From 27fad65e4bf7af760ca42adc254331b12fa26c29 Mon Sep 17 00:00:00 2001
From: tannevaled <tannevaled@users.noreply.github.com>
Date: Sat, 26 Sep 2026 11:43:14 +0200
Subject: [PATCH] Run the tests where poppler does not go, and on 32-bit

Cross-compiling proves the code is well-formed for a target. It says nothing
about whether it computes the right answer there, and this package reassembles
multi-byte numbers out of a byte stream and multiplies widths by heights -- the
two shapes in which an endianness assumption and an integer overflow hide.

Six lanes under qemu-user-static: riscv64, loong64, ppc64le, s390x (big-endian)
and 386/arm (32-bit int).

The same lanes on go-pdfkit/render found a real defect within the hour: a
ceiling written as `cw*ch > max` that a 32-bit int wrapped past, letting a 1 KB
file ask the decoder for four gigabytes.
---
 .github/workflows/ci.yml | 31 +++++++++++++++++++++++++++++++
 1 file changed, 31 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d999a11..aaee26d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -52,3 +52,34 @@ jobs:
           GOOS=js      GOARCH=wasm  go build ./...
           GOOS=darwin  GOARCH=arm64 go build ./...
           GOOS=windows GOARCH=amd64 go build ./...
+
+  # Cross-compiling proves the code COMPILES for an architecture; it does not
+  # prove it computes the right answer there. This package reads a PDF: xref
+  # offsets, stream lengths and object numbers, all of them numbers taken out of
+  # a file and held in an int.
+  #
+  # s390x is BIG-ENDIAN and 386/arm are 32-bit, so between them these lanes
+  # cover both assumptions a byte-stream reader can carry without knowing it.
+  # poppler and pdfium test on none of the four 64-bit arches; 32-bit ARM they
+  # do hold, and we did not.
+  arch-qemu:
+    name: arch ${{ matrix.goarch }} (qemu)
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - { goarch: riscv64, qemu: qemu-riscv64-static }
+          - { goarch: loong64, qemu: qemu-loongarch64-static }
+          - { goarch: ppc64le, qemu: qemu-ppc64le-static }
+          - { goarch: s390x,   qemu: qemu-s390x-static }
+          - { goarch: "386",   qemu: qemu-i386-static }
+          - { goarch: arm,     qemu: qemu-arm-static }
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-go@v7
+        with:
+          go-version: "1.27.1"
+      - run: sudo apt-get update && sudo apt-get install -y qemu-user-static
+      - name: Test under qemu (${{ matrix.goarch }})
+        run: GOARCH=${{ matrix.goarch }} go test -exec=${{ matrix.qemu }} ./...