From 3ef7fb18dc749ae51b29d3d417258a490dc6e26c Mon Sep 17 00:00:00 2001
From: Nico Weber <thakis@chromium.org>
Date: Wed, 29 Jul 2026 19:21:07 -0400
Subject: [PATCH] LibPDF: Clear arguments of unknown operators

This is a follow-up to #26905: If an unknown operator had arguments,
we used to not clear them, causing the next known operator to
receive them.

To test, call an unknown operator with a non-number arg,
followed by `re`.
---
 Tests/LibPDF/invalid-operator.pdf    | 7 +++++--
 Userland/Libraries/LibPDF/Parser.cpp | 1 +
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/Tests/LibPDF/invalid-operator.pdf b/Tests/LibPDF/invalid-operator.pdf
index 7e4e24cbf7d..48dcb670b27 100644
--- a/Tests/LibPDF/invalid-operator.pdf
+++ b/Tests/LibPDF/invalid-operator.pdf
@@ -14,11 +14,14 @@ endobj
 endobj
 
 4 0 obj
-<</Length 5>>
+<</Length 52>>
 stream
 q
 QQ
 
+() anotherunknownopwithanarg
+0 0 100 100 re f
+
 endstream
 endobj
 
@@ -33,5 +36,5 @@ xref
 trailer
 <</Size 5/Root 1 0 R>>
 startxref
-248
+296
 %%EOF
diff --git a/Userland/Libraries/LibPDF/Parser.cpp b/Userland/Libraries/LibPDF/Parser.cpp
index 4eb7d2f3255..27c6fb08b08 100644
--- a/Userland/Libraries/LibPDF/Parser.cpp
+++ b/Userland/Libraries/LibPDF/Parser.cpp
@@ -602,6 +602,7 @@ PDFErrorOr<Vector<Operator>> Parser::parse_operators()
                 //        but we ignore them everywhere. All other engines seem to do that too, so some files depend on it.
                 //        (Usually accidentally, e.g. containing "QQ" instead of "Q Q" or similar.)
                 dbgln("ignoring unknown operator \"{}\"", operator_string);
+                operator_args.clear();
                 continue;
             }
             auto operator_type = maybe_operator_type.release_value();