From 9dc64639333b4290b53753ca27fa693e480ba33a Mon Sep 17 00:00:00 2001 From: Jonas Jenwald Date: Fri, 7 Oct 2016 20:51:02 +0200 Subject: [PATCH] Ignore reserved commands when parsing operands in `CFFParser_parseDict`, instead of just rejecting the entire font (bug 1308536) According to the CFF specification, see http://partners.adobe.com/public/developer/en/font/5176.CFF.pdf#page=11, certain commands are currently reserved. Fixes https://bugzilla.mozilla.org/show_bug.cgi?id=1308536. --- src/core/cff_parser.js | 19 +++++++++++-------- test/pdfs/.gitignore | 1 + test/pdfs/bug1308536.pdf | Bin 0 -> 6753 bytes test/test_manifest.json | 7 +++++++ test/unit/cff_parser_spec.js | 35 +++++++++++++++++++++++++++++++---- 5 files changed, 50 insertions(+), 12 deletions(-) create mode 100644 test/pdfs/bug1308536.pdf diff --git a/src/core/cff_parser.js b/src/core/cff_parser.js index 3de7d3495f6cf..bd7608268dcda 100644 --- a/src/core/cff_parser.js +++ b/src/core/cff_parser.js @@ -349,9 +349,9 @@ var CFFParser = (function CFFParserClosure() { } else if (value >= 251 && value <= 254) { return -((value - 251) * 256) - dict[pos++] - 108; } else { - error('255 is not a valid DICT command'); + warn('CFFParser_parseDict: "' + value + '" is a reserved command.'); + return NaN; } - return -1; } function parseFloatOperand() { @@ -1000,19 +1000,22 @@ var CFFDict = (function CFFDictClosure() { if (!(key in this.keyToNameMap)) { return false; } + var valueLength = value.length; // ignore empty values - if (value.length === 0) { + if (valueLength === 0) { return true; } + // Ignore invalid values (fixes bug1068432.pdf and bug1308536.pdf). + for (var i = 0; i < valueLength; i++) { + if (isNaN(value[i])) { + warn('Invalid CFFDict value: "' + value + '" for key "' + key + '".'); + return true; + } + } var type = this.types[key]; // remove the array wrapping these types of values if (type === 'num' || type === 'sid' || type === 'offset') { value = value[0]; - // Ignore invalid values (fixes bug 1068432). - if (isNaN(value)) { - warn('Invalid CFFDict value: ' + value + ', for key: ' + key + '.'); - return true; - } } this.values[key] = value; return true; diff --git a/test/pdfs/.gitignore b/test/pdfs/.gitignore index f07e5921fe392..18ec5b402b829 100644 --- a/test/pdfs/.gitignore +++ b/test/pdfs/.gitignore @@ -54,6 +54,7 @@ !bug1068432.pdf !bug1146106.pdf !bug1252420.pdf +!bug1308536.pdf !issue5564_reduced.pdf !canvas.pdf !bug1132849.pdf diff --git a/test/pdfs/bug1308536.pdf b/test/pdfs/bug1308536.pdf new file mode 100644 index 0000000000000000000000000000000000000000..a5d0afe28250ecb237405ba3f476a5b2c6e4fdb4 GIT binary patch literal 6753 zcmeHMi9giq_fKRQq7c&JgA^5?Ss7WfW#9KG8e@jB%rG<7aP6{WNp?!MEGbvkk`xKa z60%&Bl-q`)ENyBcxu0sv~LYnvFHIAY~Nr{XjzWM=}IMsT*kk!hBG6c}hh zCwN)|XbcS0bj49E2y{Ri^deA66laj;g~Jm-O^^V3fH;tV!~4()AoH6Jl0iJh(-Q}h zKpIE|DWD7J4f=pY5Dz+o-aZsMfkq;`co0A<&=vFqEx{9@FK7hng4)nN4+@#N#@Wfk zgFvK%PE;J;oj_k76FfXfUNjQz7m-SGaixRCpcm)_Qt%`y-p7;ZLGTCNK-T~-R{|OI z2LnKY3l--}01ZKNP#rV@i6rR30K_?y2vkTB8n`haY~o-6Qpki2MVNB5KnnAOfuIhE zV{-MvQ3>RA-AuvtF>@*1j{?$NsRRP34{FFTEv`-SAfNyw#@PmZ6io5 ze4Oa(+Zjv{nvf`x2c1BL*m>aS1T6xd;!J>nh6J(;-4#Hg6%-hpXmlz8=Lyq|4YE3G zYT+VuSNK9uXmY7i##^Ih_Ie+B{p|_2+I_onua5|cUAu`ta!hikmP3~$A3u+Xgzo9ge+%kE#Kyn&hzwJaBQaa zD&AfEn)mD;!b~uFdL^m;``b#D+mk_WCJK;7zHX$>lyQE~xs*GjQe%Ey22oq$Qm4mh z5_797ZLMJnD>XV1PAdgG`%lX+eyh%UWhq`Q*q~nv9v{ z=3UOYXji0^`>F1ry_IQZ;rD>&x9r^m;GL1{1*Xd+_*iW@YJ9RXA>|I3bMls389T53u$y=2 zZn@&Dw8cdLAl3)}xFGveaG z{`!xxi~WAR0{gCwT1Y8m`J|<7|6=`slwJGBXy&mmMYDodF27r&oMpZ06nF#mNQ(6n zNhU2){aym~d6}FC_HKP5d|9g6zg&VuuRJ<5_I%D%m+!+t;Se#OuY21#f9RZv7|Wig z@N>+wyaC#R#)kvHh5sgW=TGWofy?1~i)n)CWB0RB$c~{9-7PV*V=DnVDbZsv%O%*& zxbl&#OV%l3g*IagyeVO9nOps2Slun=B4nP15JTTK|M+P6)dlfcWoc=@x%5=@-T5ed zAUg1hKFhdHi)CN;r>tXT*>z*u_<_-qlJuFx%y!?pKh*C_X>i-0bVIqT%Qj7|iGCX5 zOE4|0xnrxzZXF?DnANYFl@OI+&!2Z@hpB+_?&i6f-}s~F?^3uq)_zNV;%2%ZW|j7T#C=o zE6ea*y!`fKEWG*tT><4??axbYVFK#xBByTDOC@r-J6%@ZsagE+O|F zQy~qAZmG1r4h4Pgy0WXoB)2gY)$7T;F%{lOVcyhj{;}U$yYr7`rOHH=D-k1<)ch~` zom#Q=-=c_OoA2fc2Wo3J<==W5SZw#el;h@KRez4z#=|WhnEgb zjQa4zvQ5P_i^qNswx=9_61k70K?01cwGaFO)8u-bEPCBtjat{~jhA6Wd2{teo+8%mr*m~Iw#|g8ZtLEvZ?|`ZcS*r{ytw(yyF)jU zpV+m%D&@Ny6F4d?^kWIHpkWab0*l;pN3u^@vLQ8JtvJ7>oO=EiOeT3*M$<(|a70Sl z%P~D^EeWJL+&q^;|M3T3jE%}9ThUiZKEA%zuA?vdOROH2Xg(_u2BN%3s;^IDRdxEj zUudU@=@{aEi9G4|tEu~qRg@0La5e-^ZgaPLwDxct{?aks zkdbW}&r;CmZNIe2z4l4fU#XwJ1-!R?8NN#tSt?+qb*it(i4?$<`!=NptZTVM84nt? z;Ep^Sdo~L^iUm%;SxVl^8n}l&m@X2YK2CijN>y{_Pchij&7<_Z#%0PhN=S3sw{S`F z?UB+P%Ckfs(;Z5ZHIC|*NBzH66YpFpPsgT&wlRfbAs5l&r|d2C((vcSVZ;y zFWZt($3L)JN2hNs3;Sa#VrKQ6XA?h{6T!7nZEIY$gw2=s?e@VRCY>%;eaq;8#fR)5 z#m;b~Bqpt8e4uW3D~x-AjhfSZu#a%7TZEW?Y+q%oPGy9($Sc_bWjp(0vTRkp(t=TH z+?E{?#8kC|$vXfxPNV!OGl#Ic!hRucPW-+8W9Ap_+;=;EH`P|E4D_48`p-uvyK&D< zPuyHqUV7>GBjyTw$|F@VSc)oFr_h%IwabEv%|9x)oanmQbietHq+g%WM??^yeV=1Q zJlRZS708<@saCepQtQ%En;~$?B*QuWoVlfqQ-5^k%Q(eBO}k*Qu)(qTx8uD1F>^~{ zCQV{jK#A=5P-Sj!TI`PCFz!>pjNXCL5a;*v)~W||G9@JL2`&jCt)_?BxDO8Q_+kCQ zZmy(}we95WHQUg^@!GAxXFx@p(kCe>;_dY&DA=Xth_ zn$=R{_NUiahQ{LSPnsfU-$uJ-cE1+mRpnf53L}awqg1$dQa?)R>I(5M7-`tsjORYI zoxU;S*QA#1{Mibrhc>f|X|Qe4kek%9H55la&KlfZ0RAv1) z+JY7(*st)V&=gvNpD$-JC2IbF^uEiOqj7J)2l1)^ZNkAbjngx8YF>f%v|YJQ?)ql# zUphKvbybAT+tst68R|`1Qww zLS@S`g;rn7r^}m(6LA!`gYFzPsc@Eo{dlv*{eKLkCtR8>Y6;;)Yb{q3#_GnE@q6JW zsg@w;>nSWYmG7QlAX~yp-ZWgi;Jr}u<3(Y1-xq@xO)ut3#8w?$-_)t*c1^$1J*#wD z{kdLq&RpL}8oRbj-|)~Iy@)HdS7OT)cIRy8M~UAcK9jxJbd_?nJ~~!ZS@sjlQ}$HS zV>?G(jop-81ZBGOvQl=5r)W&+Vt;e{H+RPY_uA&*%4cw`lISs>KKX8!ra9^`U&ig7 z4IO#3E6>vTfyEoNgyt?DKMwN*B{}*XyivwNGybr!a;xLjB%ZeRu_JIt(W_@f?N@hu zf3%F2u@*L=ocz>LX)fM=mgkaBE$Sj|@D@+C^v8;PnaVv$cE9OMzF|+RDiVOxyEXb# z_LP|hT&kXAKPw}vtF{u%+i)XMi}f*|rm6dJ?NI*^g_<^phj{$^G=q%v=iGAwS^*rjCjV0EmNVkVpV@20%zB zA^^HT8Ur8+0NtRv8B)gs06hVa3@HsA0XjPXLRBvf(i{MN0MHjeAmIS$4}bvx7ziLx zkkDVa1b~2w@D0>}X`*$&0|GOc8X%F-QJB~PfJ8#VHgE_4$uKz+tbqD;qyg&x!XyAB z8afXXf`IzJCN>KF6J)3;hoF_sH9dN>hyTwK9;5iT3f|J(h!O$kx$~#ZN&|_bc`Kb? zW9*Cg=PJI+i8*v8FDX*GPjl`2dl8>8mW2hUKUW_lKK=T5atWn1AA;t{z4FfUowq1B z3FLklx7RgyJ&OWwe^Ahz1`1xb`eb{L{6UT^H}B`zXMFSS{R!jaZOc3EtO^BFdcFJ% zRqvj|p341tk7bqzF^H)dDRce)q+yt-b`Cq6q~x$qLv*QALb(px*q%>$zx#^*v}n2U zaA@84-%6}6c)#uTn@-beN640UErgQ9$2mhJaxZV~xxBkRTp`lt$!r`M%@ke+j`4iO=)nZ4eS{bsv25oZor{ZKoye@^? z&v!pK>*g+!)~7OOPx&ZsM5d1){4scA3+tAJ+m&nodM7cPJ!Xn?fo`KbM1nvgCY+;* zgTNrl-<-^t-vDlm2+kzjIwS;#$VfCCz`&spF(5fZ*II$W33}3`_(1Rz1Rybau8Y|m zHjH%}98DP@7yXwO|AD_bfkyG6GIGZT#`trD0I&?H4EE3;B$`Zz*wFyRb?PP!HY>o` zvY~)BiAtk0Fh~G}gjA+jkx2~r319>_WS74KTmS>>gs8u61Hedf(6a`PMqsS`uc+tW zfG-H*!u^zuL_-*z4au4A3K->-y%uk+-IcOam1E3HX<~lSM ziVG}r9<2b;AlVH4p#B%{%{@YaNoSyoo9PT5>%7-_Fl8|0Fwca6awAh0#vX*C;!pWV zNH#+zLw86w1`m0Ld`0M)VFRWNq&#Eqf7a=5dO$Cc&Cma7jKD&Ef!cqX|9|?w`~TnU z!tmc_`mcEUMMEMWKQm$h@!x&Jj3MmCdyH{QH|GLIqS(jr36$jRLjV}f1Ik%M3K>r) zQOGpF`H&1?=>|Jt`ESYDpGqLYpkRi>;2R(49~TS?0}z1?8g$LpX94mC4FiSqKWJ#i z_4p@E9=eAApkd(9wfH9u0f(|2@B{rWL4~a+ nZF35R4lv$7P`b1r1ritsT}SnCRQmeS<