From ea8e910bb8f0d974673fcf32b89303da0b13c942 Mon Sep 17 00:00:00 2001
From: Tor Andersson <tor.andersson@artifex.com>
Date: Thu, 9 Aug 2018 11:30:12 +0200
Subject: Treat invalid and truncated hex string characters as '0'.

---
 source/pdf/pdf-lex.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/source/pdf/pdf-lex.c b/source/pdf/pdf-lex.c
index bc7393c7..e6a925ff 100644
--- a/source/pdf/pdf-lex.c
+++ b/source/pdf/pdf-lex.c
@@ -419,6 +419,9 @@ lex_hex_string(fz_context *ctx, fz_stream *f, pdf_lexbuf *lb)
 		{
 		case IS_WHITE:
 			break;
+		default:
+			fz_warn(ctx, "invalid character in hex string");
+			/* fall through */
 		case IS_HEX:
 			if (x)
 			{
@@ -432,11 +435,13 @@ lex_hex_string(fz_context *ctx, fz_stream *f, pdf_lexbuf *lb)
 			}
 			break;
 		case '>':
+			if (x)
+			{
+				*s++ = a * 16; /* pad truncated string with '0' */
+			}
 			goto end;
 		case EOF:
 			return PDF_TOK_ERROR;
-		default:
-			fz_warn(ctx, "ignoring invalid character in hex string");
 		}
 	}
 end:
-- 
cgit v1.2.3