From 78dd35483ceaccab29a7584e454170e6412f5e47 Mon Sep 17 00:00:00 2001 From: Calixte Denizet Date: Wed, 18 Sep 2024 22:09:17 +0200 Subject: [PATCH] Read a signed integer when using PUSHW in sanitizing a font (bug 1919513) --- src/core/fonts.js | 2 +- test/pdfs/.gitignore | 1 + test/pdfs/bug1919513.pdf | Bin 0 -> 11206 bytes test/test_manifest.json | 8 ++++++++ 4 files changed, 10 insertions(+), 1 deletion(-) create mode 100755 test/pdfs/bug1919513.pdf diff --git a/src/core/fonts.js b/src/core/fonts.js index 6b0eb40c6382a..8dcda2a20ad51 100644 --- a/src/core/fonts.js +++ b/src/core/fonts.js @@ -2387,7 +2387,7 @@ class Font { } else { for (j = 0; j < n; j++) { b = data[i++]; - stack.push((b << 8) | data[i++]); + stack.push(signedInt16(b, data[i++])); } } } else if (op === 0x2b && !tooComplexToFollowFunctions) { diff --git a/test/pdfs/.gitignore b/test/pdfs/.gitignore index fc0f6e0e8936b..0109958757154 100644 --- a/test/pdfs/.gitignore +++ b/test/pdfs/.gitignore @@ -668,3 +668,4 @@ !issue18694.pdf !issue18693.pdf !bug1918115.pdf +!bug1919513.pdf diff --git a/test/pdfs/bug1919513.pdf b/test/pdfs/bug1919513.pdf new file mode 100755 index 0000000000000000000000000000000000000000..fa1ca32103cfba9257b434ba1a9989b46bd1d4e7 GIT binary patch literal 11206 zcmdTqc|4Te_o4`)g_5WtiZo_lV+v!-zC@BTW(Jd4m>F40T0}*Ql6XV5lI)R`kP^~@ zva}#eBrPIKB>kRe5H0WfeShE2@1Nh}GoJgLd$xP;Id?lp&5CRYMQCB9)H*tAo=Qoe zA#e!Cb(fU3Hq4B{rc=0#06GnVfSExM2qYW}vxHz_1`s?Ffq+>6U^@T|M<8Lw5GM!* zg@qt6SZ5MRiq58iOdx-Jr2M#aH&7A+DJ21)dJtHMpafz6fME&9-(Yw+{8tzPhXs@d zpBY*Nj)4CSM!*t&g&{FW%&#yE0{@#_43dEQ6%U6+{Dz0aV}5T3*e^fy<8vttCY=lR zuPxBE5Cj%x!{P8DfEo}RmZ9-o0!bTz#$YihJuDfohd^U>^$2u7l z0+(qWoxk58X1P4tL6~6(X_XKX68ipK@J~btZz{eXG^Q!eQ)V?wH8Tp^U7bdUk_|Lq z=5#)VM&VN+z_0)vXhm_S^B@R8+0NgK4$}wfm>hSQJ%jE`=K|g0M(5JmR5}kB3o?UC zr}7ybHp~oZLjs;@69$HEx*K%4d_9hz6I=^0LEwiWV6>1pECi26XyFOYFg+%nPWvYW zeGZ#XXY+Xwz%&8<^tl|be?m8>(-@S0La?F$>hq^sXhY|5e7KX1(dRHZTw5;+l@7E_ z-xdzRfdWY+n1LVP$d(U`A^g64h{i)M1X6>zECDT059$QgV^JiS8HL9;=g=5#3_5M9 z323kyR22{-U<1CVNI)^uYz1$y4*Y>|P;EdJj4lag;lpyJb2)BP)(f-bGTa$#3iJPc ze}N6M<5Ji>Hx8FY0bR|U!sjyl%ose-^x#g2DZc`JYgQRFJCJsZ33(b70<1n$PzMH$ z@9_gZ<&vQPg3q)MgXRxTWlk^?eSJL&4_wdyABNaCPh)@{`S+9E)I5iPqh{tfKd$^GP;f~kZT7kX^Rso1}`;3nqIGCtstZ?qeqOD7fW8~k)C~W&nGkRNe zucN|>6`H}XxePp!P$|D6#$R>KJ^Ax7YMvo9?;9arb7oI|)xEMGK?Q%F{6PPlQWb0p z=(#X^2g@zS=9+pGwkOnv?(V~+aA5{)V4`NQ-C+(4wl15;`0;JX;PUwT9uzJFixD_J z;FDA?!;8=1LJ*T{4`|y03?v#0v-NT1gVU!S*M}}}Ydg*sHUnG*AP8``U;`6C1&RoU zgXe_BApz#Vyn_I{e)128o-Y0SH?ZtNuy7o(vzX!Y@2UU)VG4FKKYHxH(I10{&)R

gidD?2Z^J)*KMHMnDyT#woC@>u_iXV-*S zFL~EL*Si3nyDPr<&E9Upi*kwM_6PDb+~f3;;r)zQho_l(nDmNBDbc4FRU2*^7H`|a zzTMolGFlyN7p|u9ER=#*{AXBaEyM3;V!#b0{i>KAdyAhE1WFKAWW zhQnjo=S!_FwLX4&=HZQa-Em0{YvUUS9f|#ZOS2!1T`zb76$;OudwZbU>HLGQLh$|) zrIIg?1HWAI*TBj1DJ3OCLqnup7n>{XYH?#1q)RvT-KweNH=iGH@vcV30OhZ zbp_j-yDiQvt2}t4QpZlEFQ5JW+%+CV23%Zvvg&TCS>~4Z4~^^UMSZRHyrylAri)DMfej0VgBA+k(M2B-yAM%%y! zE2MK-44R@qB~$pW%LaLoqOyHn3&RhcEEE4^LS00)=Ve3Y ztLQE`BI&3reMY4LqDw-UZ`-#NO6&}ilM48(dI~`azKjQTSL(ZYuZNc0z%k!-8B(LRg#fMxYi5g zlG;5M{}onUr;soA!63BGxrZ`{4wx6G=U&@1SF|ju&0zj&WAU*0>-2OI!{ElxOuiiP z3h_D)H}~7Dx_Fd42N4`iUJtQfc>ZW{d1kptd1tw4c~QCJ;-fT!0TqK&PfU=f57ZmH z(0gGt7S4}Bn+I52icqSWcs-Y^>}dKCB6E7=)JCqkf+*NTphn8XAIRBmcJ5kT5NA$2~Z<$g>=ZZrE zPXu1j?I*7{`V*{GH% zvGv)GCHZ$UIx^Q~Vz(Z5YRNUs)X79;zRSGscp-Nm?QWj<^@x}Jmx}o}7?LjoUbsES zzTD@sr)+oQ<5sOY3-{~yK1Q~z-cu5oA9(oN{%@(nGKz)L5z@Ot=Y-ZMP8^G&BDTt5 zgX1dP6j@4V6px?Sptx3XCqX=x8%K^a62JHpE5RWF>E+aR z;ZUJ2LpS}Ph3L1{c-5_|Zf*Rcd&Jb(q-u{cu3XzYq|jm9UtJlE&4&(l)-I!zQ9^PK zQG#Tag*b%tiIybfMxXlJQ~*JdlV_vX2qoqED}>`sS8r~p6QLbVyP1)nyQw{GAk;s^-0{_ z?ng8}cZp+GdPceG^8GLRYY?c_Jk`%I$E1v?jJ)T~?>pY>Jh$Yz^2WIAuA6TZc$VFW z&&LLKztMSc@orMsdg}LK&us?|t#`(*I}ey(i34%~JJI20ahl61*$9SJ&Te)Ma$_HL^~|M1e}0>z;dg)q~YCnn4-W*~A28&&_C~Yl^Ik z!~AQ3KKesyap$s3agIyu^U~Z5FC@Kklx)yS({XKU-)Orm{A0!0inNjI_SONYW1I{1n zhpUG-`h4*j^xa#k5_B)uqUdo~oUg;0tmc>W#*2M7bJy){7;fm*0YA1kDT7pA_S|meGW5W zPuo}Xd*>fZiAu9ynYA#RwF!}9mO?3WoF<|RV^m{K#f<;u@mIrnz4O_zim^vyN8)I4 zPvSSlXI)Ub5O!fKfsybm(I~MXX-!g8vS{+|E`?qCmdZ|TyKHm0 zJPntYc17{Z$#mg#pY*pG+cRo2$(e;&(5%GlrP*OQLODJ;y}2&AjaN;t-pRw~W#y~o z$6i}&vanAKx>*S5;wHako;pvb0L4>ehYY{TtQz>gx}%4+S<2eY(-@PX3<@HPkT4s3NNziiDZ zJWl|V4V*2&1ICZr2^f_kAmexm5N8f@;Dy`t;pY#RQd8$NBoc+4x|>2kP)H16_Ngty z-qUM^gB)q(<1UA*Oe0UnedU`~oQ_I$y072p)nPY~wWM^hk-eP5K2^t2wW8eBmP}m4 z{NSeic-a?dbK*s~TBNkd)21vt8_Q6e@wLG=#07Vwm#f3)$%u$7C+h!oNq@EX$IWXV z-#$6v;ye72@Fspw3GcCv?}*Tx{n}rIz1lYJ4GQc`E_K`|uGZI)e4^&?o3}MpMnWk{ zqi_2|mpV75-{`8^cye!N{a%`utfPr?spzJ3mAu@v>*;zvLd{A-6ZhWU|3q%EY~3ad z4_Y37M+C*mx)H&T-9esQriaCs28H{W)Dxqe}<&M7$y`BcWI5@h__8!4p6F zE9jZ*>^4843wwUZCjDq~Bsa2>&|Makb$Ili{J8vfudu9C(i$y5f+6C8oK<`l3Y`!V zj7qt2Tcks8&NC}L?*eJro)GUsVNWm3IIMlWo>=vr6;}uM2)%6>T=BN=l4Z(@Cx=7S zRy6PFN@RruoY&tzMoLOH9CO=dalKabg+)AKI7voY-d8NYQ$(S@XA@mY_PFi1a`8f0 zxtMQUVTA0K9VXcuLU&yg-Z+cn84G(d8a$30 zwp^{a(Y4B|%~(10^0Dx4+2iXJycKJs1CxS_BC^vP3Kbp&_uB8}HV>o|mP&H;K9K6K zk5Y*>n%krU+8j<9QOPU7W@4??ac zpm&ISy3zNFh9b7??p2S%oJkUw7<=G8F4w=P`D)D^yS4*w#4oNnk++r1OEgyh9JG2t zQbOFPLsxV|=pm=P=b9sxA@2+sKACP;Oris6L2&z|^W=-IM@iHwJ<*86EW`3~>AX!x z)c?xK@FSg3eSYMWd-rlB+#UMX{oYaD)pN&4?I+bXn@7&+IL+?faxfviK<}$ms)cz- zs_$B}ir~hM`mnw%U*-;us_BOkUueyfl-*6PiLQ00*XAY=7E&b3mk37}r;A5)7N<*f zb=lld_g5XD^`@o_-EHc*Ir13AKelD{Qev%Sp~YOyy$Vf>RyLjOQRy@HQh~|kzqNl{ zFt#otBi8DJ@zxBLYK7{SEnP|H{oco(PhMs?X2Tf@sftQ2gFS_1X0}^}7tDnkCf~WpJnL zh;Z2{S%Sp8I%~VvkhH|x*Gm>DK5q>#5QiIlR?(#Svn@Ys$Jl84h-vop`jqGJ1R3_B(Lz!P+jXUd_aX zgcT|xX%6tb>@y-BXK>@C6>;~9cXx;}))p$4aZ($+S(R5lwo;rLGz(tZpSifWvg4|$ z{nDn#j}l#md(|sq#Pebb&+FX#QtK&luCf9qwP3r#sv>Rptv6)L!R8wtgWG$XuH3wI zCGDJ%(N0qF;GL=}Nz>lD&NcgnI(RkCsx|3Xj$N}mS7MUY>CV!8FD&D>R0FJwe%}jp0f&%tPIe8WX@bszOFl6zxnmsA@)to zv+h+y9b6Zyr6sS^R*ZW0=|uk_o#Q^vB8efF4#ZFBIvF)-`F^&dZOzQg&f1V7f35W- zAwBiF_p0qZRBe+F7K1QG0VfxZQ*z7RK`xH@P;*dj`GnmKCFVx$=eHtWjg5@R%=;Q} zu&go7;*~K%M?T?VWpRlY%6e5SVK=k8yyv!~zvWZ;;<$i|xed!C<$bJ9j*g~ATu>4X zsB<1Hw?}D?1~=TY9+ewe>azRkF@u5nl1utV!hx(fe;pgX$8dAWnU+v@iJMhRSWhb( zs#*=dmX%eO$cK-9?9;eIEYnFe;LE*BSzz6gVG+#AuqbffOoqJ*@v(8aj@-HVea7~Q zbc=O3wcwYR&m?_Ka(1r!illnwT=zYt)3-oor_##C&SQ&Z7L?Noqy$41iqEdiYL$)= zw4f4lY~Z(-Plqb6=LZQn6_&#LR|TmzyY+2+Zc#dC-t%73aV_hrtPbAOFNad!i?NfN zkQ@8W9Y~{M@%g2R6>{ncZzz!yirYTbAMZG}be*n}j`X*D*Qb# zHfJ;LwLz-_WnNrG>%QIN_?PQk*QoA<)A+0ClY_16p%A6VPgK5Ctv)29NO}@@d7JbF zZR-`$;p-oTSOy{&?Z#L~hswtuTz=#>dVNRY*8OUc=1I&&?($s+4LxpG9=h;xLBm{( z`UeB^OUugoRR>zCPA*@(Y}jBeMfg?dDc2~s1;@n}Ji?#Ii{7_vH!jbw2-^;mZ&odd zi3|0L-SkLzyTAMi$Q|X&qR(^o2^WjE?VW4wE)}`whGjwb_q1!uz7({iq4ak7I*q-S z39Ye-ciocVhm$?e>=WZtBA;hrzF`{YeLtx=Csx(LGi7Yo`IC!}p8j?QLcAY``%~9-p{s+w=aLc=#|CdTi5{QRQt|)U$@50l%^e2p7yZabL_$m zh%4dCrA{Qq$?mqzQZQOs+1w(0BIhMDoDibjB>(wFZ;9NBaLcUs{@a{24kH>7y{D4r z>M2B0&g1jV-COL{`z4RA-(IXz?D*+YoRi{{fr5z@v*KX&vE2oK*nNSwwbQ#V9u*7* z;R#3}&gErHXSjRtA;6t047}Y1YoI`s7Kq@v^MEap;M!LYjNc&eU%A z7K7=p4&EkfOag$2B@&3%0@7>*01FC>{>Mva@DkV-hywDd9@ASu5acka4iE}~nE)|3 z2342s&IH3qwtPCv9)iQnTp`a~M#HvFwE}~{&e{Ub3Q+&U77!1ROx>GH7$4mpQM2nV zd_hIuJ_)6l`nhMMpX$#KkJ=>t_3l-jO|F_T6z}j(#ev~7AD)yg$la&+YME-x&X-P} z=0X!6mo-rK*KPga?TpP{C>k41HxPeu*{kMBW_K&XqMN-_jhfptsgnJdxCkB(xwH6Pfge?nf)6>{@_Nmld=-~Oz zr&otHhi^k?WjXZh*`S<0H%{S7h{dDY-k>2p+DrJAzSg|nG)V43*&`1g(qHqsd9O{o zC37DJEFVI?qt`#kIAZs^~6_BmwRuFv-mkuFlA)r(s<_EzMv}mpr6peyf4?)6_C>Y=&2ow~KA;PglG+{b- zL4_m%6t%fDH=+&Ma7rHVrK94(=X()hFkfF^Enk!thwBbQ5C{Yq90@}rp#TPy=g;O- z{Ge>!>PaTke5Q>Y2!cUCz7$uE4_`+`1r+q-nQ9oz>xUpVPfO59Eh>iv^P_mdz_Zog z5Sg3*GZ~BZM@k;wU^k%2RLlM-kS92-O~;!Jb_0{k>OU#LN~b z(xlZ)N30x*nAGpLqi+(E5Xd*&G4d=fp9qqFfKF{PJkltb_g^PNg$%| zns6i$4xhzj67v@x)9&(bxcr3sD<3dU?fK_e27 z6gmL`$3t-x8U~8Qp(#*`8x;+8r4mpW0*&B`p`ipV{F(MQzQ2dKNkHFf(Et%x6a^1Q zQBhDT29AWHu@qM*1&b#@=~y@dPr*~@G&pry#2?uFCTb>%E)W4W0z+`6B5^n<20@`i z(XJReAOS;w;^{~?IE6+apeg8S3A3nw<7@*2Y8hZuTc1hc@km}=4#$lM7}_-LFZI9C z8v|i*4%c5W*Zi0Q1e1;}-TP-KXszI^!DI*~4=)OrCkV{ys7yQMY{Q;mCh%<{MUdt~ zqH@@~>0CaLy8!zMKBL&Lgn%4i*#{DVcqBJ2hXtW{c>ycAAd(OBgEH7OL23tt&-tlF z&;^qcW-<7CDLjrF-xo-1(RBxW`#(G3BD214tL5(@3!CMo$C&p2XLK&i*F{ zo>V}9^(zx?*yJevJbIJRp9gi?NPag0a4G@ZhfL=(cGGEwV84S*|MQq@3#MNpW5#De zpJM!LpZbmbr`Anzr~OFc`CoeMB==e5f8x&hE%oKUlJW;Of072|Qq6W?8r_ZJ!{md8 z0<25KUutI)#ZaYOJXb`o_OG=({7fU~wB0(~c;zy=4{T)}?qu7Hmp z`!k?_bX2&&?(6p*-019-qh*O}zaX&4sR?}E>dgi~M@M9#wF|B~d1{y)p+1k|5N;Y1*?Q%Riv1L2Ip Ar2qf` literal 0 HcmV?d00001 diff --git a/test/test_manifest.json b/test/test_manifest.json index 8a9359249228e..c2eb47c18d3b9 100644 --- a/test/test_manifest.json +++ b/test/test_manifest.json @@ -10482,5 +10482,13 @@ "rounds": 1, "link": true, "type": "eq" + }, + { + "id": "bug1919513", + "file": "pdfs/bug1919513.pdf", + "md5": "83d1a7fab2c81e632910c334879e7334", + "rounds": 1, + "talos": false, + "type": "eq" } ]