mirrors/pdf.js
1
0
Fork 0
mirror of https://github.com/mozilla/pdf.js.git synced 2025-04-26 10:08:06 +02:00
Code Activity

Merge pull request #9886 from Snuffleupagus/bug-1473809

Browse source 
Prevent errors in `sanitizeTTProgram`, during parsing of CALL functions, when encountering invalid functions stack deltas (bug 1473809)
This commit is contained in:
Tim van der Meij 2018-07-15 17:23:52 +02:00 • committed by GitHub
commit 61db85ab64
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
4 changed files with 33 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

39
src/core/fonts.js
View file

@ -2109,21 +2109,32 @@ var Font = (function FontClosure() {
if (!inFDEF && !inELSE) {
// collecting information about which functions are used
funcId = stack[stack.length - 1];
ttContext.functionsUsed[funcId] = true;
if (funcId in ttContext.functionsStackDeltas) {
stack.length += ttContext.functionsStackDeltas[funcId];
} else if (funcId in ttContext.functionsDefined &&
!functionsCalled.includes(funcId)) {
callstack.push({ data, i, stackTop: stack.length - 1, });
functionsCalled.push(funcId);
pc = ttContext.functionsDefined[funcId];
if (!pc) {
warn('TT: CALL non-existent function');
ttContext.hintsValid = false;
return;
if (isNaN(funcId)) {
info('TT: CALL empty stack (or invalid entry).');
} else {
ttContext.functionsUsed[funcId] = true;
if (funcId in ttContext.functionsStackDeltas) {
let newStackLength = stack.length +
ttContext.functionsStackDeltas[funcId];
if (newStackLength < 0) {
warn('TT: CALL invalid functions stack delta.');
ttContext.hintsValid = false;
return;
}
stack.length = newStackLength;
} else if (funcId in ttContext.functionsDefined &&
!functionsCalled.includes(funcId)) {
callstack.push({ data, i, stackTop: stack.length - 1, });
functionsCalled.push(funcId);
pc = ttContext.functionsDefined[funcId];
if (!pc) {
warn('TT: CALL non-existent function');
ttContext.hintsValid = false;
return;
}
data = pc.data;
i = pc.i;
}
data = pc.data;
i = pc.i;
}
}
} else if (op === 0x2C && !tooComplexToFollowFunctions) { // FDEF