mirrors/pdf.js
1
0
Fork 0
mirror of https://github.com/mozilla/pdf.js.git synced 2025-04-22 16:18:08 +02:00
Code Activity

Prevent errors in sanitizeTTProgram, during parsing of CALL functions, when encountering invalid functions stack deltas (bug 1473809)

Browse source 
*I was feeling bored; so this is a very quick, and somewhat naive, attempt at fixing the bug.*

The breaking error, i.e. `Error during font loading: invalid array length`, was thrown when attempting to re-size the `stack` to a *negative* length when parsing the CALL functions.

Fixes https://bugzilla.mozilla.org/show_bug.cgi?id=1473809.
This commit is contained in:
Jonas Jenwald 2018-07-09 22:11:46 +02:00
parent 646d81cd09
commit 2b25deb84c
4 changed files with 33 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

39
src/core/fonts.js
View file

@ -2109,21 +2109,32 @@ var Font = (function FontClosure() {
if (!inFDEF && !inELSE) {
// collecting information about which functions are used
funcId = stack[stack.length - 1];
ttContext.functionsUsed[funcId] = true;
if (funcId in ttContext.functionsStackDeltas) {
stack.length += ttContext.functionsStackDeltas[funcId];
} else if (funcId in ttContext.functionsDefined &&
!functionsCalled.includes(funcId)) {
callstack.push({ data, i, stackTop: stack.length - 1, });
functionsCalled.push(funcId);
pc = ttContext.functionsDefined[funcId];
if (!pc) {
warn('TT: CALL non-existent function');
ttContext.hintsValid = false;
return;
if (isNaN(funcId)) {
info('TT: CALL empty stack (or invalid entry).');
} else {
ttContext.functionsUsed[funcId] = true;
if (funcId in ttContext.functionsStackDeltas) {
let newStackLength = stack.length +
ttContext.functionsStackDeltas[funcId];
if (newStackLength < 0) {
warn('TT: CALL invalid functions stack delta.');
ttContext.hintsValid = false;
return;
}
stack.length = newStackLength;
} else if (funcId in ttContext.functionsDefined &&
!functionsCalled.includes(funcId)) {
callstack.push({ data, i, stackTop: stack.length - 1, });
functionsCalled.push(funcId);
pc = ttContext.functionsDefined[funcId];
if (!pc) {
warn('TT: CALL non-existent function');
ttContext.hintsValid = false;
return;
}
data = pc.data;
i = pc.i;
}
data = pc.data;
i = pc.i;
}
}
} else if (op === 0x2C && !tooComplexToFollowFunctions) { // FDEF