Repository navigation
Stop readHexString at the end of its input - #91
Merged
Merged
Conversation
A content stream that ends inside a hex string, as one does when its /Length is short, made readHexString loop for ever: at end of input readByte returns '\n', and the loop skips it as white space. It now stops at end of input, as readArray and readDict do. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HwFWqvYkhLz3RSShWD1qxQ
Owner
|
looks good |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A content stream that ends inside a hex string makes
GetPlainTextloop forever. At end of inputreadBytereturns'\n',readHexStringskips it as white space, and it never returns. It is the same shape #79 fixed forreadArray.Damaged files produce it: an uncompressed content stream whose
/Lengthis shorter than its data, cut inside a<...>string. A compressed stream cut short fails with an error instead.The fix stops the loop at end of input, as
readArrayandreadDictdo. The same two checks are part of #78's wider hardening, which conflicts with master today; this is that hex-string fix on its own, in the shape of #79.TestUnterminatedHexStringTerminatescovers three cuts: between pairs of digits, inside a pair, and inside an array. Each case hangs past the test's 5 s bound without the fix. The test reuses the unterminated-array test's builder, which now takes the content as a parameter.