mirrors/pdf.js
1
0
Fork 0
mirror of https://github.com/mozilla/pdf.js.git synced 2025-04-22 16:18:08 +02:00
Code Activity

Check the top-level /Pages dictionary when finding the trailer in XRef.indexObjects (issue 12402)

Browse source 
In addition to the existing /Root and /Pages validation, also check that the /Pages-entry actually is a dictionary and that it has a valid /Count-entry.
This way we can avoid picking a trailer candidate which e.g. the `Catalog.numPages` getter will just end up rejecting, thus breaking PDF document loading completely.
This commit is contained in:
Jonas Jenwald 2020-11-25 13:44:57 +01:00
parent b1d3b6eb12
commit 8a132f584d
3 changed files with 25 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

23
src/core/obj.js
View file

@ -1836,14 +1836,13 @@ var XRef = (function XRefClosure() {
}
}
// reading XRef streams
var i, ii;
for (i = 0, ii = xrefStms.length; i < ii; ++i) {
for (let i = 0, ii = xrefStms.length; i < ii; ++i) {
this.startXRefQueue.push(xrefStms[i]);
this.readXRef(/* recoveryMode */ true);
}
// finding main trailer
let trailerDict;
for (i = 0, ii = trailers.length; i < ii; ++i) {
for (let i = 0, ii = trailers.length; i < ii; ++i) {
stream.pos = trailers[i];
const parser = new Parser({
lexer: new Lexer(stream),
@ -1861,18 +1860,26 @@ var XRef = (function XRefClosure() {
continue;
}
// Do some basic validation of the trailer/root dictionary candidate.
let rootDict;
try {
rootDict = dict.get("Root");
const rootDict = dict.get("Root");
if (!(rootDict instanceof Dict)) {
continue;
}
const pagesDict = rootDict.get("Pages");
if (!(pagesDict instanceof Dict)) {
continue;
}
const pagesCount = pagesDict.get("Count");
if (!Number.isInteger(pagesCount)) {
continue;
}
// The top-level /Pages dictionary isn't obviously corrupt.
} catch (ex) {
if (ex instanceof MissingDataException) {
throw ex;
}
continue;
}
if (!isDict(rootDict) || !rootDict.has("Pages")) {
continue;
}
// taking the first one with 'ID'
if (dict.has("ID")) {
return dict;