/src/ghostpdl/pdf/pdf_repair.c

Source (jump to first uncovered line)
/* Copyright (C) 2020-2025 Artifex Software, Inc.
   All Rights Reserved.

   This software is provided AS-IS with no warranty, either express or
   implied.

   This software is distributed under license and may not be copied,
   modified or distributed except as expressly authorized under the terms
   of the license contained in the file LICENSE in this distribution.

   Refer to licensing information at http://www.artifex.com or contact
   Artifex Software, Inc.,  39 Mesa Street, Suite 108A, San Francisco,
   CA 94129, USA, for further information.
*/

/* Routines to attempt repair of PDF files in the event of an error */

#include "pdf_int.h"
#include "pdf_stack.h"
#include "strmio.h"
#include "stream.h"
#include "pdf_deref.h"
#include "pdf_dict.h"
#include "pdf_file.h"
#include "pdf_misc.h"
#include "pdf_repair.h"

static int pdfi_repair_add_object(pdf_context *ctx, int64_t obj, int64_t gen, gs_offset_t offset)
{
    /* Although we can handle object numbers larger than this, on some systems (32-bit Windows)
     * memset is limited to a (signed!) integer for the size of memory to clear. We could deal
     * with this by clearing the memory in blocks, but really, this is almost certainly a
     * corrupted file or something.
     */
    if (obj >= 0x7ffffff / sizeof(xref_entry) || obj < 1 || gen < 0 || offset < 0)
        return_error(gs_error_rangecheck);

    if (ctx->xref_table == NULL) {
        ctx->xref_table = (xref_table_t *)gs_alloc_bytes(ctx->memory, sizeof(xref_table_t), "repair xref table");
        if (ctx->xref_table == NULL) {
            return_error(gs_error_VMerror);
        }
        memset(ctx->xref_table, 0x00, sizeof(xref_table_t));
        ctx->xref_table->xref = (xref_entry *)gs_alloc_bytes(ctx->memory, (size_t)(obj + 1) * sizeof(xref_entry), "repair xref table");
        if (ctx->xref_table->xref == NULL){
            gs_free_object(ctx->memory, ctx->xref_table, "failed to allocate xref table entries for repair");
            ctx->xref_table = NULL;
            return_error(gs_error_VMerror);
        }
        memset(ctx->xref_table->xref, 0x00, (obj + 1) * sizeof(xref_entry));
        ctx->xref_table->ctx = ctx;
        ctx->xref_table->type = PDF_XREF_TABLE;
        ctx->xref_table->xref_size = obj + 1;
#if REFCNT_DEBUG
        ctx->xref_table->UID = ctx->ref_UID++;
        outprintf(ctx->memory, "Allocated xref table with UID %"PRIi64"\n", ctx->xref_table->UID);
#endif
        pdfi_countup(ctx->xref_table);
    } else {
        if (ctx->xref_table->xref_size < (obj + 1)) {
            xref_entry *new_xrefs;

            new_xrefs = (xref_entry *)gs_alloc_bytes(ctx->memory, (size_t)(obj + 1) * sizeof(xref_entry), "read_xref_stream allocate xref table entries");
            if (new_xrefs == NULL){
                pdfi_countdown(ctx->xref_table);
                ctx->xref_table = NULL;
                return_error(gs_error_VMerror);
            }
            memset(new_xrefs, 0x00, (obj + 1) * sizeof(xref_entry));
            memcpy(new_xrefs, ctx->xref_table->xref, ctx->xref_table->xref_size * sizeof(xref_entry));
            gs_free_object(ctx->memory, ctx->xref_table->xref, "reallocated xref entries");
            ctx->xref_table->xref = new_xrefs;
            ctx->xref_table->xref_size = obj + 1;
        }
    }
    ctx->xref_table->xref[obj].compressed = false;
    ctx->xref_table->xref[obj].free = false;
    ctx->xref_table->xref[obj].object_num = obj;
    ctx->xref_table->xref[obj].u.uncompressed.generation_num = gen;
    ctx->xref_table->xref[obj].u.uncompressed.offset = offset;
    return 0;
}

int pdfi_repair_file(pdf_context *ctx)
{
    int code = 0;
    gs_offset_t offset, saved_offset;
    int64_t object_num = 0, generation_num = 0;
    int i;
    gs_offset_t outer_saved_offset[3];

    if (ctx->repaired) {
        pdfi_set_error(ctx, 0, NULL, E_PDF_UNREPAIRABLE, "pdfi_repair_file", (char *)"%% Trying to repair file for second time -- unrepairable");
        return_error(gs_error_undefined);
    }

    saved_offset = pdfi_unread_tell(ctx);

    ctx->repaired = true;
    if ((code = pdfi_set_error_stop(ctx, gs_note_error(gs_error_ioerror), NULL, E_PDF_REPAIRED, "pdfi_repair_file", NULL)) < 0)
        return code;

    ctx->repairing = true;

    pdfi_clearstack(ctx);

    if(ctx->args.pdfdebug)
        outprintf(ctx->memory, "%% Error encountered in opening PDF file, attempting repair\n");

    /* First try to locate a %PDF header. If we can't find one, abort this, the file is too broken
     * and may not even be a PDF file.
     */
    pdfi_seek(ctx, ctx->main_stream, 0, SEEK_SET);
    {
        static const char test[] = "%PDF";
        int index = 0;

        do {
            int c = pdfi_read_byte(ctx, ctx->main_stream);
            if (c < 0)
                goto exit;

            if (c == test[index])
                index++;
            else
                index = 0;
        } while (index < 4);
        if (index != 4) {
            code = gs_note_error(gs_error_undefined);
            goto exit;
        }
        pdfi_unread(ctx, ctx->main_stream, (byte *)test, 4);
        pdfi_skip_comment(ctx, ctx->main_stream);
    }
    if (ctx->main_stream->eof == true) {
        code = gs_note_error(gs_error_ioerror);
        goto exit;
    }

    /* First pass, identify all the objects of the form x y obj */

    do {
        code = pdfi_skip_white(ctx, ctx->main_stream);
        if (code < 0) {
            if (code != gs_error_VMerror && code != gs_error_ioerror) {
                pdfi_clearstack(ctx);
                continue;
            } else
                goto exit;
        }
        offset = pdfi_unread_tell(ctx);
        outer_saved_offset[0] = outer_saved_offset[1] = outer_saved_offset[2] = 0;
        do {
            outer_saved_offset[0] = outer_saved_offset[1];
            outer_saved_offset[1] = outer_saved_offset[2];
            outer_saved_offset[2] = pdfi_unread_tell(ctx);

            object_num = 0;

            code = pdfi_read_token(ctx, ctx->main_stream, 0, 0);
            if (code < 0) {
                if (code != gs_error_VMerror && code != gs_error_ioerror) {
                    pdfi_clearstack(ctx);
                    continue;
                } else
                    goto exit;
            }
            if (pdfi_count_stack(ctx) > 0) {
                if (pdfi_type_of(ctx->stack_top[-1]) == PDF_FAST_KEYWORD) {
                    pdf_obj *k = ctx->stack_top[-1];
                    pdf_num *n;

                    if (k == PDF_TOKEN_AS_OBJ(TOKEN_OBJ)) {
                        gs_offset_t saved_offset[3];

                        offset = outer_saved_offset[0];

                        saved_offset[0] = saved_offset[1] = saved_offset[2] = 0;

                        if (pdfi_count_stack(ctx) < 3 || pdfi_type_of(ctx->stack_top[-3]) != PDF_INT || pdfi_type_of(ctx->stack_top[-2]) != PDF_INT) {
                            pdfi_clearstack(ctx);
                            continue;
                        }
                        n = (pdf_num *)ctx->stack_top[-3];
                        object_num = n->value.i;
                        n = (pdf_num *)ctx->stack_top[-2];
                        generation_num = n->value.i;
                        pdfi_clearstack(ctx);

                        do {
                            /* move all the saved offsets up by one */
                            saved_offset[0] = saved_offset[1];
                            saved_offset[1] = saved_offset[2];
                            saved_offset[2] = pdfi_unread_tell(ctx);

                            code = pdfi_read_token(ctx, ctx->main_stream, 0, 0);
                            if (code < 0) {
                                if (code != gs_error_VMerror && code != gs_error_ioerror)
                                    continue;
                                goto exit;
                            }
                            if (code == 0 && ctx->main_stream->eof)
                                break;

                            if (pdfi_type_of(ctx->stack_top[-1]) == PDF_FAST_KEYWORD) {
                                pdf_obj *k = ctx->stack_top[-1];

                                if (k == PDF_TOKEN_AS_OBJ(TOKEN_OBJ)) {
                                    /* Found obj while looking for endobj, store the existing 'obj'
                                     * and start afresh.
                                     */
                                    code = pdfi_repair_add_object(ctx, object_num, generation_num, offset);
                                    if (pdfi_count_stack(ctx) < 3 || pdfi_type_of(ctx->stack_top[-3]) != PDF_INT || pdfi_type_of(ctx->stack_top[-2]) != PDF_INT) {
                                        pdfi_clearstack(ctx);
                                        break;
                                    }
                                    n = (pdf_num *)ctx->stack_top[-3];
                                    object_num = n->value.i;
                                    n = (pdf_num *)ctx->stack_top[-2];
                                    generation_num = n->value.i;
                                    pdfi_clearstack(ctx);
                                    offset = saved_offset[0];
                                    continue;
                                }

                                if (k == PDF_TOKEN_AS_OBJ(TOKEN_ENDOBJ)) {
                                    code = pdfi_repair_add_object(ctx, object_num, generation_num, offset);
                                    if (code < 0)
                                        goto exit;
                                    pdfi_clearstack(ctx);
                                    break;
                                } else {
                                    if (k == PDF_TOKEN_AS_OBJ(TOKEN_STREAM)) {
                                        static const char test[] = "endstream";
                                        int index = 0;

                                        do {
                                            int c = pdfi_read_byte(ctx, ctx->main_stream);
                                            if (c == EOFC)
                                                break;
                                            if (c < 0)
                                                goto exit;
                                            if (c == test[index])
                                                index++;
                                            else if (c == test[0]) /* Pesky 'e' appears twice */
                                                index = 1;
                                            else
                                                index = 0;
                                        } while (index < 9);
                                        do {
                                            code = pdfi_read_bare_keyword(ctx, ctx->main_stream);
                                            if (code == gs_error_VMerror || code == gs_error_ioerror)
                                                goto exit;
                                            if (code < 0) {
                                                /* Something went wrong and we couldn't read a token, consume one byte and retry */
                                                (void)pdfi_read_byte(ctx, ctx->main_stream);
                                            } else {
                                                if (code == TOKEN_ENDOBJ || code == TOKEN_INVALID_KEY) {
                                                    code = pdfi_repair_add_object(ctx, object_num, generation_num, offset);
                                                    if (code == gs_error_VMerror || code == gs_error_ioerror)
                                                        goto exit;
                                                    break;
                                                }
                                            }
                                        } while(ctx->main_stream->eof == false);
                                        pdfi_clearstack(ctx);
                                        break;
                                    } else {
                                        pdfi_clearstack(ctx);
                                    }
                                }
                            }
                        } while(1);
                        break;
                    } else {
                        if (k == PDF_TOKEN_AS_OBJ(TOKEN_ENDOBJ)) {
                            pdfi_clearstack(ctx);
                        } else
                            if (k == PDF_TOKEN_AS_OBJ(TOKEN_STARTXREF)) {
                                code = pdfi_read_token(ctx, ctx->main_stream, 0, 0);
                                if (code < 0 && code != gs_error_VMerror && code != gs_error_ioerror)
                                    continue;
                                if (code < 0)
                                    goto exit;
                                pdfi_clearstack(ctx);
                            } else {
                                if (k == PDF_TOKEN_AS_OBJ(TOKEN_TRAILER)) {
                                    code = pdfi_read_bare_object(ctx, ctx->main_stream, 0, 0, 0);
                                    if (code == 0 && pdfi_count_stack(ctx) > 0 && pdfi_type_of(ctx->stack_top[-1]) == PDF_DICT) {
                                        if (ctx->Trailer) {
                                            pdf_dict *d = (pdf_dict *)ctx->stack_top[-1];
                                            bool known = false;

                                            code = pdfi_dict_known(ctx, d, "Root", &known);
                                            if (code == 0 && known) {
                                                pdfi_countdown(ctx->Trailer);
                                                ctx->Trailer = (pdf_dict *)ctx->stack_top[-1];
                                                pdfi_countup(ctx->Trailer);
                                            }
                                        } else {
                                            ctx->Trailer = (pdf_dict *)ctx->stack_top[-1];
                                            pdfi_countup(ctx->Trailer);
                                        }
                                    }
                                }
                                pdfi_clearstack(ctx);
                            }
                    }
                    code = pdfi_skip_white(ctx, ctx->main_stream);
                    if (code < 0) {
                        if (code != gs_error_VMerror && code != gs_error_ioerror) {
                            pdfi_clearstack(ctx);
                            continue;
                        } else
                            goto exit;
                    }
                }
                if (pdfi_count_stack(ctx) > 0 && pdfi_type_of(ctx->stack_top[-1]) != PDF_INT)
                    pdfi_clearstack(ctx);
            }
        } while (ctx->main_stream->eof == false);
    } while(ctx->main_stream->eof == false);

    pdfi_seek(ctx, ctx->main_stream, 0, SEEK_SET);
    ctx->main_stream->eof = false;

    /* Second pass, examine every object we have located to see if its an ObjStm */
    if (ctx->xref_table == NULL || ctx->xref_table->xref_size < 1) {
        code = gs_note_error(gs_error_syntaxerror);
        goto exit;
    }

    for (i=1;i < ctx->xref_table->xref_size;i++) {
        if (ctx->xref_table->xref[i].object_num != 0) {
            /* At this stage, all the objects we've found must be uncompressed */
            if (ctx->xref_table->xref[i].u.uncompressed.offset > ctx->main_stream_length) {
                /* This can only happen if we had read an xref table before we tried to repair
                 * the file, and the table has entries we didn't find in the file. So
                 * mark the entry as free, and offset of 0, and just carry on.
                 */
                ctx->xref_table->xref[i].free = 1;
                ctx->xref_table->xref[i].u.uncompressed.offset = 0;
                continue;
            }

            pdfi_seek(ctx, ctx->main_stream, ctx->xref_table->xref[i].u.uncompressed.offset, SEEK_SET);
            do {
                code = pdfi_read_token(ctx, ctx->main_stream, 0, 0);
                if (ctx->main_stream->eof == true || (code < 0 && code != gs_error_ioerror && code != gs_error_VMerror)) {
                    /* object offset is beyond EOF or object is broken (possibly due to multiple xref
                     * errors) ignore the error and carry on, if the object gets used then we will
                     * error out at that point.
                     */
                    code = 0;
                    break;
                }
                if (code < 0)
                    goto exit;
                if (pdfi_type_of(ctx->stack_top[-1]) == PDF_FAST_KEYWORD) {
                    pdf_obj *k = ctx->stack_top[-1];

                    if (k == PDF_TOKEN_AS_OBJ(TOKEN_OBJ)) {
                        continue;
                    }
                    if (k == PDF_TOKEN_AS_OBJ(TOKEN_ENDOBJ)) {
                        if (pdfi_count_stack(ctx) > 1) {
                            if (pdfi_type_of(ctx->stack_top[-2]) == PDF_DICT) {
                                pdf_dict *d = (pdf_dict *)ctx->stack_top[-2];
                                pdf_obj *o = NULL;

                                code = pdfi_dict_knownget_type(ctx, d, "Type", PDF_NAME, &o);
                                if (code < 0) {
                                    pdfi_clearstack(ctx);
                                    continue;
                                }
                                if (code > 0) {
                                    pdf_name *n = (pdf_name *)o;

                                    if (pdfi_name_is(n, "Catalog")) {
                                        pdfi_countdown(ctx->Root); /* In case it was already set */
                                        ctx->Root = (pdf_dict *)ctx->stack_top[-2];
                                        pdfi_countup(ctx->Root);
                                    }
                                }
                                pdfi_countdown(o);
                            }
                        }
                        pdfi_clearstack(ctx);
                        break;
                    }
                    if (k == PDF_TOKEN_AS_OBJ(TOKEN_STREAM)) {
                        pdf_dict *d;
                        pdf_name *n = NULL;

                        if (pdfi_count_stack(ctx) <= 1) {
                            pdfi_clearstack(ctx);
                            break;;
                        }
                        d = (pdf_dict *)ctx->stack_top[-2];
                        if (pdfi_type_of(d) != PDF_DICT) {
                            pdfi_clearstack(ctx);
                            break;;
                        }
                        code = pdfi_dict_knownget_type(ctx, d, "Type", PDF_NAME, (pdf_obj **)&n);
                        if (code < 0) {
                            if ((code = pdfi_set_error_stop(ctx, code, NULL, E_PDF_UNREPAIRABLE, "pdfi_repair_file", NULL)) < 0) {
                                pdfi_clearstack(ctx);
                                goto exit;
                            }
                        }
                        if (code > 0) {
                            if (pdfi_name_is(n, "ObjStm")) {
                                int64_t N;
                                int obj_num, offset;
                                int j;
                                pdf_c_stream *compressed_stream;
                                pdf_stream *stream;

                                offset = pdfi_unread_tell(ctx);
                                pdfi_seek(ctx, ctx->main_stream, offset, SEEK_SET);

                                code = pdfi_obj_dict_to_stream(ctx, d, &stream, true);
                                if (code == 0)
                                    code = pdfi_filter(ctx, stream, ctx->main_stream, &compressed_stream, false);

                                pdfi_countdown(stream);

                                if (code == 0) {
                                    code = pdfi_dict_get_int(ctx, d, "N", &N);
                                    if (code == 0) {
                                        for (j=0;j < N; j++) {
                                            code = pdfi_read_bare_int(ctx, compressed_stream, &obj_num);
                                            if (code <= 0)
                                                break;
                                            else {
                                                code = pdfi_read_bare_int(ctx, compressed_stream, &offset);
                                                if (code > 0) {
                                                    if (obj_num < 1) {
                                                        pdfi_close_file(ctx, compressed_stream);
                                                        pdfi_countdown(n);
                                                        pdfi_clearstack(ctx);
                                                        code = gs_note_error(gs_error_rangecheck);
                                                        goto exit;
                                                    }
                                                    if (obj_num >= ctx->xref_table->xref_size)
                                                        code = pdfi_repair_add_object(ctx, obj_num, 0, 0);

                                                    if (code >= 0) {
                                                        ctx->xref_table->xref[obj_num].compressed = true;
                                                        ctx->xref_table->xref[obj_num].free = false;
                                                        ctx->xref_table->xref[obj_num].object_num = obj_num;
                                                        ctx->xref_table->xref[obj_num].u.compressed.compressed_stream_num = i;
                                                        ctx->xref_table->xref[obj_num].u.compressed.object_index = j;
                                                    }
                                                }
                                            }
                                        }
                                    }
                                    pdfi_close_file(ctx, compressed_stream);
                                }
                                if (code < 0) {
                                    if ((code = pdfi_set_error_stop(ctx, code, NULL, E_PDF_UNREPAIRABLE, "pdfi_repair_file", NULL)) < 0) {
                                        pdfi_countdown(n);
                                        pdfi_clearstack(ctx);
                                        goto exit;
                                    }
                                }
                            }
                        }
                        pdfi_countdown(n);
                        pdfi_clearstack(ctx);
                        break;
                    }
                }
            } while (1);
        }
    }

exit:
    if (code > 0)
        code = 0;
    pdfi_seek(ctx, ctx->main_stream, saved_offset, SEEK_SET);
    ctx->main_stream->eof = false;
    ctx->repairing = false;
    return code;
}

Coverage Report

Created: 2025-08-28 07:06

Line	Count	Source (jump to first uncovered line)
1		/* Copyright (C) 2020-2025 Artifex Software, Inc.
2		All Rights Reserved.
3
4		This software is provided AS-IS with no warranty, either express or
5		implied.
6
7		This software is distributed under license and may not be copied,
8		modified or distributed except as expressly authorized under the terms
9		of the license contained in the file LICENSE in this distribution.
10
11		Refer to licensing information at http://www.artifex.com or contact
12		Artifex Software, Inc., 39 Mesa Street, Suite 108A, San Francisco,
13		CA 94129, USA, for further information.
14		*/
15
16		/* Routines to attempt repair of PDF files in the event of an error */
17
18		#include "pdf_int.h"
19		#include "pdf_stack.h"
20		#include "strmio.h"
21		#include "stream.h"
22		#include "pdf_deref.h"
23		#include "pdf_dict.h"
24		#include "pdf_file.h"
25		#include "pdf_misc.h"
26		#include "pdf_repair.h"
27
28		static int pdfi_repair_add_object(pdf_context *ctx, int64_t obj, int64_t gen, gs_offset_t offset)
29	3.62M	{
30		/* Although we can handle object numbers larger than this, on some systems (32-bit Windows)
31		* memset is limited to a (signed!) integer for the size of memory to clear. We could deal
32		* with this by clearing the memory in blocks, but really, this is almost certainly a
33		* corrupted file or something.
34		*/
35	3.62M	if (obj >= 0x7ffffff / sizeof(xref_entry) \|\| obj < 1 \|\| gen < 0 \|\| offset < 0)
36	7.15k	return_error(gs_error_rangecheck);
37
38	3.61M	if (ctx->xref_table == NULL) {
39	79.4k	ctx->xref_table = (xref_table_t *)gs_alloc_bytes(ctx->memory, sizeof(xref_table_t), "repair xref table");
40	79.4k	if (ctx->xref_table == NULL) {
41	0	return_error(gs_error_VMerror);
42	0	}
43	79.4k	memset(ctx->xref_table, 0x00, sizeof(xref_table_t));
44	79.4k	ctx->xref_table->xref = (xref_entry )gs_alloc_bytes(ctx->memory, (size_t)(obj + 1) sizeof(xref_entry), "repair xref table");
45	79.4k	if (ctx->xref_table->xref == NULL){
46	0	gs_free_object(ctx->memory, ctx->xref_table, "failed to allocate xref table entries for repair");
47	0	ctx->xref_table = NULL;
48	0	return_error(gs_error_VMerror);
49	0	}
50	79.4k	memset(ctx->xref_table->xref, 0x00, (obj + 1) * sizeof(xref_entry));
51	79.4k	ctx->xref_table->ctx = ctx;
52	79.4k	ctx->xref_table->type = PDF_XREF_TABLE;
53	79.4k	ctx->xref_table->xref_size = obj + 1;
54		#if REFCNT_DEBUG
55		ctx->xref_table->UID = ctx->ref_UID++;
56		outprintf(ctx->memory, "Allocated xref table with UID %"PRIi64"\n", ctx->xref_table->UID);
57		#endif
58	79.4k	pdfi_countup(ctx->xref_table);
59	3.53M	} else {
60	3.53M	if (ctx->xref_table->xref_size < (obj + 1)) {
61	1.64M	xref_entry *new_xrefs;
62
63	1.64M	new_xrefs = (xref_entry )gs_alloc_bytes(ctx->memory, (size_t)(obj + 1) sizeof(xref_entry), "read_xref_stream allocate xref table entries");
64	1.64M	if (new_xrefs == NULL){
65	0	pdfi_countdown(ctx->xref_table);
66	0	ctx->xref_table = NULL;
67	0	return_error(gs_error_VMerror);
68	0	}
69	1.64M	memset(new_xrefs, 0x00, (obj + 1) * sizeof(xref_entry));
70	1.64M	memcpy(new_xrefs, ctx->xref_table->xref, ctx->xref_table->xref_size * sizeof(xref_entry));
71	1.64M	gs_free_object(ctx->memory, ctx->xref_table->xref, "reallocated xref entries");
72	1.64M	ctx->xref_table->xref = new_xrefs;
73	1.64M	ctx->xref_table->xref_size = obj + 1;
74	1.64M	}
75	3.53M	}
76	3.61M	ctx->xref_table->xref[obj].compressed = false;
77	3.61M	ctx->xref_table->xref[obj].free = false;
78	3.61M	ctx->xref_table->xref[obj].object_num = obj;
79	3.61M	ctx->xref_table->xref[obj].u.uncompressed.generation_num = gen;
80	3.61M	ctx->xref_table->xref[obj].u.uncompressed.offset = offset;
81	3.61M	return 0;
82	3.61M	}
83
84		int pdfi_repair_file(pdf_context *ctx)
85	956k	{
86	956k	int code = 0;
87	956k	gs_offset_t offset, saved_offset;
88	956k	int64_t object_num = 0, generation_num = 0;
89	956k	int i;
90	956k	gs_offset_t outer_saved_offset[3];
91
92	956k	if (ctx->repaired) {
93	855k	pdfi_set_error(ctx, 0, NULL, E_PDF_UNREPAIRABLE, "pdfi_repair_file", (char *)"%% Trying to repair file for second time -- unrepairable");
94	855k	return_error(gs_error_undefined);
95	855k	}
96
97	100k	saved_offset = pdfi_unread_tell(ctx);
98
99	100k	ctx->repaired = true;
100	100k	if ((code = pdfi_set_error_stop(ctx, gs_note_error(gs_error_ioerror), NULL, E_PDF_REPAIRED, "pdfi_repair_file", NULL)) < 0)
101	0	return code;
102
103	100k	ctx->repairing = true;
104
105	100k	pdfi_clearstack(ctx);
106
107	100k	if(ctx->args.pdfdebug)
108	0	outprintf(ctx->memory, "%% Error encountered in opening PDF file, attempting repair\n");
109
110		/* First try to locate a %PDF header. If we can't find one, abort this, the file is too broken
111		* and may not even be a PDF file.
112		*/
113	100k	pdfi_seek(ctx, ctx->main_stream, 0, SEEK_SET);
114	100k	{
115	100k	static const char test[] = "%PDF";
116	100k	int index = 0;
117
118	403k	do {
119	403k	int c = pdfi_read_byte(ctx, ctx->main_stream);
120	403k	if (c < 0)
121	0	goto exit;
122
123	403k	if (c == test[index])
124	403k	index++;
125	0	else
126	0	index = 0;
127	403k	} while (index < 4);
128	100k	if (index != 4) {
129	0	code = gs_note_error(gs_error_undefined);
130	0	goto exit;
131	0	}
132	100k	pdfi_unread(ctx, ctx->main_stream, (byte *)test, 4);
133	100k	pdfi_skip_comment(ctx, ctx->main_stream);
134	100k	}
135	100k	if (ctx->main_stream->eof == true) {
136	922	code = gs_note_error(gs_error_ioerror);
137	922	goto exit;
138	922	}
139
140		/* First pass, identify all the objects of the form x y obj */
141
142	3.53M	do {
143	3.53M	code = pdfi_skip_white(ctx, ctx->main_stream);
144	3.53M	if (code < 0) {
145	0	if (code != gs_error_VMerror && code != gs_error_ioerror) {
146	0	pdfi_clearstack(ctx);
147	0	continue;
148	0	} else
149	0	goto exit;
150	0	}
151	3.53M	offset = pdfi_unread_tell(ctx);
152	3.53M	outer_saved_offset[0] = outer_saved_offset[1] = outer_saved_offset[2] = 0;
153	26.7M	do {
154	26.7M	outer_saved_offset[0] = outer_saved_offset[1];
155	26.7M	outer_saved_offset[1] = outer_saved_offset[2];
156	26.7M	outer_saved_offset[2] = pdfi_unread_tell(ctx);
157
158	26.7M	object_num = 0;
159
160	26.7M	code = pdfi_read_token(ctx, ctx->main_stream, 0, 0);
161	26.7M	if (code < 0) {
162	970k	if (code != gs_error_VMerror && code != gs_error_ioerror) {
163	970k	pdfi_clearstack(ctx);
164	970k	continue;
165	970k	} else
166	233	goto exit;
167	970k	}
168	25.7M	if (pdfi_count_stack(ctx) > 0) {
169	24.8M	if (pdfi_type_of(ctx->stack_top[-1]) == PDF_FAST_KEYWORD) {
170	6.83M	pdf_obj *k = ctx->stack_top[-1];
171	6.83M	pdf_num *n;
172
173	6.83M	if (k == PDF_TOKEN_AS_OBJ(TOKEN_OBJ)) {
174	3.50M	gs_offset_t saved_offset[3];
175
176	3.50M	offset = outer_saved_offset[0];
177
178	3.50M	saved_offset[0] = saved_offset[1] = saved_offset[2] = 0;
179
180	3.50M	if (pdfi_count_stack(ctx) < 3 \|\| pdfi_type_of(ctx->stack_top[-3]) != PDF_INT \|\| pdfi_type_of(ctx->stack_top[-2]) != PDF_INT) {
181	15.7k	pdfi_clearstack(ctx);
182	15.7k	continue;
183	15.7k	}
184	3.48M	n = (pdf_num *)ctx->stack_top[-3];
185	3.48M	object_num = n->value.i;
186	3.48M	n = (pdf_num *)ctx->stack_top[-2];
187	3.48M	generation_num = n->value.i;
188	3.48M	pdfi_clearstack(ctx);
189
190	103M	do {
191		/* move all the saved offsets up by one */
192	103M	saved_offset[0] = saved_offset[1];
193	103M	saved_offset[1] = saved_offset[2];
194	103M	saved_offset[2] = pdfi_unread_tell(ctx);
195
196	103M	code = pdfi_read_token(ctx, ctx->main_stream, 0, 0);
197	103M	if (code < 0) {
198	755k	if (code != gs_error_VMerror && code != gs_error_ioerror)
199	755k	continue;
200	111	goto exit;
201	755k	}
202	102M	if (code == 0 && ctx->main_stream->eof)
203	21.8k	break;
204
205	102M	if (pdfi_type_of(ctx->stack_top[-1]) == PDF_FAST_KEYWORD) {
206	3.86M	pdf_obj *k = ctx->stack_top[-1];
207
208	3.86M	if (k == PDF_TOKEN_AS_OBJ(TOKEN_OBJ)) {
209		/* Found obj while looking for endobj, store the existing 'obj'
210		* and start afresh.
211		*/
212	102k	code = pdfi_repair_add_object(ctx, object_num, generation_num, offset);
213	102k	if (pdfi_count_stack(ctx) < 3 \|\| pdfi_type_of(ctx->stack_top[-3]) != PDF_INT \|\| pdfi_type_of(ctx->stack_top[-2]) != PDF_INT) {
214	9.65k	pdfi_clearstack(ctx);
215	9.65k	break;
216	9.65k	}
217	93.0k	n = (pdf_num *)ctx->stack_top[-3];
218	93.0k	object_num = n->value.i;
219	93.0k	n = (pdf_num *)ctx->stack_top[-2];
220	93.0k	generation_num = n->value.i;
221	93.0k	pdfi_clearstack(ctx);
222	93.0k	offset = saved_offset[0];
223	93.0k	continue;
224	102k	}
225
226	3.76M	if (k == PDF_TOKEN_AS_OBJ(TOKEN_ENDOBJ)) {
227	2.07M	code = pdfi_repair_add_object(ctx, object_num, generation_num, offset);
228	2.07M	if (code < 0)
229	131	goto exit;
230	2.07M	pdfi_clearstack(ctx);
231	2.07M	break;
232	2.07M	} else {
233	1.69M	if (k == PDF_TOKEN_AS_OBJ(TOKEN_STREAM)) {
234	1.38M	static const char test[] = "endstream";
235	1.38M	int index = 0;
236
237	4.62G	do {
238	4.62G	int c = pdfi_read_byte(ctx, ctx->main_stream);
239	4.62G	if (c == EOFC)
240	29.1k	break;
241	4.62G	if (c < 0)
242	0	goto exit;
243	4.62G	if (c == test[index])
244	38.3M	index++;
245	4.58G	else if (c == test[0]) /* Pesky 'e' appears twice */
246	352k	index = 1;
247	4.58G	else
248	4.58G	index = 0;
249	4.62G	} while (index < 9);
250	1.38M	do {
251	1.38M	code = pdfi_read_bare_keyword(ctx, ctx->main_stream);
252	1.38M	if (code == gs_error_VMerror \|\| code == gs_error_ioerror)
253	0	goto exit;
254	1.38M	if (code < 0) {
255		/* Something went wrong and we couldn't read a token, consume one byte and retry */
256	0	(void)pdfi_read_byte(ctx, ctx->main_stream);
257	1.38M	} else {
258	1.38M	if (code == TOKEN_ENDOBJ \|\| code == TOKEN_INVALID_KEY) {
259	1.38M	code = pdfi_repair_add_object(ctx, object_num, generation_num, offset);
260	1.38M	if (code == gs_error_VMerror \|\| code == gs_error_ioerror)
261	0	goto exit;
262	1.38M	break;
263	1.38M	}
264	1.38M	}
265	1.38M	} while(ctx->main_stream->eof == false);
266	1.38M	pdfi_clearstack(ctx);
267	1.38M	break;
268	1.38M	} else {
269	309k	pdfi_clearstack(ctx);
270	309k	}
271	1.69M	}
272	3.76M	}
273	102M	} while(1);
274	3.48M	break;
275	3.48M	} else {
276	3.32M	if (k == PDF_TOKEN_AS_OBJ(TOKEN_ENDOBJ)) {
277	47.0k	pdfi_clearstack(ctx);
278	47.0k	} else
279	3.28M	if (k == PDF_TOKEN_AS_OBJ(TOKEN_STARTXREF)) {
280	21.0k	code = pdfi_read_token(ctx, ctx->main_stream, 0, 0);
281	21.0k	if (code < 0 && code != gs_error_VMerror && code != gs_error_ioerror)
282	23	continue;
283	21.0k	if (code < 0)
284	0	goto exit;
285	21.0k	pdfi_clearstack(ctx);
286	3.25M	} else {
287	3.25M	if (k == PDF_TOKEN_AS_OBJ(TOKEN_TRAILER)) {
288	70.8k	code = pdfi_read_bare_object(ctx, ctx->main_stream, 0, 0, 0);
289	70.8k	if (code == 0 && pdfi_count_stack(ctx) > 0 && pdfi_type_of(ctx->stack_top[-1]) == PDF_DICT) {
290	37.2k	if (ctx->Trailer) {
291	12.3k	pdf_dict d = (pdf_dict )ctx->stack_top[-1];
292	12.3k	bool known = false;
293
294	12.3k	code = pdfi_dict_known(ctx, d, "Root", &known);
295	12.3k	if (code == 0 && known) {
296	8.62k	pdfi_countdown(ctx->Trailer);
297	8.62k	ctx->Trailer = (pdf_dict *)ctx->stack_top[-1];
298	8.62k	pdfi_countup(ctx->Trailer);
299	8.62k	}
300	24.8k	} else {
301	24.8k	ctx->Trailer = (pdf_dict *)ctx->stack_top[-1];
302	24.8k	pdfi_countup(ctx->Trailer);
303	24.8k	}
304	37.2k	}
305	70.8k	}
306	3.25M	pdfi_clearstack(ctx);
307	3.25M	}
308	3.32M	}
309	3.32M	code = pdfi_skip_white(ctx, ctx->main_stream);
310	3.32M	if (code < 0) {
311	0	if (code != gs_error_VMerror && code != gs_error_ioerror) {
312	0	pdfi_clearstack(ctx);
313	0	continue;
314	0	} else
315	0	goto exit;
316	0	}
317	3.32M	}
318	21.3M	if (pdfi_count_stack(ctx) > 0 && pdfi_type_of(ctx->stack_top[-1]) != PDF_INT)
319	3.88M	pdfi_clearstack(ctx);
320	21.3M	}
321	25.7M	} while (ctx->main_stream->eof == false);
322	3.53M	} while(ctx->main_stream->eof == false);
323
324	99.3k	pdfi_seek(ctx, ctx->main_stream, 0, SEEK_SET);
325	99.3k	ctx->main_stream->eof = false;
326
327		/* Second pass, examine every object we have located to see if its an ObjStm */
328	99.3k	if (ctx->xref_table == NULL \|\| ctx->xref_table->xref_size < 1) {
329	8.56k	code = gs_note_error(gs_error_syntaxerror);
330	8.56k	goto exit;
331	8.56k	}
332
333	234M	for (i=1;i < ctx->xref_table->xref_size;i++) {
334	234M	if (ctx->xref_table->xref[i].object_num != 0) {
335		/* At this stage, all the objects we've found must be uncompressed */
336	5.16M	if (ctx->xref_table->xref[i].u.uncompressed.offset > ctx->main_stream_length) {
337		/* This can only happen if we had read an xref table before we tried to repair
338		* the file, and the table has entries we didn't find in the file. So
339		* mark the entry as free, and offset of 0, and just carry on.
340		*/
341	10.9k	ctx->xref_table->xref[i].free = 1;
342	10.9k	ctx->xref_table->xref[i].u.uncompressed.offset = 0;
343	10.9k	continue;
344	10.9k	}
345
346	5.15M	pdfi_seek(ctx, ctx->main_stream, ctx->xref_table->xref[i].u.uncompressed.offset, SEEK_SET);
347	163M	do {
348	163M	code = pdfi_read_token(ctx, ctx->main_stream, 0, 0);
349	163M	if (ctx->main_stream->eof == true \|\| (code < 0 && code != gs_error_ioerror && code != gs_error_VMerror)) {
350		/* object offset is beyond EOF or object is broken (possibly due to multiple xref
351		* errors) ignore the error and carry on, if the object gets used then we will
352		* error out at that point.
353		*/
354	242k	code = 0;
355	242k	break;
356	242k	}
357	162M	if (code < 0)
358	0	goto exit;
359	162M	if (pdfi_type_of(ctx->stack_top[-1]) == PDF_FAST_KEYWORD) {
360	13.3M	pdf_obj *k = ctx->stack_top[-1];
361
362	13.3M	if (k == PDF_TOKEN_AS_OBJ(TOKEN_OBJ)) {
363	4.42M	continue;
364	4.42M	}
365	8.87M	if (k == PDF_TOKEN_AS_OBJ(TOKEN_ENDOBJ)) {
366	3.56M	if (pdfi_count_stack(ctx) > 1) {
367	3.52M	if (pdfi_type_of(ctx->stack_top[-2]) == PDF_DICT) {
368	2.24M	pdf_dict d = (pdf_dict )ctx->stack_top[-2];
369	2.24M	pdf_obj *o = NULL;
370
371	2.24M	code = pdfi_dict_knownget_type(ctx, d, "Type", PDF_NAME, &o);
372	2.24M	if (code < 0) {
373	261	pdfi_clearstack(ctx);
374	261	continue;
375	261	}
376	2.24M	if (code > 0) {
377	1.06M	pdf_name n = (pdf_name )o;
378
379	1.06M	if (pdfi_name_is(n, "Catalog")) {
380	121k	pdfi_countdown(ctx->Root); /* In case it was already set */
381	121k	ctx->Root = (pdf_dict *)ctx->stack_top[-2];
382	121k	pdfi_countup(ctx->Root);
383	121k	}
384	1.06M	}
385	2.24M	pdfi_countdown(o);
386	2.24M	}
387	3.52M	}
388	3.56M	pdfi_clearstack(ctx);
389	3.56M	break;
390	3.56M	}
391	5.31M	if (k == PDF_TOKEN_AS_OBJ(TOKEN_STREAM)) {
392	1.35M	pdf_dict *d;
393	1.35M	pdf_name *n = NULL;
394
395	1.35M	if (pdfi_count_stack(ctx) <= 1) {
396	1.73k	pdfi_clearstack(ctx);
397	1.73k	break;;
398	0	}
399	1.35M	d = (pdf_dict *)ctx->stack_top[-2];
400	1.35M	if (pdfi_type_of(d) != PDF_DICT) {
401	25.1k	pdfi_clearstack(ctx);
402	25.1k	break;;
403	0	}
404	1.32M	code = pdfi_dict_knownget_type(ctx, d, "Type", PDF_NAME, (pdf_obj **)&n);
405	1.32M	if (code < 0) {
406	63	if ((code = pdfi_set_error_stop(ctx, code, NULL, E_PDF_UNREPAIRABLE, "pdfi_repair_file", NULL)) < 0) {
407	0	pdfi_clearstack(ctx);
408	0	goto exit;
409	0	}
410	63	}
411	1.32M	if (code > 0) {
412	592k	if (pdfi_name_is(n, "ObjStm")) {
413	62.5k	int64_t N;
414	62.5k	int obj_num, offset;
415	62.5k	int j;
416	62.5k	pdf_c_stream *compressed_stream;
417	62.5k	pdf_stream *stream;
418
419	62.5k	offset = pdfi_unread_tell(ctx);
420	62.5k	pdfi_seek(ctx, ctx->main_stream, offset, SEEK_SET);
421
422	62.5k	code = pdfi_obj_dict_to_stream(ctx, d, &stream, true);
423	62.5k	if (code == 0)
424	62.5k	code = pdfi_filter(ctx, stream, ctx->main_stream, &compressed_stream, false);
425
426	62.5k	pdfi_countdown(stream);
427
428	62.5k	if (code == 0) {
429	62.0k	code = pdfi_dict_get_int(ctx, d, "N", &N);
430	62.0k	if (code == 0) {
431	2.11M	for (j=0;j < N; j++) {
432	2.06M	code = pdfi_read_bare_int(ctx, compressed_stream, &obj_num);
433	2.06M	if (code <= 0)
434	6.20k	break;
435	2.05M	else {
436	2.05M	code = pdfi_read_bare_int(ctx, compressed_stream, &offset);
437	2.05M	if (code > 0) {
438	2.05M	if (obj_num < 1) {
439	64	pdfi_close_file(ctx, compressed_stream);
440	64	pdfi_countdown(n);
441	64	pdfi_clearstack(ctx);
442	64	code = gs_note_error(gs_error_rangecheck);
443	64	goto exit;
444	64	}
445	2.05M	if (obj_num >= ctx->xref_table->xref_size)
446	65.9k	code = pdfi_repair_add_object(ctx, obj_num, 0, 0);
447
448	2.05M	if (code >= 0) {
449	2.05M	ctx->xref_table->xref[obj_num].compressed = true;
450	2.05M	ctx->xref_table->xref[obj_num].free = false;
451	2.05M	ctx->xref_table->xref[obj_num].object_num = obj_num;
452	2.05M	ctx->xref_table->xref[obj_num].u.compressed.compressed_stream_num = i;
453	2.05M	ctx->xref_table->xref[obj_num].u.compressed.object_index = j;
454	2.05M	}
455	2.05M	}
456	2.05M	}
457	2.06M	}
458	61.9k	}
459	62.0k	pdfi_close_file(ctx, compressed_stream);
460	62.0k	}
461	62.5k	if (code < 0) {
462	4.38k	if ((code = pdfi_set_error_stop(ctx, code, NULL, E_PDF_UNREPAIRABLE, "pdfi_repair_file", NULL)) < 0) {
463	0	pdfi_countdown(n);
464	0	pdfi_clearstack(ctx);
465	0	goto exit;
466	0	}
467	4.38k	}
468	62.5k	}
469	592k	}
470	1.32M	pdfi_countdown(n);
471	1.32M	pdfi_clearstack(ctx);
472	1.32M	break;
473	1.32M	}
474	5.31M	}
475	162M	} while (1);
476	5.15M	}
477	234M	}
478
479	100k	exit:
480	100k	if (code > 0)
481	29.2k	code = 0;
482	100k	pdfi_seek(ctx, ctx->main_stream, saved_offset, SEEK_SET);
483	100k	ctx->main_stream->eof = false;
484	100k	ctx->repairing = false;
485	100k	return code;
486	90.8k	}