From 183fe652e43f06b65a484b58f521b3c64f29b7ae Mon Sep 17 00:00:00 2001 From: bflatastic Date: Fri, 16 Oct 2026 17:36:11 +0700 Subject: [PATCH] pdf: an inline image just under usize::MAX bytes doesn't overflow its end offset Co-Authored-By: Claude Opus 5.5 --- crates/pdf/src/page.rs | 2 +- crates/pdf/src/tests_import.rs | 5 +++++ 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/crates/pdf/src/page.rs b/crates/pdf/src/page.rs index 13e98b3c..1d84c0fb 100644 --- a/crates/pdf/src/page.rs +++ b/crates/pdf/src/page.rs @@ -515,7 +515,7 @@ impl<'a> Interp<'a> { && (p + 2 == data.len() || crate::object::is_white(data[p + 2])) }; let end = match crate::image::inline_len(self.file, &d, Some(res)) { - Some(len) => (start + len).min(data.len()), + Some(len) => start.saturating_add(len).min(data.len()), None => { let mut p = start; while p + 1 < data.len() && !is_ei(p) { diff --git a/crates/pdf/src/tests_import.rs b/crates/pdf/src/tests_import.rs index 3e7cd570..2e103d5e 100644 --- a/crates/pdf/src/tests_import.rs +++ b/crates/pdf/src/tests_import.rs @@ -276,6 +276,11 @@ fn inline_image_with_absurd_dimensions_falls_back_to_ei_scan() { let doc = parse(&bytes).unwrap(); let _ = render(&doc); assert!(!doc.skipped.is_empty()); + // A length just under `usize::MAX` passes the row math; past byte 4096 of the content the + // caller's `start + len` would then overflow. + let content = format!("{}q 10 0 0 10 0 0 cm BI /W 2305843009213693440 /H 8 /CS /G /BPC 8 ID EI Q", " ".repeat(5000)); + let doc = parse(&page_pdf(&content, "", vec![])).unwrap(); + let _ = render(&doc); } #[test]