From 8a1cb82aeedb7a2c3c2b3b8238c35dd22c1aefb2 Mon Sep 17 00:00:00 2001 From: Jonas Jenwald Date: Fri, 7 May 2021 12:44:20 +0200 Subject: [PATCH] Ensure that the `Widths` array is parsed correctly in `PartialEvaluator.preEvaluateFont` *Please note:* While I don't have a document that this patches fixes, the current code is however not entirely correct as far as I can tell. Looking at how the `Widths` array is parsed in `PartialEvaluator.extractWidths`, it's clear that the implementation in `PartialEvaluator.preEvaluateFont` is a bit too simplistic. In particular, by only wrapping the data into a TypedArray, there's no attempt to handle *indirect* objects which could potentially lead to colliding `hash`es being computed. --- src/core/evaluator.js | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/src/core/evaluator.js b/src/core/evaluator.js index ee9017558..7202e2052 100644 --- a/src/core/evaluator.js +++ b/src/core/evaluator.js @@ -3616,9 +3616,14 @@ class PartialEvaluator { } const widths = dict.get("Widths") || baseDict.get("Widths"); - if (widths) { - uint8array = new Uint8Array(new Uint32Array(widths).buffer); - hash.update(uint8array); + if (Array.isArray(widths)) { + const widthsBuf = []; + for (const entry of widths) { + if (isNum(entry) || isRef(entry)) { + widthsBuf.push(entry.toString()); + } + } + hash.update(widthsBuf.join()); } if (composite) {