summaryrefslogtreecommitdiff
path: root/source/pdf
diff options
context:
space:
mode:
authorSebastian Rasmussen <sebras@gmail.com>2017-05-27 14:43:05 +0800
committerSebastian Rasmussen <sebras@gmail.com>2017-05-27 16:34:47 +0800
commitcedd12f48e4460cd4d7fca58c064787151c13a8d (patch)
treef6105c69048426bddd62044c150a649f4ee5630e /source/pdf
parent3b1083e580c59511f38cc7b6ac31544bedc60bb3 (diff)
downloadmupdf-cedd12f48e4460cd4d7fca58c064787151c13a8d.tar.xz
Bug 697947: Handle Illegal hex codes in PDF names.
PDF 1.2 and prior treats # in PDF names to be regular characters. PDF 1.2 and later treats # as escape characters for character hex codes. Previously illegal hex codes, e.g. #BX, were partially parsed as escaped hex codes and the illegal remainder parsed as regular characters. Now illegal hex codes are handled as consisting entirely of regular characters. Note that character code 0 is also considered to be an illegal hex code.
Diffstat (limited to 'source/pdf')
-rw-r--r--source/pdf/pdf-lex.c64
1 files changed, 27 insertions, 37 deletions
diff --git a/source/pdf/pdf-lex.c b/source/pdf/pdf-lex.c
index 74355d05..751f6a61 100644
--- a/source/pdf/pdf-lex.c
+++ b/source/pdf/pdf-lex.c
@@ -225,46 +225,36 @@ lex_name(fz_context *ctx, fz_stream *f, pdf_lexbuf *lb)
goto end;
case '#':
{
- int d;
- c = fz_read_byte(ctx, f);
- switch (c)
- {
- case RANGE_0_9:
- d = (c - '0') << 4;
- break;
- case RANGE_a_f:
- d = (c - 'a' + 10) << 4;
- break;
- case RANGE_A_F:
- d = (c - 'A' + 10) << 4;
- break;
- default:
- fz_unread_byte(ctx, f);
- /* fallthrough */
- case EOF:
- goto end;
- }
- c = fz_read_byte(ctx, f);
- switch (c)
+ int hex[2];
+ int i;
+ for (i = 0; i < 2; i++)
{
- case RANGE_0_9:
- c -= '0';
- break;
- case RANGE_a_f:
- c -= 'a' - 10;
- break;
- case RANGE_A_F:
- c -= 'A' - 10;
- break;
- default:
- fz_unread_byte(ctx, f);
- /* fallthrough */
- case EOF:
- *s++ = d;
- goto end;
+ c = fz_peek_byte(ctx, f);
+ switch (c)
+ {
+ case RANGE_0_9:
+ if (i == 1 && c == '0' && hex[0] == 0)
+ goto illegal;
+ hex[i] = fz_read_byte(ctx, f) - '0';
+ break;
+ case RANGE_a_f:
+ hex[i] = fz_read_byte(ctx, f) - 'a' + 10;
+ break;
+ case RANGE_A_F:
+ hex[i] = fz_read_byte(ctx, f) - 'A' + 10;
+ break;
+ default:
+ case EOF:
+ goto illegal;
+ }
}
- *s++ = d + c;
+ *s++ = (hex[0] << 4) + hex[1];
break;
+illegal:
+ if (i == 1)
+ fz_unread_byte(ctx, f);
+ *s++ = '#';
+ continue;
}
default:
*s++ = c;