GitHub Security Advisory: GHSA-88q9-cmp2-c2vq
Package: oxidize-pdf (PIP)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-20: Improper Input Validation, CWE-1284: Improper Validation of Specified Quantity in Input
Vulnerable versions: <= 0.4.3
Patched in: 0.5.0

Summary: oxidize-pdf: NaN/inf bypass in colour content-stream emission causes PDF rejection (DoS)

Details:
### Impact

  `oxidize-pdf` defines `Color` as a `pub enum` with public tuple-struct variants `Rgb(f64, f64, f64)`, `Gray(f64)`, and `Cmyk(f64, f64, f64, f64)`. The constructors `Color::rgb`, `Color::gray`, and `Color::cmyk` clamp incoming
  components to `[0.0, 1.0]`, but because the variants are `pub`, callers can construct values directly without going through the constructors:

  ```rust
  let safe   = Color::rgb(f64::NAN, 0.5, 0.5);   // clamps NaN to 0.0
  let attack = Color::Rgb(f64::NAN, 0.5, 0.5);    // bypasses clamp

  Color: Copy allows the non-finite value to propagate freely through API surfaces and serialisation. When such a value reaches a content-stream emitter, the writer formats it via format!("{:.3}", v). The Rust standard library renders
  f64::NAN as "NaN", f64::INFINITY as "inf", and f64::NEG_INFINITY as "-inf" — none of which are valid PDF numeric tokens per ISO 32000-1 §7.3.3:

  ▎ A numeric object shall be represented by one or more decimal digits with an optional sign and a leading, trailing, or embedded PERIOD.

  The resulting content stream contains an invalid token sequence (e.g. NaN 0.500 0.500 rg). Conformant PDF viewers (Adobe Acrobat, Foxit, PDF.js, Apple Preview) reject the content stream, the affected page, or the entire document
  depending on parser strictness.

  Affected packages (all listed in the "Affected products" section of this advisory):

  - oxidize-pdf on crates.io — the core Rust library where the vulnerable code path lives.
  - OxidizePdf.NET on NuGet — .NET FFI binding that exposes Color through its public API; inherits the vulnerability from its dependency on oxidize-pdf.
  - oxidize-pdf on PyPI — Python bindings (PyO3) that similarly expose colour construction; inherits the vulnerability from its dependency.

  Who is impacted: any application that uses these packages to generate PDFs and accepts user-influenced colour values without validation. The most exposed surfaces are server-side PDF generators that take arbitrary f64 colour
  parameters from upstream services.

  Reproduction (Rust API):
  use oxidize_pdf::{Document, Page, graphics::Color};

  let mut doc = Document::new();
  let mut page = Page::a4();
  let gc = page.graphics();
  gc.set_fill_color(Color::Rgb(f64::NAN, 0.5, 0.5));
  gc.rectangle(50.0, 50.0, 100.0, 100.0).fill();
  doc.add_page(page);
  doc.save("malformed.pdf").unwrap();

  // The resulting content stream contains:
  //   NaN 0.500 0.500 rg
  //   50 50 100 100 re
  //   f
  // which conformant viewers reject.

  Affected sites in oxidize-pdf 2.5.7 (the same code paths are reached by both .NET and Python bindings via FFI):

  - oxidize-pdf-core/src/text/flow.rs (TextFlowContext)
  - oxidize-pdf-core/src/text/mod.rs (TextContext::apply_text_state_parameters)
  - oxidize-pdf-core/src/graphics/mod.rs (GraphicsContext::apply_fill_color / apply_stroke_color)
  - oxidize-pdf-core/src/graphics/patterns.rs (create_checkerboard_pattern / create_stripe_pattern / create_dots_pa