/* Copyright (C) 2020-2025 Artifex Software, Inc.

   All Rights Reserved.

   This software is provided AS-IS with no warranty, either express or

   implied.

   This software is distributed under license and may not be copied,

   modified or distributed except as expressly authorized under the terms

   of the license contained in the file LICENSE in this distribution.

   Refer to licensing information at http://www.artifex.com or contact

   Artifex Software, Inc.,  39 Mesa Street, Suite 108A, San Francisco,

   CA 94129, USA, for further information.

*/

/* Functions to deal with PDF structure, such as retrieving

 * the Info, Catalog, Root dictionaries, and finding resources

 * and page dictionaries.

 */

#include "ghostpdf.h"

#include "pdf_stack.h"

#include "pdf_deref.h"

#include "pdf_array.h"

#include "pdf_dict.h"

#include "pdf_loop_detect.h"

#include "pdf_misc.h"

#include "pdf_repair.h"

#include "pdf_doc.h"

#include "pdf_mark.h"

#include "pdf_colour.h"

#include "pdf_device.h"

int pdfi_read_Root(pdf_context *ctx)

{

    pdf_obj *o, *o1;

    pdf_dict *d;

    int code;

    if (ctx->args.pdfdebug)

        outprintf(ctx->memory, "%% Reading Root dictionary\n");

    /* Unusual code. This is because if the entry in the trailer dictionary causes

     * us to repair the file, the Trailer dictionary in the context can be replaced.

     * This counts it down and frees it, potentially while pdfi_dict_get is still

     * using it! Rather than countup and down in the dict_get routine, which is

     * normally unnecessary, count it up and down round the access here.

     */

    d = ctx->Trailer;

    pdfi_countup(d);

    code = pdfi_dict_get(ctx, d, "Root", &o1);

    if (code < 0) {

        pdfi_countdown(d);

        return code;

    }

    pdfi_countdown(d);

    if (pdfi_type_of(o1) == PDF_INDIRECT) {

        code = pdfi_dereference(ctx, ((pdf_indirect_ref *)o1)->ref_object_num,  ((pdf_indirect_ref *)o1)->ref_generation_num, &o);

        pdfi_countdown(o1);

        if (code < 0)

            return code;

        if (pdfi_type_of(o) != PDF_DICT) {

            pdfi_countdown(o);

            return_error(gs_error_typecheck);

        }

        code = pdfi_dict_put(ctx, ctx->Trailer, "Root", o);

        if (code < 0) {

            pdfi_countdown(o);

            return code;

        }

        o1 = o;

    } else {

        if (pdfi_type_of(o1) != PDF_DICT) {

            pdfi_countdown(o1);

            if (ctx->Root == NULL)

                return_error(gs_error_typecheck);

            return 0;

        }

    }

    code = pdfi_dict_get_type(ctx, (pdf_dict *)o1, "Type", PDF_NAME, &o);

    if (code < 0) {

        bool known = false;

        if ((code = pdfi_set_error_stop(ctx, gs_note_error(gs_error_syntaxerror), NULL, E_PDF_MISSINGTYPE, "pdfi_read_Root", NULL)) < 0) {

            pdfi_countdown(o1);

            return code;

        }

        /* Missing the *required* /Type key! See if it has /Pages at least, if it does carry on */

        code = pdfi_dict_known(ctx, (pdf_dict *)o1, "Pages", &known);

        if (code < 0 || known == false) {

            pdfi_countdown(o1);

            return code;

        }

    }

    else {

        if (pdfi_name_strcmp((pdf_name *)o, "Catalog") != 0){

            pdf_obj *pages = NULL;

            /* Bug #706038 has a Root dictionary with /Type /Calalog which (of course) Acrobat

             * happily opens :-( So if we find a /Type and it's not /Catalog, try and see if

             * we have a /Pages key (the only other required entry). If we do assume that the

             * Type is wrong and use this dictionary, otherwise fall back to seeing if we

             * have a repaired Root. See above for handling a missing /Type.....

             */

            code = pdfi_dict_get_type(ctx, (pdf_dict *)o1, "Pages", PDF_DICT, &pages);

            if (code < 0) {

                pdfi_countdown(o);

                pdfi_countdown(o1);

                /* If we repaired the file, we may already have spotted a potential Root dictionary

                 * so if the one we found here isn't valid, try the one we found when scanning

                 */

                if (ctx->Root == NULL) {

                    pdfi_set_error(ctx, 0, NULL, E_PDF_NO_ROOT, "pdfi_read_Root", NULL);

                    return_error(gs_error_syntaxerror);

                }

                return 0;

            }

            pdfi_countdown(pages);

            if ((code = pdfi_set_error_stop(ctx, gs_note_error(gs_error_typecheck), NULL, E_PDF_BAD_ROOT_TYPE, "pdfi_read_Root", NULL)) < 0) {

                pdfi_countdown(o);

                pdfi_countdown(o1);

                return code;

            }

        }

        pdfi_countdown(o);

    }

    if (ctx->args.pdfdebug)

        outprintf(ctx->memory, "\n");

    /* We don't pdfi_countdown(o1) now, because we've transferred our

     * reference to the pointer in the pdf_context structure.

     */

    pdfi_countdown(ctx->Root); /* If file was repaired it might be set already */

    ctx->Root = (pdf_dict *)o1;

    return 0;

}

static int Info_check_dict(pdf_context *ctx, pdf_dict *d);

static int Info_check_array(pdf_context *ctx, pdf_array *a)

{

    int code = 0, i = 0;

    pdf_obj *array_obj = NULL;

    code = pdfi_loop_detector_mark(ctx);

    if (code < 0)

        return code;

    for (i = 0;i < pdfi_array_size(a); i++) {

        code = pdfi_array_fetch_recursing(ctx, a, i, &array_obj, true, true);

        if (code < 0)

            goto error;

        switch(pdfi_type_of(array_obj)) {

            case PDF_DICT:

                if (array_obj->object_num != 0) {

                    code = pdfi_loop_detector_add_object(ctx, array_obj->object_num);

                    if (code < 0)

                        goto error;

                }

                code = Info_check_dict(ctx, (pdf_dict *)array_obj);

                if (code < 0) {

                    if (array_obj->object_num != 0) {

                        pdf_indirect_ref *i_o;

                        code = pdfi_object_alloc(ctx, PDF_INDIRECT, 0, (pdf_obj **)&i_o);

                        if (code < 0)

                            goto error;

                        i_o->ref_generation_num = array_obj->generation_num;

                        i_o->ref_object_num = array_obj->object_num;

                        i_o->indirect_num = array_obj->object_num;

                        i_o->indirect_gen = array_obj->generation_num;

                        code = pdfi_array_put(ctx, a, i, (pdf_obj *)i_o);

                        if (code < 0)

                            return code;

                    }

                    goto error;

                }

                break;

            case PDF_ARRAY:

                if (array_obj->object_num != 0) {

                    code = pdfi_loop_detector_add_object(ctx, array_obj->object_num);

                    if (code < 0)

                        goto error;

                }

                code = Info_check_array(ctx, (pdf_array *)array_obj);

                if (code < 0) {

                    if (array_obj->object_num != 0) {

                        pdf_indirect_ref *i_o;

                        code = pdfi_object_alloc(ctx, PDF_INDIRECT, 0, (pdf_obj **)&i_o);

                        if (code < 0)

                            goto error;

                        i_o->ref_generation_num = array_obj->generation_num;

                        i_o->ref_object_num = array_obj->object_num;

                        i_o->indirect_num = array_obj->object_num;

                        i_o->indirect_gen = array_obj->generation_num;

                        code = pdfi_array_put(ctx, a, i, (pdf_obj *)i_o);

                        if (code < 0)

                            return code;

                    }

                    goto error;

                }

                break;

            default:

                break;

        }

        pdfi_countdown(array_obj);

        array_obj = NULL;

    }

error:

    pdfi_countdown(array_obj);

    pdfi_loop_detector_cleartomark(ctx);

    return code;

}

static int Info_check_dict(pdf_context *ctx, pdf_dict *d)

{

    int code = 0;

    uint64_t index = 0;

    pdf_name *Key = NULL;

    pdf_obj *Value = NULL;

    code = pdfi_loop_detector_mark(ctx);

    if (code < 0)

        return code;

    code = pdfi_dict_first(ctx, d, (pdf_obj **)&Key, &Value, &index);

    if (code < 0) {

        if (code == gs_error_undefined)

            code = 0;

        goto error;

    }

    while (code >= 0) {

        switch(pdfi_type_of(Value)) {

            case PDF_DICT:

                if (Value->object_num != 0) {

                    code = pdfi_loop_detector_add_object(ctx, Value->object_num);

                    if (code < 0)

                        goto error;

                }

                code = Info_check_dict(ctx, (pdf_dict *)Value);

                if (code < 0)

                    goto error;

                break;

            case PDF_ARRAY:

                if (Value->object_num != 0) {

                    code = pdfi_loop_detector_add_object(ctx, Value->object_num);

                    if (code < 0)

                        goto error;

                }

                code = Info_check_array(ctx, (pdf_array *)Value);

                if (code < 0)

                    goto error;

                break;

            default:

                break;

        }

        pdfi_countdown(Key);

        Key = NULL;

        pdfi_countdown(Value);

        Value = NULL;

        code = pdfi_dict_next(ctx, d, (pdf_obj **)&Key, &Value, &index);

        if (code == gs_error_undefined) {

            code = 0;

            break;

        }

    }

error:

    pdfi_countdown(Key);

    pdfi_countdown(Value);

    pdfi_loop_detector_cleartomark(ctx);

    return code;

}

static int pdfi_sanitize_Info_references(pdf_context *ctx, pdf_dict *Info)

{

    int code = 0;

    uint64_t index = 0;

    pdf_name *Key = NULL;

    pdf_obj *Value = NULL;

restart_scan:

    code = pdfi_loop_detector_mark(ctx);

    if (code < 0)

        return code;

    code = pdfi_dict_first(ctx, Info, (pdf_obj **)&Key, &Value, &index);

    if (code == gs_error_undefined) {

        code = 0;

        goto error;

    }

    while (code >= 0) {

        switch(pdfi_type_of(Value)) {

            case PDF_DICT:

                code = Info_check_dict(ctx, (pdf_dict *)Value);

                break;

            case PDF_ARRAY:

                code = Info_check_array(ctx, (pdf_array *)Value);

                break;

            default:

                code = 0;

                break;

        }

        pdfi_countdown(Value);

        Value = NULL;

        if (code < 0) {

            code = pdfi_dict_delete_pair(ctx, Info, Key);

            if (code < 0)

                goto error;

            pdfi_countdown(Key);

            Key = NULL;

            pdfi_loop_detector_cleartomark(ctx);

            goto restart_scan;

        }

        pdfi_countdown(Key);

        Key = NULL;

        pdfi_loop_detector_cleartomark(ctx);

        code = pdfi_loop_detector_mark(ctx);

        if (code < 0) {

            pdfi_countdown(Key);

            pdfi_countdown(Value);

            return code;

        }

        code = pdfi_dict_next(ctx, Info, (pdf_obj **)&Key, &Value, &index);

        if (code == gs_error_undefined) {

            code = 0;

            break;

        }

    }

error:

    pdfi_countdown(Key);

    pdfi_countdown(Value);

    pdfi_loop_detector_cleartomark(ctx);

    return code;

}

int pdfi_read_Info(pdf_context *ctx)

{

    pdf_dict *Info;

    int code;

    pdf_dict *d;

    if (ctx->args.pdfdebug)

        outprintf(ctx->memory, "%% Reading Info dictionary\n");

    /* See comment in pdfi_read_Root() for details */

    d = ctx->Trailer;

    pdfi_countup(d);

    code = pdfi_dict_get_type(ctx, ctx->Trailer, "Info", PDF_DICT, (pdf_obj **)&Info);

    pdfi_countdown(d);

    if (code < 0)

        return code;

    if (ctx->args.pdfdebug)

        outprintf(ctx->memory, "\n");

    code = pdfi_loop_detector_mark(ctx);

    if (code < 0)

        goto error;

    if (Info->object_num != 0) {

        code = pdfi_loop_detector_add_object(ctx, Info->object_num);

        if (code < 0)

            goto error1;

    } else {

        if ((code = pdfi_set_warning_stop(ctx, 0, NULL, W_PDF_INFO_NOT_INDIRECT, "pdfi_read_Info", "")) < 0)

            goto error1;

    }

    /* sanitize Info for circular references */

    code = pdfi_sanitize_Info_references(ctx, Info);

    if (code < 0)

        goto error1;

    (void)pdfi_loop_detector_cleartomark(ctx);

    pdfi_pdfmark_write_docinfo(ctx, Info);

    /* We don't pdfi_countdown(Info) now, because we've transferred our

     * reference to the pointer in the pdf_context structure.

     */

    ctx->Info = Info;

    return 0;

error1:

    pdfi_loop_detector_cleartomark(ctx);

error:

    pdfi_countdown(Info);

    return code;

}

int pdfi_read_Pages(pdf_context *ctx)

{

    pdf_obj *o, *o1;

    pdf_array *a = NULL;

    int code, pagecount = 0;

    double d;

    if (ctx->args.pdfdebug)

        outprintf(ctx->memory, "%% Reading Pages dictionary\n");

    code = pdfi_dict_get(ctx, ctx->Root, "Pages", &o1);

    if (code < 0)

        return code;

    if (pdfi_type_of(o1) == PDF_INDIRECT) {

        code = pdfi_dereference(ctx, ((pdf_indirect_ref *)o1)->ref_object_num,  ((pdf_indirect_ref *)o1)->ref_generation_num, &o);

        pdfi_countdown(o1);

        if (code < 0)

            return code;

        if (pdfi_type_of(o) != PDF_DICT) {

            pdfi_countdown(o);

            if (pdfi_type_of(o) == PDF_INDIRECT)

                pdfi_set_error(ctx, 0, NULL, E_PDF_BADPAGEDICT, "pdfi_read_Pages", (char *)"*** Error: Something is wrong with the Pages dictionary.  Giving up.");

            else

                pdfi_set_error(ctx, 0, NULL, E_PDF_BADPAGEDICT, "pdfi_read_Pages", (char *)"*** Error: Something is wrong with the Pages dictionary.  Giving up.\n           Double indirect reference.  Loop in Pages tree?");

            return_error(gs_error_typecheck);

        }

        code = pdfi_dict_put(ctx, ctx->Root, "Pages", o);

        if (code < 0) {

            pdfi_countdown(o);

            return code;

        }

        o1 = o;

    } else {

        if (pdfi_type_of(o1) != PDF_DICT) {

            pdfi_countdown(o1);

            return_error(gs_error_typecheck);

        }

    }

    if (ctx->args.pdfdebug)

        outprintf(ctx->memory, "\n");

    /* Acrobat allows the Pages Count to be a floating point number (!) */

    /* sample w_a.PDF from Bug688419 (not on the cluster, maybe it should be?) has no /Count entry because

     * The Root dictionary Pages key points directly to a single dictionary of type /Page. This is plainly

     * illegal but Acrobat can deal with it. We do so by ignoring the error her, and adding logic in

     * pdfi_get_page_dict() which notes that ctx->PagesTree is NULL and tries to get the single Page

     * dictionary from the Root instead of using the PagesTree.

     */

    code = pdfi_dict_get_number(ctx, (pdf_dict *)o1, "Count", &d);

    if (code < 0) {

        if (code == gs_error_undefined) {

            pdf_name *n = NULL;

            /* It may be that the Root dictionary Pages entry points directly to a sinlge Page dictionary

             * See if the dictionary has a Type of /Page, if so don't throw an error and the pdf_page.c

             * logic in pdfi_get_page_dict() logic will take care of it.

             */

            code = pdfi_dict_get_type(ctx, (pdf_dict *)o1, "Type", PDF_NAME, (pdf_obj **)&n);

            if (code == 0) {

                if(pdfi_name_is(n, "Page")) {

                    ctx->num_pages = 1;

                    code = 0;

                }

                else

                    code = gs_error_undefined;

                pdfi_countdown(n);

            }

        }

        pdfi_countdown(o1);

        return code;

    }

    if (floor(d) != d) {

        pdfi_countdown(o1);

        return_error(gs_error_rangecheck);

    } else {

        ctx->num_pages = (int)floor(d);

    }

    /* A simple confidence check in the value of Count. We only do this because

     * the OSS-fuzz tool keeps on coming up with files that time out because the

     * initial Count is insanely huge, and we spend much time trying to find

     * millions of pages which don't exist.

     */

    code = pdfi_dict_knownget_type(ctx, (pdf_dict *)o1, "Kids", PDF_ARRAY, (pdf_obj **)&a);

    if (code == 0)

        code = gs_note_error(gs_error_undefined);

    if (code < 0) {

        pdfi_countdown(o1);

        return code;

    }

    /* Firstly check if the Kids array has enough nodes, in which case it's

     * probably flat (the common case)

     */

    if (a->size != ctx->num_pages) {

        int i = 0;

        pdf_obj *p = NULL, *p1 = NULL;

        pdf_num *c = NULL;

        /* Either its not a flat tree, or the top node /Count is incorrect.

         * Get each entry in the Kids array in turn and total the /Count of

         * each node and add any leaf nodes.

         */

        for (i=0;i < a->size; i++) {

            /* We must not allow the entry in the array to be replaced, in case it's a circular reference */

            code = pdfi_array_get_no_store_R(ctx, a, i, &p);

            if (code < 0)

                continue;

            if (pdfi_type_of(p) != PDF_DICT) {

                pdfi_countdown(p);

                p = NULL;

                continue;

            }

            /* Explicit check that the root node Kids array entry is not a self-reference

             * back to the root node. We only check one level of the Kids array. so we don't

             * need a full loop detection setup here.

             */

            if (p->object_num != 0 && p->object_num == o1->object_num) {

                pdfi_countdown(p);

                p = NULL;

                pdfi_countdown(a);

                pdfi_countdown(o1);

                ctx->num_pages = 0;

                return_error(gs_error_circular_reference);

            }

            /* Now we've checked for circular reference we can replace the entry in the

             * array, and add the object to the cache.

             * These are optimisations, so we don't especially care whether they succeed

             */

            (void)pdfi_array_put(ctx, a, i, p);

            (void)replace_cache_entry(ctx, p);

            code = pdfi_dict_knownget_type(ctx, (pdf_dict *)p, "Type", PDF_NAME, (pdf_obj **)&p1);

            if (code <= 0) {

                pdfi_countdown(p);

                p = NULL;

                continue;

            }

            if (pdfi_name_is((pdf_name *)p1, "Page")) {

                pagecount++;

            } else {

                if (pdfi_name_is((pdf_name *)p1, "Pages")) {

                    code = pdfi_dict_knownget(ctx, (pdf_dict *)p, "Count", (pdf_obj **)&c);

                    if (code >= 0) {

                        if (pdfi_type_of(c) == PDF_INT)

                            pagecount += c->value.i;

                        if (pdfi_type_of(c) == PDF_REAL)

                            pagecount += (int)c->value.d;

                        pdfi_countdown(c);

                        c = NULL;

                    }

                }

            }

            pdfi_countdown(p1);

            p1 = NULL;

            pdfi_countdown(p);

            p = NULL;

        }

    } else

        pagecount = a->size;

    pdfi_countdown(a);

    /* If the count of the top level of the tree doesn't match the /Count

     * of the root node then something is wrong. We could abort right now

     * and will if this continues to be a problem, but initially let's assume

     * the count of the top level is correct and the root node /Count is wrong.

     * This will allow us to recover if only the root /Count gets corrupted.

     * In future we could also try validating the entire tree at this point,

     * though I suspect that's pointless; if the tree is corrupted we aren't

     * likely to get much that's usable from it.

     */

    if (pagecount != ctx->num_pages) {

        ctx->num_pages = pagecount;

        if ((code = pdfi_set_error_stop(ctx, gs_note_error(gs_error_syntaxerror), NULL, E_PDF_BADPAGECOUNT, "pdfi_read_Pages", NULL)) < 0)

            return code;

        code = pdfi_dict_put_int(ctx, (pdf_dict *)o1, "Count", ctx->num_pages);

        if (code < 0) {

            pdfi_countdown(o1);

            return code;

        }

    }

    /* We don't pdfi_countdown(o1) now, because we've transferred our

     * reference to the pointer in the pdf_context structure.

     */

    ctx->PagesTree = (pdf_dict *)o1;

    return 0;

}

/* Read optional things in from Root */

void pdfi_read_OptionalRoot(pdf_context *ctx)

{

    pdf_obj *obj = NULL;

    int code;

    bool known;

    if (ctx->args.pdfdebug)

        outprintf(ctx->memory, "%% Reading other Root contents\n");

    if (ctx->args.pdfdebug)

        outprintf(ctx->memory, "%% OCProperties\n");

    code = pdfi_dict_get_type(ctx, ctx->Root, "OCProperties", PDF_DICT, &obj);

    if (code == 0) {

        ctx->OCProperties = (pdf_dict *)obj;

    } else {

        ctx->OCProperties = NULL;

        if (ctx->args.pdfdebug)

            outprintf(ctx->memory, "%% (None)\n");

    }

    (void)pdfi_dict_known(ctx, ctx->Root, "Collection", &known);

    if (known) {

        if (ctx->args.pdfdebug)

            outprintf(ctx->memory, "%% Collection\n");

        code = pdfi_dict_get(ctx, ctx->Root, "Collection", (pdf_obj **)&ctx->Collection);

        if (code < 0) {

            (void)pdfi_set_warning_stop(ctx, 0, NULL, W_PDF_BAD_COLLECTION, "pdfi_read_OptionalRoot", "");

        }

    }

}

void pdfi_free_OptionalRoot(pdf_context *ctx)

{

    if (ctx->OCProperties) {

        pdfi_countdown(ctx->OCProperties);

        ctx->OCProperties = NULL;

    }

    if (ctx->Collection) {

        pdfi_countdown(ctx->Collection);

        ctx->Collection = NULL;

    }

}

/* Handle child node processing for page_dict */

static int pdfi_get_child(pdf_context *ctx, pdf_array *Kids, int i, pdf_dict **pchild)

{

    pdf_indirect_ref *node = NULL;

    pdf_dict *child = NULL;

    pdf_name *Type = NULL;

    pdf_dict *leaf_dict = NULL;

    pdf_name *Key = NULL;

    int code = 0;

    code = pdfi_array_get_no_deref(ctx, Kids, i, (pdf_obj **)&node);

    if (code < 0)

        goto errorExit;

    if (pdfi_type_of(node) != PDF_INDIRECT && pdfi_type_of(node) != PDF_DICT) {

        code = gs_note_error(gs_error_typecheck);

        goto errorExit;

    }

    if (pdfi_type_of(node) == PDF_INDIRECT) {

        code = pdfi_dereference(ctx, node->ref_object_num, node->ref_generation_num,

                                (pdf_obj **)&child);

        if (code < 0) {

            int code1 = pdfi_repair_file(ctx);

            if (code1 < 0)

                goto errorExit;

            code = pdfi_dereference(ctx, node->ref_object_num,

                                    node->ref_generation_num, (pdf_obj **)&child);

            if (code < 0)

                goto errorExit;

        }

        /* It makes no sense for the Page dictionary to be a stream, but safedocs/DialectDictIsStream.pdf

         * has this (stream length is 0, not that it matters) and Acrobat happily opens it....

         */

        if (pdfi_type_of(child) != PDF_DICT) {

            pdf_dict *d1 = NULL;

            if (pdfi_type_of(child) != PDF_STREAM) {

                code = gs_note_error(gs_error_typecheck);

                goto errorExit;

            }

            if ((code = pdfi_set_error_stop(ctx, gs_note_error(gs_error_typecheck), NULL, E_PDF_DICT_IS_STREAM, "pdfi_get_child", NULL)) < 0)

                goto errorExit;

            code = pdfi_get_stream_dict(ctx, (pdf_stream *)child, &d1);

            if (code < 0)

                goto errorExit;

            pdfi_countdown(child);

            child = d1;

            code = replace_cache_entry(ctx, (pdf_obj *)d1);

            if (code < 0)

                goto errorExit;

        }

        /* If its an intermediate node, store it in the page_table, if its a leaf node

         * then don't store it. Instead we create a special dictionary of our own which

         * has a /Type of /PageRef and a /PageRef key which is the indirect reference

         * to the page. However in this case we pass on the actual page dictionary to

         * the Kids processing below. If we didn't then we'd fall foul of the loop

         * detection by dereferencing the same object twice.

         * This is tedious, but it means we don't store all the page dictionaries in

         * the Pages tree, because page dictionaries can be large and we generally

         * only use them once. If processed in order we only dereference each page

         * dictionary once, any other order will dereference each page twice. (or more

         * if we render the same page multiple times).

         */

        code = pdfi_dict_get_type(ctx, child, "Type", PDF_NAME, (pdf_obj **)&Type);

        if (code < 0)

            goto errorExit;

        if (pdfi_name_is(Type, "Pages")) {

            code = pdfi_array_put(ctx, Kids, i, (pdf_obj *)child);

            if (code < 0)

                goto errorExit;

        } else {

            /* Bizarrely, one of the QL FTS files (FTS_07_0704.pdf) has a page diciotnary with a /Type of /Template */

            if (!pdfi_name_is(Type, "Page"))

                if ((code = pdfi_set_error_stop(ctx, gs_note_error(gs_error_typecheck), NULL, E_PDF_BADPAGETYPE, "pdfi_get_child", NULL)) < 0)

                    goto errorExit;

            /* Make a 'PageRef' entry (just stores an indirect reference to the actual page)

             * and store that in the Kids array for future reference. But pass on the

             * dereferenced Page dictionary, in case this is the target page.

             */

            code = pdfi_dict_alloc(ctx, 0, &leaf_dict);

            if (code < 0)

                goto errorExit;

            code = pdfi_name_alloc(ctx, (byte *)"PageRef", 7, (pdf_obj **)&Key);

            if (code < 0)

                goto errorExit;

            pdfi_countup(Key);

            code = pdfi_dict_put_obj(ctx, leaf_dict, (pdf_obj *)Key, (pdf_obj *)node, true);

            if (code < 0)

                goto errorExit;

            code = pdfi_dict_put(ctx, leaf_dict, "Type", (pdf_obj *)Key);

            if (code < 0)

                goto errorExit;

            code = pdfi_array_put(ctx, Kids, i, (pdf_obj *)leaf_dict);

            if (code < 0)

                goto errorExit;

            leaf_dict = NULL;

        }

    } else {

        if (ctx->loop_detection != NULL) {

            if (node->object_num != 0 && pdfi_loop_detector_check_object(ctx, node->object_num)) {

                code = gs_note_error(gs_error_circular_reference);

                goto errorExit;

            }

            if (node->object_num > 0) {

                code = pdfi_loop_detector_add_object(ctx, node->object_num);

                if (code < 0)

                    goto errorExit;

            }

        }

        child = (pdf_dict *)node;

        pdfi_countup(child);

    }

    *pchild = child;

    child = NULL;

 errorExit:

    pdfi_free_object((pdf_obj *)leaf_dict);

    pdfi_countdown(child);

    pdfi_countdown(node);

    pdfi_countdown(Type);

    pdfi_countdown(Key);

    return code;

}

/* Check if key is in the dictionary, and if so, copy it into the inheritable dict.

 */

static int pdfi_check_inherited_key(pdf_context *ctx, pdf_dict *d, const char *keyname, pdf_dict *inheritable)

{

    int code = 0;

    pdf_obj *object = NULL;

    bool known;

    /* Check for inheritable keys, if we find any copy them to the 'inheritable' dictionary at this level */

    code = pdfi_dict_known(ctx, d, keyname, &known);

    if (code < 0)

        goto exit;

    if (known) {

        code = pdfi_loop_detector_mark(ctx);

        if (code < 0){

            goto exit;

        }

        code = pdfi_dict_get(ctx, d, keyname, &object);

        if (code < 0) {

            (void)pdfi_loop_detector_cleartomark(ctx);

            goto exit;

        }

        code = pdfi_loop_detector_cleartomark(ctx);

        if (code < 0) {

            goto exit;

        }

        code = pdfi_dict_put(ctx, inheritable, keyname, object);

    }

 exit:

    pdfi_countdown(object);

    return code;

}

int pdfi_get_page_dict(pdf_context *ctx, pdf_dict *d, uint64_t page_num, uint64_t *page_offset,

                   pdf_dict **target, pdf_dict *inherited)

{

    int i, code = 0;

    pdf_array *Kids = NULL;

    pdf_dict *child = NULL;

    pdf_name *Type = NULL;

    pdf_dict *inheritable = NULL;

    int64_t num;

    double dbl;

    if (ctx->args.pdfdebug)

        outprintf(ctx->memory, "%% Finding page dictionary for page %"PRIi64"\n", page_num + 1);

    /* Allocated inheritable dict (it might stay empty) */

    code = pdfi_dict_alloc(ctx, 0, &inheritable);

    if (code < 0)

        return code;

    pdfi_countup(inheritable);

    code = pdfi_loop_detector_mark(ctx);

    if (code < 0)

        return code;

    /* if we are being passed any inherited values from our parent, copy them now */

    if (inherited != NULL) {

        code = pdfi_dict_copy(ctx, inheritable, inherited);

        if (code < 0)

            goto exit;

    }

    code = pdfi_dict_get_number(ctx, d, "Count", &dbl);

    if (code < 0)

        goto exit;

    if (dbl != floor(dbl)) {

        code = gs_note_error(gs_error_rangecheck);

        goto exit;

    }

    num = (int)dbl;

    if (num < 0 || (num + *page_offset) > ctx->num_pages) {

        code = gs_note_error(gs_error_rangecheck);

        goto exit;

    }

    if (num + *page_offset < page_num) {

        *page_offset += num;

        code = 1;

        goto exit;

    }

    /* The requested page is a descendant of this node */

    /* Check for inheritable keys, if we find any copy them to the 'inheritable' dictionary at this level */

    code = pdfi_check_inherited_key(ctx, d, "Resources", inheritable);

    if (code < 0)

        goto exit;

    code = pdfi_check_inherited_key(ctx, d, "MediaBox", inheritable);

    if (code < 0)

        goto exit;

    code = pdfi_check_inherited_key(ctx, d, "CropBox", inheritable);

    if (code < 0)

        goto exit;

    code = pdfi_check_inherited_key(ctx, d, "Rotate", inheritable);

    if (code < 0) {

        goto exit;

    }

    /* Get the Kids array */

    code = pdfi_dict_get_type(ctx, d, "Kids", PDF_ARRAY, (pdf_obj **)&Kids);

    if (code < 0) {

        goto exit;

    }

    /* Check each entry in the Kids array */

    for (i = 0;i < pdfi_array_size(Kids);i++) {

        pdfi_countdown(child);

        child = NULL;

        pdfi_countdown(Type);

        Type = NULL;

        code = pdfi_get_child(ctx, Kids, i, &child);

        if (code < 0) {

            goto exit;

        }

        /* Check the type, if its a Pages entry, then recurse. If its a Page entry, is it the one we want */

        code = pdfi_dict_get_type(ctx, child, "Type", PDF_NAME, (pdf_obj **)&Type);

        if (code == 0) {

            if (pdfi_name_is(Type, "Pages")) {

                code = pdfi_dict_get_number(ctx, child, "Count", &dbl);

                if (code == 0) {

                    if (dbl != floor(dbl)) {

                        code = gs_note_error(gs_error_rangecheck);

                        goto exit;

                    }

                    num = (int)dbl;

                    if (num < 0 || (num + *page_offset) > ctx->num_pages) {

                        code = gs_note_error(gs_error_rangecheck);

                        goto exit;

                    } else {

                        if (num + *page_offset <= page_num) {

                            *page_offset += num;

                        } else {

                            code = pdfi_get_page_dict(ctx, child, page_num, page_offset, target, inheritable);

                            goto exit;

                        }

                    }

                }

            } else {

                if (pdfi_name_is(Type, "PageRef")) {

                    if ((*page_offset) == page_num) {

                        pdf_dict *page_dict = NULL;

                        code = pdfi_dict_get_no_store_R(ctx, child, "PageRef", (pdf_obj **)&page_dict);

                        if (code < 0)

                            goto exit;

                        code = pdfi_merge_dicts(ctx, page_dict, inheritable);

                        *target = page_dict;

                        pdfi_countup(*target);

                        pdfi_countdown(page_dict);

                        goto exit;

                    } else {

                        *page_offset += 1;

                    }

                } else {

                    if (!pdfi_name_is(Type, "Page")) {

                        if ((code = pdfi_set_error_stop(ctx, gs_note_error(gs_error_typecheck), NULL, E_PDF_BADPAGETYPE, "pdfi_get_page_dict", NULL)) < 0)

                            goto exit;

                    }

                    if ((*page_offset) == page_num) {

                        code = pdfi_merge_dicts(ctx, child, inheritable);

                        *target = child;

                        pdfi_countup(*target);

                        goto exit;

                    } else {

                        *page_offset += 1;

                    }

                }

            }

        }

        if (code < 0)

            goto exit;

    }

    /* Positive return value indicates we did not find the target below this node, try the next one */

    code = 1;

 exit:

    pdfi_loop_detector_cleartomark(ctx);

    pdfi_countdown(inheritable);

    pdfi_countdown(Kids);

    pdfi_countdown(child);

    pdfi_countdown(Type);

    return code;

}

int pdfi_doc_page_array_init(pdf_context *ctx)

{

    size_t size = ctx->num_pages*sizeof(uint32_t);

    ctx->page_array = (uint32_t *)gs_alloc_bytes(ctx->memory, size,

                                                 "pdfi_doc_page_array_init(page_array)");

    if (ctx->page_array == NULL)

        return_error(gs_error_VMerror);

    memset(ctx->page_array, 0, size);

    return 0;

}

void pdfi_doc_page_array_free(pdf_context *ctx)

{

    if (!ctx->page_array)

        return;

    gs_free_object(ctx->memory, ctx->page_array, "pdfi_doc_page_array_free(page_array)");

    ctx->page_array = NULL;

}

/*

 * Checks for both "Resource" and "RD" in the specified dict.

 * And then gets the typedict of Type (e.g. Font or XObject).

 * Returns 0 if undefined, >0 if found, <0 if error

 */

static int pdfi_resource_knownget_typedict(pdf_context *ctx, unsigned char *Type,

                                           pdf_dict *dict, pdf_dict **typedict)

{

    int code;

    pdf_dict *Resources = NULL;

    code = pdfi_dict_knownget_type(ctx, dict, "Resources", PDF_DICT, (pdf_obj **)&Resources);

    if (code == 0)

        code = pdfi_dict_knownget_type(ctx, dict, "DR", PDF_DICT, (pdf_obj **)&Resources);

    if (code < 0)

        goto exit;