Development record
A PDF text string written in hex, a FEFF-led run of hex digits between angle brackets, is not read by the payload byte scan: the hex spelling never puts the UTF-16 bytes in the file, so the UTF-16 view (utf16.go) cannot reach the caller's name in such an /Author or /Creator at any length. Reading it needs no escape grammar: the hex pairs decode to bytes with an offset map, and the decoded bytes feed the existing UTF-16 view. This is the hex half of iss-2609261831352258, split from its octal-literal half. Detector: the caller's name in a UTF-16 /Author written as a hex string is a real_name finding in the payload scan, and a short one is kept only where a person key stands within reach.
A PDF text string written in hex, a FEFF-led run of hex digits between angle brackets, is not read by the payload byte scan: the hex spelling never puts the UTF-16 bytes in the file, so the UTF-16 view (utf16.go) cannot reach the caller's name in such an /Author or /Creator at any length. Reading it needs no escape grammar: the hex pairs decode to bytes with an offset map, and the decoded bytes feed the existing UTF-16 view. This is the hex half of iss-2609261831352258, split from its octal-literal half. Detector: the caller's name in a UTF-16 /Author written as a hex string is a real_name finding in the payload scan, and a short one is kept only where a person key stands within reach.
Grounds
- pursued: a name in a hex-spelled PDF text string is found at linear cost without new findings on chance bytes; a launch dry-run that reports a new finding on this tree's assets, or a hex-spelled /Author name the scan still passes, would show it wrong
Frontmatter
| id | iss-2609261909108726 |
|---|---|
| type | issue |
| lifecycle | resolved |
| severity | minor |
.abcd/work/issues/resolved/iss-2609261909108726-a-pdf-text-string-written-in-hex-a-feff.md
open on GitHub ↗ · commit history ↗
mentions1
- iss-2609261831352258A PDF text string written in hex (a FEFF-led run of hex digits between angle brackets) or with octal escapes (a backslash-376, backslash-377 opening inside parentheses), the forms several common PDF writers use for a non-ASCII document field, is read by neither the payload byte scan nor its UTF-16 view: neither spelling puts the UTF-16 bytes in the file, so the caller's name in such an /Author or /Creator raises nothing at any length. Reading them is a decode of the string syntax ahead of the UTF-16 view (hex pairs, and the PDF literal-string escapes), in the shape of the percent and JSON-escape views, not a format parser. Detector: the caller's name in a UTF-16 /Author written in hex or with octal escapes is a real_name finding in the payload scan.