From 1d4ae786f4a961e5cbdb9794a8f66733f6b4ce99 Mon Sep 17 00:00:00 2001
From: Calixte Denizet <calixte.denizet@gmail.com>
Date: Sat, 9 Aug 2025 22:34:40 +0200
Subject: [PATCH] Check the setDash arguments

It fixes #20155.
---
 src/core/evaluator.js       | 16 ++++++++++++++++
 test/unit/evaluator_spec.js | 12 ++++++++++++
 2 files changed, 28 insertions(+)

diff --git a/src/core/evaluator.js b/src/core/evaluator.js
index 25b32505b..474f29788 100644
--- a/src/core/evaluator.js
+++ b/src/core/evaluator.js
@@ -2206,6 +2206,22 @@ class PartialEvaluator {
             args[0] = Math.abs(thickness);
             break;
           }
+          case OPS.setDash: {
+            const dashPhase = args[1];
+            if (typeof dashPhase !== "number") {
+              warn(`Invalid setDash: ${dashPhase}`);
+              continue;
+            }
+            const dashArray = args[0];
+            if (!Array.isArray(dashArray)) {
+              warn(`Invalid setDash: ${dashArray}`);
+              continue;
+            }
+            if (dashArray.some(x => typeof x !== "number")) {
+              args[0] = dashArray.filter(x => typeof x === "number");
+            }
+            break;
+          }
           case OPS.moveTo:
           case OPS.lineTo:
           case OPS.curveTo:
diff --git a/test/unit/evaluator_spec.js b/test/unit/evaluator_spec.js
index 643a965f0..7ec3056d2 100644
--- a/test/unit/evaluator_spec.js
+++ b/test/unit/evaluator_spec.js
@@ -357,6 +357,18 @@ describe("evaluator", function () {
       expect(result.argsArray).toEqual([]);
       expect(result.fnArray).toEqual([]);
     });
+
+    it("should handle invalid dash stuff", async function () {
+      const stream = new StringStream("[ none ] 0 d");
+      const result = await runOperatorListCheck(
+        partialEvaluator,
+        stream,
+        new ResourcesMock()
+      );
+      expect(result.argsArray[0][0]).toEqual([]);
+      expect(result.argsArray[0][1]).toEqual(0);
+      expect(result.fnArray[0]).toEqual(OPS.setDash);
+    });
   });
 
   describe("thread control", function () {