Merge pull request #18760 from calixteman/bug1919513

Read a signed integer when using PUSHW in sanitizing a font (bug 1919513)
mozilla · Sep 19, 2024 · 652e3e0 · 652e3e0
2 parents 19151fe + 78dd354
commit 652e3e0
Show file tree

Hide file tree

Showing 4 changed files with 10 additions and 1 deletion.
diff --git a/src/core/fonts.js b/src/core/fonts.js
@@ -2387,7 +2387,7 @@ class Font {
           } else {
             for (j = 0; j < n; j++) {
               b = data[i++];
-              stack.push((b << 8) | data[i++]);
+              stack.push(signedInt16(b, data[i++]));
             }
           }
         } else if (op === 0x2b && !tooComplexToFollowFunctions) {

diff --git a/test/pdfs/.gitignore b/test/pdfs/.gitignore
@@ -668,3 +668,4 @@
 !issue18694.pdf
 !issue18693.pdf
 !bug1918115.pdf
+!bug1919513.pdf
diff --git a/test/pdfs/bug1919513.pdf b/test/pdfs/bug1919513.pdf
diff --git a/test/test_manifest.json b/test/test_manifest.json
@@ -10482,5 +10482,13 @@
     "rounds": 1,
     "link": true,
     "type": "eq"
+  },
+  {
+    "id": "bug1919513",
+    "file": "pdfs/bug1919513.pdf",
+    "md5": "83d1a7fab2c81e632910c334879e7334",
+    "rounds": 1,
+    "talos": false,
+    "type": "eq"
   }
 ]