Refine xref table reconstruction

During xref table reconstruction ignore uncompressed object entries found in xref streams. The xref table gets populated with entries for the objects actually found in the file. The entries for uncompressed object in xref streams are redundant and potentially incorrect.

Refine xref table reconstruction
During xref table reconstruction ignore uncompressed object entries found in xref streams. The xref table gets populated with entries for the objects actually found in the file. The entries for uncompressed object in xref streams are redundant and potentially incorrect.
m-holger
1 parent ad3bac2c
Showing 2 changed files with 17 additions and 10 deletions
include/qpdf/QPDF.hh
libqpdf/QPDF_objects.cc
@@ -765,15 +765,15 @@ class QPDF
     void parse(char const* password);
     void inParse(bool);
     void setTrailer(QPDFObjectHandle obj);
-    void read_xref(qpdf_offset_t offset);
+    void read_xref(qpdf_offset_t offset, bool in_stream_recovery = false);
     bool resolveXRefTable();
     void reconstruct_xref(QPDFExc& e, bool found_startxref = true);
     bool parse_xrefFirst(std::string const& line, int& obj, int& num, int& bytes);
     bool read_xrefEntry(qpdf_offset_t& f1, int& f2, char& type);
     bool read_bad_xrefEntry(qpdf_offset_t& f1, int& f2, char& type);
     qpdf_offset_t read_xrefTable(qpdf_offset_t offset);
-    qpdf_offset_t read_xrefStream(qpdf_offset_t offset);
-    qpdf_offset_t processXRefStream(qpdf_offset_t offset, QPDFObjectHandle& xref_stream);
+    qpdf_offset_t read_xrefStream(qpdf_offset_t offset, bool in_stream_recovery=false);
+    qpdf_offset_t processXRefStream(qpdf_offset_t offset, QPDFObjectHandle& xref_stream, bool in_stream_recovery=false);
     std::pair<int, std::array<int, 3>>
     processXRefW(QPDFObjectHandle& dict, std::function<QPDFExc(std::string_view)> damaged);
     int processXRefSize(
@@ -325,7 +325,7 @@ QPDF::reconstruct_xref(QPDFExc&amp; e, bool found_startxref)
         }
         if (max_offset > 0) {
             try {
-                read_xref(max_offset);
+                read_xref(max_offset, true);
             } catch (std::exception&) {
                 warn(damagedPDF(
                     "", -1, "error decoding candidate xref stream while recovering damaged file"));
@@ -388,7 +388,7 @@ QPDF::reconstruct_xref(QPDFExc&amp; e, bool found_startxref)
 }
 void
-QPDF::read_xref(qpdf_offset_t xref_offset)
+QPDF::read_xref(qpdf_offset_t xref_offset, bool in_stream_recovery)
 {
     std::map<int, int> free_table;
     std::set<qpdf_offset_t> visited;
@@ -440,7 +440,7 @@ QPDF::read_xref(qpdf_offset_t xref_offset)
             }
             xref_offset = read_xrefTable(xref_offset + skip);
         } else {
-            xref_offset = read_xrefStream(xref_offset);
+            xref_offset = read_xrefStream(xref_offset, in_stream_recovery);
         }
         if (visited.count(xref_offset) != 0) {
             QTC::TC("qpdf", "QPDF xref loop");
@@ -759,7 +759,7 @@ QPDF::read_xrefTable(qpdf_offset_t xref_offset)
 // Read a single cross-reference stream.
 qpdf_offset_t
-QPDF::read_xrefStream(qpdf_offset_t xref_offset)
+QPDF::read_xrefStream(qpdf_offset_t xref_offset, bool in_stream_recovery)
 {
     if (!m->ignore_xref_streams) {
         QPDFObjGen x_og;
@@ -772,7 +772,7 @@ QPDF::read_xrefStream(qpdf_offset_t xref_offset)
         }
         if (xref_obj.isStreamOfType("/XRef")) {
             QTC::TC("qpdf", "QPDF found xref stream");
-            return processXRefStream(xref_offset, xref_obj);
+            return processXRefStream(xref_offset, xref_obj, in_stream_recovery);
         }
     }
@@ -905,7 +905,8 @@ QPDF::processXRefIndex(
 }
 qpdf_offset_t
-QPDF::processXRefStream(qpdf_offset_t xref_offset, QPDFObjectHandle& xref_obj)
+QPDF::processXRefStream(
+    qpdf_offset_t xref_offset, QPDFObjectHandle& xref_obj, bool in_stream_recovery)
 {
     auto damaged = [this, xref_offset](std::string_view msg) -> QPDFExc {
         return damagedPDF("xref stream", xref_offset, msg.data());
@@ -971,7 +972,13 @@ QPDF::processXRefStream(qpdf_offset_t xref_offset, QPDFObjectHandle&amp; xref_obj)
                 // objects.
                 insertFreeXrefEntry(QPDFObjGen(obj, 0));
             } else {
-                insertXrefEntry(obj, toI(fields[0]), fields[1], toI(fields[2]));
+                auto typ = toI(fields[0]);
+                if (!in_stream_recovery || typ == 2) {
+                    // If we are in xref stream recovery all actual uncompressed objects have
+                    // already been inserted into the xref table. Avoid adding junk data into the
+                    // xref table.
+                    insertXrefEntry(obj, toI(fields[0]), fields[1], toI(fields[2]));
+                }
             }
             ++obj;
         }