From f0ded6bca881f26b4a12df551f7652ee175ad844 Mon Sep 17 00:00:00 2001
From: m-holger <m.holger@qpdf.org>
Date: Thu, 4 Jul 2024 20:40:47 +0100
Subject: [PATCH] Add test case for self-referential object streams

---
 ChangeLog                                      |  5 +++++
 libqpdf/QPDF.cc                                |  1 +
 qpdf/qpdf.testcov                              |  1 +
 qpdf/qtest/object-stream.test                  | 13 ++++++++++++-
 qpdf/qtest/qpdf/object-stream-self-ref.out     |  2 ++
 qpdf/qtest/qpdf/object-stream-self-ref.out.pdf | Bin 0 -> 1249 bytes
 qpdf/qtest/qpdf/object-stream-self-ref.pdf     | Bin 0 -> 792 bytes
 7 files changed, 21 insertions(+), 1 deletion(-)
 create mode 100644 qpdf/qtest/qpdf/object-stream-self-ref.out
 create mode 100644 qpdf/qtest/qpdf/object-stream-self-ref.out.pdf
 create mode 100644 qpdf/qtest/qpdf/object-stream-self-ref.pdf

diff --git a/ChangeLog b/ChangeLog
index 2b31f8c..8171ae9 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -17,6 +17,11 @@
 	* Add static option to Pl_DCT to control whether decompression of
 	corrupt JPEG data is attempted.
 
+2024-07-01  M Holger  <m.holger@qpdf.org>
+
+	* Bug fix: certain invalid object streams caused the insertion of
+	invalid entries into in the xref table.
+
 2024-06-29  M Holger  <m.holger@qpdf.org>
 
 	* Bug fix: in QPDFOutlineObjectHelper detect loops in the list of 
diff --git a/libqpdf/QPDF.cc b/libqpdf/QPDF.cc
index af2811f..451cdf7 100644
--- a/libqpdf/QPDF.cc
+++ b/libqpdf/QPDF.cc
@@ -1938,6 +1938,7 @@ QPDF::resolveObjectsInStream(int obj_stream_number)
             continue;
         }
         if (num == obj_stream_number) {
+            QTC::TC("qpdf", "QPDF ignore self-referential object stream");
             warn(damagedPDF(
                 input,
                 m->last_object_description,
diff --git a/qpdf/qpdf.testcov b/qpdf/qpdf.testcov
index 3b82a8d..984b9ff 100644
--- a/qpdf/qpdf.testcov
+++ b/qpdf/qpdf.testcov
@@ -4,6 +4,7 @@ QPDF err wrong objid/generation 0
 QPDF check objid 1
 QPDF check generation 1
 QPDF check obj 1
+QPDF ignore self-referential object stream 0
 QPDF hint table length indirect 0
 QPDF hint table length direct 0
 QPDF P absent in lindict 0
diff --git a/qpdf/qtest/object-stream.test b/qpdf/qtest/object-stream.test
index 28479ee..bed3fef 100644
--- a/qpdf/qtest/object-stream.test
+++ b/qpdf/qtest/object-stream.test
@@ -16,7 +16,7 @@ cleanup();
 
 my $td = new TestDriver('object-stream');
 
-my $n_tests = 7 + (36 * 4) + (12 * 2);
+my $n_tests = 9 + (36 * 4) + (12 * 2);
 my $n_compare_pdfs = 36;
 
 for (my $n = 16; $n <= 19; ++$n)
@@ -107,5 +107,16 @@ $td->runtest("check file",
              {$td->FILE => "a.pdf"},
              {$td->FILE => "recover-xref-stream-recovered.pdf"});
 
+# Self-referential object stream
+$td->runtest("self-referential object stream",
+             {$td->COMMAND => "qpdf --static-id --qdf" .
+                  " object-stream-self-ref.pdf a.pdf"},
+             {$td->FILE => "object-stream-self-ref.out", $td->EXIT_STATUS => 3},
+             $td->NORMALIZE_NEWLINES);
+$td->runtest("check file",
+             {$td->FILE => "a.pdf"},
+             {$td->FILE => "object-stream-self-ref.out.pdf"});
+
+
 cleanup();
 $td->report(calc_ntests($n_tests, $n_compare_pdfs));
diff --git a/qpdf/qtest/qpdf/object-stream-self-ref.out b/qpdf/qtest/qpdf/object-stream-self-ref.out
new file mode 100644
index 0000000..84a2d3e
--- /dev/null
+++ b/qpdf/qtest/qpdf/object-stream-self-ref.out
@@ -0,0 +1,2 @@
+WARNING: object-stream-self-ref.pdf object stream 1 (object 1 0, offset 2): object stream claims to contain itself
+qpdf: operation succeeded with warnings; resulting file may have some problems
diff --git a/qpdf/qtest/qpdf/object-stream-self-ref.out.pdf b/qpdf/qtest/qpdf/object-stream-self-ref.out.pdf
new file mode 100644
index 0000000..d6b78a0
Binary files /dev/null and b/qpdf/qtest/qpdf/object-stream-self-ref.out.pdf differ
diff --git a/qpdf/qtest/qpdf/object-stream-self-ref.pdf b/qpdf/qtest/qpdf/object-stream-self-ref.pdf
new file mode 100644
index 0000000..40ea11a
Binary files /dev/null and b/qpdf/qtest/qpdf/object-stream-self-ref.pdf differ
--
libgit2 0.21.4