shifathosn
/
effectcraft
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Never crash: PostScript radix numbers outside 2..=36 

In EPS/PostScript, `0#7` asked i64::from_str_radix for radix 0, which panics (found by
fuzzing). Radixes outside 2..=36 are not numbers now.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Brandon Thomas 2026-10-04 14:21:14 -04:00
parent 8e4e29844e
commit e910858445
2 changed files with 10 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
crates/pdf/src/ps.rs
View File

@ -278,7 +278,7 @@ impl Src<'_> {
None => {
// Radix numbers (16#FF).
let s = String::from_utf8_lossy(w).into_owned();
match s.split_once('#').and_then(|(r, v)| i64::from_str_radix(v, r.parse().ok()?).ok()) {
match s.split_once('#').and_then(|(r, v)| i64::from_str_radix(v, r.parse::<u32>().ok().filter(|r| (2..=36).contains(r))?).ok()) {
Some(n) => V::Num(n as f64),
None => V::Name(s.into()),
}

9
crates/pdf/src/tests_import.rs
View File

@ -304,3 +304,12 @@ fn closing_an_empty_path_is_a_no_op() {
let _ = render(&doc);
}
}
#[test]
fn postscript_radix_numbers_outside_2_to_36_are_not_numbers() {
// `0#7` asked `i64::from_str_radix` for radix 0, which panics (found by fuzzing).
for n in ["0#7", "1#1", "37#1", "99999999999#1", "16#FF"] {
let src = format!("%!PS-Adobe-3.0 EPSF-3.0\n%%BoundingBox: 0 0 100 100\n{n} pop 0 0 moveto 10 10 lineto stroke\n");
let _ = parse(src.as_bytes());
}
}