Skip to content

Conversation

@PietroCarrara
Copy link

@PietroCarrara PietroCarrara commented Mar 30, 2025

This is a simple bugfix: mutool run had a stack for PDF objects that was only being read from, not written to. This caused a NULL/garbage pointer read.

There were two ways this could be fixed, in my mind:

  • Actually inserting pdf objects into the stack
  • Removing the whole thing;

I picked the 2nd option because:

  • It's simpler
  • When we create PDF objects to pass to JS (ffi_pushobj), we already register functions to drop them. So I believe there's no need for the cleanup that existed before.

Below, there's a simple case to reproduce the bug:

Reproducing

  • Download blank-form.pdf or any PDF with a XForm Object.
  • Run mutool run bug.js blank-form.pdf

bug.js:

function main() {
  var input = Document.openDocument(scriptArgs[0]);

  for (var i = 0; i < input.countPages(); i++) {
    var page = input.loadPage(i);
    page.process({
      op_Do_form: function () {
        print("Hello from JS!");
      },
    });
  }
}

if (scriptArgs.length !== 1) {
  print("usage: mutool run input.pdf");
} else {
  main();
}

Expected output

The program prints Hello from JS! for each Form XObject.

Actual output

The program segfaults.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant