Prevent circular references in Type3 fonts

Snuffleupagus · pull[bot] · commit 1974436279bf · 2022-12-12T10:12:58.000Z
In corrupt PDF documents Type3 fonts may introduce circular dependencies, thus resulting in the affected font(s) never loading and parsing/rendering never completing. Note that I've not seen any real-world examples of this kind of font corruption, but the attached PDF document was rather found in https://github.com/pdf-association/safedocs/tree/main/Miscellaneous%20Targeted%20Test%20PDFs *Please note:* That repository contains a number of reduced test-cases that are specifically intended to test interoperability (between PDF viewer) and parsing/rendering for various kinds of strange/corrupt PDF documents. Some of the test-cases found there may thus not make sense to try and "fix" upfront, in my opinion, unless the problems are also found in real-world PDF documents.
diff --git a/src/core/evaluator.js b/src/core/evaluator.js
@@ -1155,6 +1155,10 @@ class PartialEvaluator {
       }
     }
 
+    if (this.parsingType3Font && this.type3FontRefs.has(fontRef)) {
+      return errorFont();
+    }
+
     if (this.fontCache.has(fontRef)) {
       return this.fontCache.get(fontRef);
     }
@@ -4183,6 +4187,12 @@ class TranslatedFont {
     // make sense to only be able to render a Type3 glyph partially.
     const type3Evaluator = evaluator.clone({ ignoreErrors: false });
     type3Evaluator.parsingType3Font = true;
+    // Prevent circular references in Type3 fonts.
+    const type3FontRefs = new RefSet(evaluator.type3FontRefs);
+    if (this.dict.objId && !type3FontRefs.has(this.dict.objId)) {
+      type3FontRefs.put(this.dict.objId);
+    }
+    type3Evaluator.type3FontRefs = type3FontRefs;
 
     const translatedFont = this.font,
       type3Dependencies = this.type3Dependencies;
diff --git a/test/pdfs/.gitignore b/test/pdfs/.gitignore
@@ -218,6 +218,7 @@
 !issue7339_reduced.pdf
 !issue3438.pdf
 !issue11403_reduced.pdf
+!ContentStreamCycleType3insideType3.pdf
 !issue2074.pdf
 !scan-bad.pdf
 !issue13561_reduced.pdf
diff --git a/test/pdfs/ContentStreamCycleType3insideType3.pdf b/test/pdfs/ContentStreamCycleType3insideType3.pdf
diff --git a/test/test_manifest.json b/test/test_manifest.json
@@ -4537,6 +4537,12 @@
        "lastPage": 3,
        "type": "eq"
     },
+    {  "id": "ContentStreamCycleType3insideType3",
+       "file": "pdfs/ContentStreamCycleType3insideType3.pdf",
+       "md5": "64840fc5dd8ca06afbc86477d9121b59",
+       "rounds": 1,
+       "type": "eq"
+    },
     { "id": "issue3458.pdf",
       "file": "pdfs/issue3458.pdf",
       "md5": "dab8bd3ad1acfc8dc82a8381a3c8ff94",
