Merge pull request #16483 from calixteman/bug1529502

calixteman · web-flow · commit f06d0b2a9e50 · 2023-05-28T20:42:59.000+02:00
[OTS] Remove cntrmask instruction with no stem in charstring (bug 1529502)
diff --git a/src/core/cff_parser.js b/src/core/cff_parser.js
@@ -546,6 +546,13 @@ class CFFParser {
         stackSize++;
       } else if (value === 19 || value === 20) {
         state.hints += stackSize >> 1;
+        if (state.hints === 0) {
+          // Not a valid value (see bug 1529502): just remove it.
+          data.copyWithin(j - 1, j, -1);
+          j -= 1;
+          length -= 1;
+          continue;
+        }
         // skipping right amount of hints flag data
         j += (state.hints + 7) >> 3;
         stackSize %= 2;
diff --git a/test/pdfs/.gitignore b/test/pdfs/.gitignore
@@ -595,3 +595,4 @@
 !bug1825002.pdf
 !issue14755.pdf
 !issue16473.pdf
+!bug1529502.pdf
diff --git a/test/pdfs/bug1529502.pdf b/test/pdfs/bug1529502.pdf
diff --git a/test/test_manifest.json b/test/test_manifest.json
@@ -7676,5 +7676,12 @@
       "link": true,
       "forms": true,
       "type": "eq"
+   },
+   {
+      "id": "bug1529502",
+      "file": "pdfs/bug1529502.pdf",
+      "md5": "4830e765a3d6cb64d39b84de11178f6e",
+      "rounds": 1,
+      "type": "eq"
    }
 ]
