From e9108584452687910b89e60ef6ffa9505d64fc86 Mon Sep 17 00:00:00 2001 From: Brandon Thomas Date: Sun, 4 Oct 2026 14:21:14 -0400 Subject: [PATCH] Never crash: PostScript radix numbers outside 2..=36 In EPS/PostScript, `0#7` asked i64::from_str_radix for radix 0, which panics (found by fuzzing). Radixes outside 2..=36 are not numbers now. Co-Authored-By: Claude Opus 5.5 --- crates/pdf/src/ps.rs | 2 +- crates/pdf/src/tests_import.rs | 9 +++++++++ 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/crates/pdf/src/ps.rs b/crates/pdf/src/ps.rs index 22d2e231..f0adaab2 100644 --- a/crates/pdf/src/ps.rs +++ b/crates/pdf/src/ps.rs @@ -278,7 +278,7 @@ impl Src<'_> { None => { // Radix numbers (16#FF). let s = String::from_utf8_lossy(w).into_owned(); - match s.split_once('#').and_then(|(r, v)| i64::from_str_radix(v, r.parse().ok()?).ok()) { + match s.split_once('#').and_then(|(r, v)| i64::from_str_radix(v, r.parse::().ok().filter(|r| (2..=36).contains(r))?).ok()) { Some(n) => V::Num(n as f64), None => V::Name(s.into()), } diff --git a/crates/pdf/src/tests_import.rs b/crates/pdf/src/tests_import.rs index e5daf94e..8314c7d1 100644 --- a/crates/pdf/src/tests_import.rs +++ b/crates/pdf/src/tests_import.rs @@ -304,3 +304,12 @@ fn closing_an_empty_path_is_a_no_op() { let _ = render(&doc); } } + +#[test] +fn postscript_radix_numbers_outside_2_to_36_are_not_numbers() { + // `0#7` asked `i64::from_str_radix` for radix 0, which panics (found by fuzzing). + for n in ["0#7", "1#1", "37#1", "99999999999#1", "16#FF"] { + let src = format!("%!PS-Adobe-3.0 EPSF-3.0\n%%BoundingBox: 0 0 100 100\n{n} pop 0 0 moveto 10 10 lineto stroke\n"); + let _ = parse(src.as_bytes()); + } +}