Correct reversed Rectangle coordinates (fixes #363)

ChangeLog

@@ -1,5 +1,9 @@
 2019-09-19  Jay Berkenbilt  <ejb@ql.org>
 
+	* When converting an array to a Rectangle, ensure that llx <= urx
+	and lly <= ury. This prevents flatten-annotations from flipping
+	fields whose coordinates are messed up in the input. Fixes #363.
+
 	* Warn when duplicated dictionary keys are found during parsing.
 	The behavior remains as before: later keys override earlier ones.
 	However, this generates a warning now rather than being silently

libqpdf/QPDFObjectHandle.cc

@@ -30,6 +30,7 @@
 #include <ctype.h>
 #include <limits.h>
 #include <cstring>
+#include <algorithm>
 
 class TerminateParsing
 {
@@ -717,10 +718,17 @@ QPDFObjectHandle::getArrayAsRectangle()
     Rectangle result;
     if (isRectangle())
     {
-        result = Rectangle(getArrayItem(0).getNumericValue(),
-                           getArrayItem(1).getNumericValue(),
-                           getArrayItem(2).getNumericValue(),
-                           getArrayItem(3).getNumericValue());
+        // Rectangle coordinates are always supposed to be llx, lly,
+        // urx, ury, but files have been found in the wild where
+        // llx > urx or lly > ury.
+        double i0 = getArrayItem(0).getNumericValue();
+        double i1 = getArrayItem(1).getNumericValue();
+        double i2 = getArrayItem(2).getNumericValue();
+        double i3 = getArrayItem(3).getNumericValue();
+        result = Rectangle(std::min(i0, i2),
+                           std::min(i1, i3),
+                           std::max(i0, i2),
+                           std::max(i1, i3));
     }
     return result;
 }

qpdf/qtest/qpdf/manual-appearances.pdf

@@ -819,10 +819,10 @@ endobj
   /Ff 4096
   /P 100 0 R
   /Rect [
-    294.149
-    430.251
     366.951
     528.249
+    294.149
+    430.251
   ]
   /Subtype /Widget
   /T (Text Box 3)