@ -150,6 +150,10 @@ var Type1CharString = (function Type1CharStringClosure() {
                 break;
               }
               subrNumber = this.stack.pop();
+              if (!subrs[subrNumber]) {
+                error = true;
+                break;
+              }
               error = this.convert(subrs[subrNumber], subrs,
                                    seacAnalysisEnabled);
               break;
@@ -503,6 +507,15 @@ var Type1Parser = (function Type1ParserClosure() {
       return token;
     },
 
+    readCharStrings: function Type1Parser_readCharStrings(bytes, lenIV) {
+      if (lenIV === -1) {
+        // This isn't in the spec, but Adobe's tx program handles -1
+        // as plain text.
+        return bytes;
+      }
+      return decrypt(bytes, CHAR_STRS_ENCRYPT_KEY, lenIV);
+    },
+
     /*
      * Returns an object containing a Subrs array and a CharStrings
      * array extracted from and eexec encrypted block of data
@@ -548,7 +561,7 @@ var Type1Parser = (function Type1ParserClosure() {
               this.getToken(); // read in 'RD' or '-|'
               data = stream.makeSubStream(stream.pos, length);
               lenIV = program.properties.privateData['lenIV'];
-              encoded = decrypt(data.getBytes(), CHAR_STRS_ENCRYPT_KEY, lenIV);
+              encoded = this.readCharStrings(data.getBytes(), lenIV);
               // Skip past the required space and binary data.
               stream.skip(length);
               this.nextChar();
@@ -571,7 +584,7 @@ var Type1Parser = (function Type1ParserClosure() {
               this.getToken(); // read in 'RD' or '-|'
               data = stream.makeSubStream(stream.pos, length);
               lenIV = program.properties.privateData['lenIV'];
-              encoded = decrypt(data.getBytes(), CHAR_STRS_ENCRYPT_KEY, lenIV);
+              encoded = this.readCharStrings(data.getBytes(), lenIV);
               // Skip past the required space and binary data.
               stream.skip(length);
               this.nextChar();

test/pdfs/.gitignore

@@ -31,6 +31,7 @@
 !issue7101.pdf
 !issue7115.pdf
 !issue7180.pdf
+!issue7769.pdf
 !issue7200.pdf
 !issue7229.pdf
 !issue7403.pdf

test/test_manifest.json

@@ -489,6 +489,13 @@
        "link": false,
        "type": "eq"
     },
+    {  "id": "issue7769",
+       "file": "pdfs/issue7769.pdf",
+       "md5": "814f167b8437eb8e4e4b6e89743011d5",
+       "rounds": 1,
+       "link": false,
+       "type": "eq"
+    },
     {  "id": "issue5044",
        "file": "pdfs/issue5044.pdf",
        "md5": "44788cd31dcb4a2495ded34a84c4a765",