Skip to content

Commit

Permalink
fix panic on malformed CIDToGID tables
Browse files Browse the repository at this point in the history
If the number of bytes in the stream is odd, indexing c[1] will result in an
out of bounds access and will cause a panic.

This should not happen normally, since the spec says that this field should be
a list of u16, but some malformed PDF trigger this bug.
  • Loading branch information
Orycterope authored and s3bk committed Aug 2, 2024
1 parent 94dc9b8 commit 22ff7fd
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion pdf/src/font.rs
Original file line number Diff line number Diff line change
Expand Up @@ -75,7 +75,7 @@ impl Object for CidToGidMap {
p @ Primitive::Stream(_) | p @ Primitive::Reference(_) => {
let stream: Stream<()> = Stream::from_primitive(p, resolve)?;
let data = stream.data(resolve)?;
Ok(CidToGidMap::Table(data.chunks(2).map(|c| (c[0] as u16) << 8 | c[1] as u16).collect()))
Ok(CidToGidMap::Table(data.chunks_exact(2).map(|c| (c[0] as u16) << 8 | c[1] as u16).collect()))
},
p => Err(PdfError::UnexpectedPrimitive {
expected: "/Identity or Stream",
Expand Down

0 comments on commit 22ff7fd

Please sign in to comment.