/src/ghostpdl/pdf/pdf_repair.c

Source
/* Copyright (C) 2020-2025 Artifex Software, Inc.
   All Rights Reserved.

   This software is provided AS-IS with no warranty, either express or
   implied.

   This software is distributed under license and may not be copied,
   modified or distributed except as expressly authorized under the terms
   of the license contained in the file LICENSE in this distribution.

   Refer to licensing information at http://www.artifex.com or contact
   Artifex Software, Inc.,  39 Mesa Street, Suite 108A, San Francisco,
   CA 94129, USA, for further information.
*/

/* Routines to attempt repair of PDF files in the event of an error */

#include "pdf_int.h"
#include "pdf_stack.h"
#include "strmio.h"
#include "stream.h"
#include "pdf_deref.h"
#include "pdf_dict.h"
#include "pdf_file.h"
#include "pdf_misc.h"
#include "pdf_repair.h"

static int pdfi_repair_add_object(pdf_context *ctx, int64_t obj, int64_t gen, gs_offset_t offset)
{
    /* Although we can handle object numbers larger than this, on some systems (32-bit Windows)
     * memset is limited to a (signed!) integer for the size of memory to clear. We could deal
     * with this by clearing the memory in blocks, but really, this is almost certainly a
     * corrupted file or something.
     */
    if (obj >= 0x7ffffff / sizeof(xref_entry) || obj < 1 || gen < 0 || offset < 0)
        return_error(gs_error_rangecheck);

    if (ctx->xref_table == NULL) {
        ctx->xref_table = (xref_table_t *)gs_alloc_bytes(ctx->memory, sizeof(xref_table_t), "repair xref table");
        if (ctx->xref_table == NULL) {
            return_error(gs_error_VMerror);
        }
        memset(ctx->xref_table, 0x00, sizeof(xref_table_t));
        ctx->xref_table->xref = (xref_entry *)gs_alloc_bytes(ctx->memory, (size_t)(obj + 1) * sizeof(xref_entry), "repair xref table");
        if (ctx->xref_table->xref == NULL){
            gs_free_object(ctx->memory, ctx->xref_table, "failed to allocate xref table entries for repair");
            ctx->xref_table = NULL;
            return_error(gs_error_VMerror);
        }
        memset(ctx->xref_table->xref, 0x00, (obj + 1) * sizeof(xref_entry));
        ctx->xref_table->ctx = ctx;
        ctx->xref_table->type = PDF_XREF_TABLE;
        ctx->xref_table->xref_size = obj + 1;
#if REFCNT_DEBUG
        ctx->xref_table->UID = ctx->ref_UID++;
        outprintf(ctx->memory, "Allocated xref table with UID %"PRIi64"\n", ctx->xref_table->UID);
#endif
        pdfi_countup(ctx->xref_table);
    } else {
        if (ctx->xref_table->xref_size < (obj + 1)) {
            xref_entry *new_xrefs;

            new_xrefs = (xref_entry *)gs_alloc_bytes(ctx->memory, (size_t)(obj + 1) * sizeof(xref_entry), "read_xref_stream allocate xref table entries");
            if (new_xrefs == NULL){
                pdfi_countdown(ctx->xref_table);
                ctx->xref_table = NULL;
                return_error(gs_error_VMerror);
            }
            memset(new_xrefs, 0x00, (obj + 1) * sizeof(xref_entry));
            memcpy(new_xrefs, ctx->xref_table->xref, ctx->xref_table->xref_size * sizeof(xref_entry));
            gs_free_object(ctx->memory, ctx->xref_table->xref, "reallocated xref entries");
            ctx->xref_table->xref = new_xrefs;
            ctx->xref_table->xref_size = obj + 1;
        }
    }
    ctx->xref_table->xref[obj].compressed = false;
    ctx->xref_table->xref[obj].free = false;
    ctx->xref_table->xref[obj].object_num = obj;
    ctx->xref_table->xref[obj].u.uncompressed.generation_num = gen;
    ctx->xref_table->xref[obj].u.uncompressed.offset = offset;
    return 0;
}

int pdfi_repair_file(pdf_context *ctx)
{
    int code = 0;
    gs_offset_t offset, saved_offset;
    int64_t object_num = 0, generation_num = 0;
    int i;
    gs_offset_t outer_saved_offset[3];

    if (ctx->repaired) {
        pdfi_set_error(ctx, 0, NULL, E_PDF_UNREPAIRABLE, "pdfi_repair_file", (char *)"%% Trying to repair file for second time -- unrepairable");
        return_error(gs_error_undefined);
    }

    saved_offset = pdfi_unread_tell(ctx);

    ctx->repaired = true;
    if ((code = pdfi_set_error_stop(ctx, gs_note_error(gs_error_ioerror), NULL, E_PDF_REPAIRED, "pdfi_repair_file", NULL)) < 0)
        return code;

    ctx->repairing = true;

    pdfi_clearstack(ctx);

    if(ctx->args.pdfdebug)
        outprintf(ctx->memory, "%% Error encountered in opening PDF file, attempting repair\n");

    /* First try to locate a %PDF header. If we can't find one, abort this, the file is too broken
     * and may not even be a PDF file.
     */
    pdfi_seek(ctx, ctx->main_stream, 0, SEEK_SET);
    {
        static const char test[] = "%PDF";
        int index = 0;

        do {
            int c = pdfi_read_byte(ctx, ctx->main_stream);
            if (c < 0)
                goto exit;

            if (c == test[index])
                index++;
            else
                index = 0;
        } while (index < 4);
        if (index != 4) {
            code = gs_note_error(gs_error_undefined);
            goto exit;
        }
        pdfi_unread(ctx, ctx->main_stream, (byte *)test, 4);
        pdfi_skip_comment(ctx, ctx->main_stream);
    }
    if (ctx->main_stream->eof == true) {
        code = gs_note_error(gs_error_ioerror);
        goto exit;
    }

    /* First pass, identify all the objects of the form x y obj */

    do {
        code = pdfi_skip_white(ctx, ctx->main_stream);
        if (code < 0) {
            if (code != gs_error_VMerror && code != gs_error_ioerror) {
                pdfi_clearstack(ctx);
                continue;
            } else
                goto exit;
        }
        offset = pdfi_unread_tell(ctx);
        outer_saved_offset[0] = outer_saved_offset[1] = outer_saved_offset[2] = 0;
        do {
            outer_saved_offset[0] = outer_saved_offset[1];
            outer_saved_offset[1] = outer_saved_offset[2];
            outer_saved_offset[2] = pdfi_unread_tell(ctx);

            object_num = 0;

            code = pdfi_read_token(ctx, ctx->main_stream, 0, 0);
            if (code < 0) {
                if (code != gs_error_VMerror && code != gs_error_ioerror) {
                    pdfi_clearstack(ctx);
                    continue;
                } else
                    goto exit;
            }
            if (pdfi_count_stack(ctx) > 0) {
                if (pdfi_type_of(ctx->stack_top[-1]) == PDF_FAST_KEYWORD) {
                    pdf_obj *k = ctx->stack_top[-1];
                    pdf_num *n;

                    if (k == PDF_TOKEN_AS_OBJ(TOKEN_OBJ)) {
                        gs_offset_t saved_offset[3];

                        offset = outer_saved_offset[0];

                        saved_offset[0] = saved_offset[1] = saved_offset[2] = 0;

                        if (pdfi_count_stack(ctx) < 3 || pdfi_type_of(ctx->stack_top[-3]) != PDF_INT || pdfi_type_of(ctx->stack_top[-2]) != PDF_INT) {
                            pdfi_clearstack(ctx);
                            continue;
                        }
                        n = (pdf_num *)ctx->stack_top[-3];
                        object_num = n->value.i;
                        n = (pdf_num *)ctx->stack_top[-2];
                        generation_num = n->value.i;
                        pdfi_clearstack(ctx);

                        do {
                            /* move all the saved offsets up by one */
                            saved_offset[0] = saved_offset[1];
                            saved_offset[1] = saved_offset[2];
                            saved_offset[2] = pdfi_unread_tell(ctx);

                            code = pdfi_read_token(ctx, ctx->main_stream, 0, 0);
                            if (code < 0) {
                                if (code != gs_error_VMerror && code != gs_error_ioerror)
                                    continue;
                                goto exit;
                            }
                            if (code == 0 && ctx->main_stream->eof)
                                break;

                            if (pdfi_type_of(ctx->stack_top[-1]) == PDF_FAST_KEYWORD) {
                                pdf_obj *k = ctx->stack_top[-1];

                                if (k == PDF_TOKEN_AS_OBJ(TOKEN_OBJ)) {
                                    /* Found obj while looking for endobj, store the existing 'obj'
                                     * and start afresh.
                                     */
                                    code = pdfi_repair_add_object(ctx, object_num, generation_num, offset);
                                    if (pdfi_count_stack(ctx) < 3 || pdfi_type_of(ctx->stack_top[-3]) != PDF_INT || pdfi_type_of(ctx->stack_top[-2]) != PDF_INT) {
                                        pdfi_clearstack(ctx);
                                        break;
                                    }
                                    n = (pdf_num *)ctx->stack_top[-3];
                                    object_num = n->value.i;
                                    n = (pdf_num *)ctx->stack_top[-2];
                                    generation_num = n->value.i;
                                    pdfi_clearstack(ctx);
                                    offset = saved_offset[0];
                                    continue;
                                }

                                if (k == PDF_TOKEN_AS_OBJ(TOKEN_ENDOBJ)) {
                                    code = pdfi_repair_add_object(ctx, object_num, generation_num, offset);
                                    if (code < 0)
                                        goto exit;
                                    pdfi_clearstack(ctx);
                                    break;
                                } else {
                                    if (k == PDF_TOKEN_AS_OBJ(TOKEN_STREAM)) {
                                        static const char test[] = "endstream";
                                        int index = 0;

                                        do {
                                            int c = pdfi_read_byte(ctx, ctx->main_stream);
                                            if (c == EOFC)
                                                break;
                                            if (c < 0)
                                                goto exit;
                                            if (c == test[index])
                                                index++;
                                            else if (c == test[0]) /* Pesky 'e' appears twice */
                                                index = 1;
                                            else
                                                index = 0;
                                        } while (index < 9);
                                        do {
                                            code = pdfi_read_bare_keyword(ctx, ctx->main_stream);
                                            if (code == gs_error_VMerror || code == gs_error_ioerror)
                                                goto exit;
                                            if (code < 0) {
                                                /* Something went wrong and we couldn't read a token, consume one byte and retry */
                                                (void)pdfi_read_byte(ctx, ctx->main_stream);
                                            } else {
                                                if (code == TOKEN_ENDOBJ || code == TOKEN_INVALID_KEY) {
                                                    code = pdfi_repair_add_object(ctx, object_num, generation_num, offset);
                                                    if (code == gs_error_VMerror || code == gs_error_ioerror)
                                                        goto exit;
                                                    break;
                                                }
                                            }
                                        } while(ctx->main_stream->eof == false);
                                        pdfi_clearstack(ctx);
                                        break;
                                    } else {
                                        pdfi_clearstack(ctx);
                                    }
                                }
                            }
                        } while(1);
                        break;
                    } else {
                        if (k == PDF_TOKEN_AS_OBJ(TOKEN_ENDOBJ)) {
                            pdfi_clearstack(ctx);
                        } else
                            if (k == PDF_TOKEN_AS_OBJ(TOKEN_STARTXREF)) {
                                code = pdfi_read_token(ctx, ctx->main_stream, 0, 0);
                                if (code < 0 && code != gs_error_VMerror && code != gs_error_ioerror)
                                    continue;
                                if (code < 0)
                                    goto exit;
                                pdfi_clearstack(ctx);
                            } else {
                                if (k == PDF_TOKEN_AS_OBJ(TOKEN_TRAILER)) {
                                    code = pdfi_read_bare_object(ctx, ctx->main_stream, 0, 0, 0);
                                    if (code == 0 && pdfi_count_stack(ctx) > 0 && pdfi_type_of(ctx->stack_top[-1]) == PDF_DICT) {
                                        if (ctx->Trailer) {
                                            pdf_dict *d = (pdf_dict *)ctx->stack_top[-1];
                                            bool known = false;

                                            code = pdfi_dict_known(ctx, d, "Root", &known);
                                            if (code == 0 && known) {
                                                pdfi_countdown(ctx->Trailer);
                                                ctx->Trailer = (pdf_dict *)ctx->stack_top[-1];
                                                pdfi_countup(ctx->Trailer);
                                            }
                                        } else {
                                            ctx->Trailer = (pdf_dict *)ctx->stack_top[-1];
                                            pdfi_countup(ctx->Trailer);
                                        }
                                    }
                                }
                                pdfi_clearstack(ctx);
                            }
                    }
                    code = pdfi_skip_white(ctx, ctx->main_stream);
                    if (code < 0) {
                        if (code != gs_error_VMerror && code != gs_error_ioerror) {
                            pdfi_clearstack(ctx);
                            continue;
                        } else
                            goto exit;
                    }
                }
                if (pdfi_count_stack(ctx) > 0 && pdfi_type_of(ctx->stack_top[-1]) != PDF_INT)
                    pdfi_clearstack(ctx);
            }
        } while (ctx->main_stream->eof == false);
    } while(ctx->main_stream->eof == false);

    pdfi_seek(ctx, ctx->main_stream, 0, SEEK_SET);
    ctx->main_stream->eof = false;

    /* Second pass, examine every object we have located to see if its an ObjStm */
    if (ctx->xref_table == NULL || ctx->xref_table->xref_size < 1) {
        code = gs_note_error(gs_error_syntaxerror);
        goto exit;
    }

    for (i=1;i < ctx->xref_table->xref_size;i++) {
        if (ctx->xref_table->xref[i].object_num != 0) {
            /* At this stage, all the objects we've found must be uncompressed */
            if (ctx->xref_table->xref[i].u.uncompressed.offset > ctx->main_stream_length) {
                /* This can only happen if we had read an xref table before we tried to repair
                 * the file, and the table has entries we didn't find in the file. So
                 * mark the entry as free, and offset of 0, and just carry on.
                 */
                ctx->xref_table->xref[i].free = 1;
                ctx->xref_table->xref[i].u.uncompressed.offset = 0;
                continue;
            }

            pdfi_seek(ctx, ctx->main_stream, ctx->xref_table->xref[i].u.uncompressed.offset, SEEK_SET);
            do {
                code = pdfi_read_token(ctx, ctx->main_stream, 0, 0);
                if (ctx->main_stream->eof == true || (code < 0 && code != gs_error_ioerror && code != gs_error_VMerror)) {
                    /* object offset is beyond EOF or object is broken (possibly due to multiple xref
                     * errors) ignore the error and carry on, if the object gets used then we will
                     * error out at that point.
                     */
                    code = 0;
                    break;
                }
                if (code < 0)
                    goto exit;
                if (pdfi_type_of(ctx->stack_top[-1]) == PDF_FAST_KEYWORD) {
                    pdf_obj *k = ctx->stack_top[-1];

                    if (k == PDF_TOKEN_AS_OBJ(TOKEN_OBJ)) {
                        continue;
                    }
                    if (k == PDF_TOKEN_AS_OBJ(TOKEN_ENDOBJ)) {
                        if (pdfi_count_stack(ctx) > 1) {
                            if (pdfi_type_of(ctx->stack_top[-2]) == PDF_DICT) {
                                pdf_dict *d = (pdf_dict *)ctx->stack_top[-2];
                                pdf_obj *o = NULL;

                                code = pdfi_dict_knownget_type(ctx, d, "Type", PDF_NAME, &o);
                                if (code < 0) {
                                    pdfi_clearstack(ctx);
                                    continue;
                                }
                                if (code > 0) {
                                    pdf_name *n = (pdf_name *)o;

                                    if (pdfi_name_is(n, "Catalog")) {
                                        pdfi_countdown(ctx->Root); /* In case it was already set */
                                        ctx->Root = (pdf_dict *)ctx->stack_top[-2];
                                        pdfi_countup(ctx->Root);
                                    }
                                }
                                pdfi_countdown(o);
                            }
                        }
                        pdfi_clearstack(ctx);
                        break;
                    }
                    if (k == PDF_TOKEN_AS_OBJ(TOKEN_STREAM)) {
                        pdf_dict *d;
                        pdf_name *n = NULL;

                        if (pdfi_count_stack(ctx) <= 1) {
                            pdfi_clearstack(ctx);
                            break;;
                        }
                        d = (pdf_dict *)ctx->stack_top[-2];
                        if (pdfi_type_of(d) != PDF_DICT) {
                            pdfi_clearstack(ctx);
                            break;;
                        }
                        code = pdfi_dict_knownget_type(ctx, d, "Type", PDF_NAME, (pdf_obj **)&n);
                        if (code < 0) {
                            if ((code = pdfi_set_error_stop(ctx, code, NULL, E_PDF_UNREPAIRABLE, "pdfi_repair_file", NULL)) < 0) {
                                pdfi_clearstack(ctx);
                                goto exit;
                            }
                        }
                        if (code > 0) {
                            if (pdfi_name_is(n, "ObjStm")) {
                                int64_t N;
                                int obj_num, offset;
                                int j;
                                pdf_c_stream *compressed_stream;
                                pdf_stream *stream;

                                offset = pdfi_unread_tell(ctx);
                                pdfi_seek(ctx, ctx->main_stream, offset, SEEK_SET);

                                code = pdfi_obj_dict_to_stream(ctx, d, &stream, true);
                                if (code == 0)
                                    code = pdfi_filter(ctx, stream, ctx->main_stream, &compressed_stream, false);

                                pdfi_countdown(stream);

                                if (code == 0) {
                                    code = pdfi_dict_get_int(ctx, d, "N", &N);
                                    if (code == 0) {
                                        for (j=0;j < N; j++) {
                                            code = pdfi_read_bare_int(ctx, compressed_stream, &obj_num);
                                            if (code <= 0)
                                                break;
                                            else {
                                                code = pdfi_read_bare_int(ctx, compressed_stream, &offset);
                                                if (code > 0) {
                                                    if (obj_num < 1) {
                                                        pdfi_close_file(ctx, compressed_stream);
                                                        pdfi_countdown(n);
                                                        pdfi_clearstack(ctx);
                                                        code = gs_note_error(gs_error_rangecheck);
                                                        goto exit;
                                                    }
                                                    if (obj_num >= ctx->xref_table->xref_size)
                                                        code = pdfi_repair_add_object(ctx, obj_num, 0, 0);

                                                    if (code >= 0) {
                                                        ctx->xref_table->xref[obj_num].compressed = true;
                                                        ctx->xref_table->xref[obj_num].free = false;
                                                        ctx->xref_table->xref[obj_num].object_num = obj_num;
                                                        ctx->xref_table->xref[obj_num].u.compressed.compressed_stream_num = i;
                                                        ctx->xref_table->xref[obj_num].u.compressed.object_index = j;
                                                    }
                                                }
                                            }
                                        }
                                    }
                                    pdfi_close_file(ctx, compressed_stream);
                                }
                                if (code < 0) {
                                    if ((code = pdfi_set_error_stop(ctx, code, NULL, E_PDF_UNREPAIRABLE, "pdfi_repair_file", NULL)) < 0) {
                                        pdfi_countdown(n);
                                        pdfi_clearstack(ctx);
                                        goto exit;
                                    }
                                }
                            }
                        }
                        pdfi_countdown(n);
                        pdfi_clearstack(ctx);
                        break;
                    }
                }
            } while (1);
        }
    }

exit:
    if (code > 0)
        code = 0;
    pdfi_seek(ctx, ctx->main_stream, saved_offset, SEEK_SET);
    ctx->main_stream->eof = false;
    ctx->repairing = false;
    return code;
}

Coverage Report

Created: 2025-11-16 07:40

Line	Count	Source
1		/* Copyright (C) 2020-2025 Artifex Software, Inc.
2		All Rights Reserved.
3
4		This software is provided AS-IS with no warranty, either express or
5		implied.
6
7		This software is distributed under license and may not be copied,
8		modified or distributed except as expressly authorized under the terms
9		of the license contained in the file LICENSE in this distribution.
10
11		Refer to licensing information at http://www.artifex.com or contact
12		Artifex Software, Inc., 39 Mesa Street, Suite 108A, San Francisco,
13		CA 94129, USA, for further information.
14		*/
15
16		/* Routines to attempt repair of PDF files in the event of an error */
17
18		#include "pdf_int.h"
19		#include "pdf_stack.h"
20		#include "strmio.h"
21		#include "stream.h"
22		#include "pdf_deref.h"
23		#include "pdf_dict.h"
24		#include "pdf_file.h"
25		#include "pdf_misc.h"
26		#include "pdf_repair.h"
27
28		static int pdfi_repair_add_object(pdf_context *ctx, int64_t obj, int64_t gen, gs_offset_t offset)
29	4.11M	{
30		/* Although we can handle object numbers larger than this, on some systems (32-bit Windows)
31		* memset is limited to a (signed!) integer for the size of memory to clear. We could deal
32		* with this by clearing the memory in blocks, but really, this is almost certainly a
33		* corrupted file or something.
34		*/
35	4.11M	if (obj >= 0x7ffffff / sizeof(xref_entry) \|\| obj < 1 \|\| gen < 0 \|\| offset < 0)
36	8.08k	return_error(gs_error_rangecheck);
37
38	4.10M	if (ctx->xref_table == NULL) {
39	83.8k	ctx->xref_table = (xref_table_t *)gs_alloc_bytes(ctx->memory, sizeof(xref_table_t), "repair xref table");
40	83.8k	if (ctx->xref_table == NULL) {
41	0	return_error(gs_error_VMerror);
42	0	}
43	83.8k	memset(ctx->xref_table, 0x00, sizeof(xref_table_t));
44	83.8k	ctx->xref_table->xref = (xref_entry )gs_alloc_bytes(ctx->memory, (size_t)(obj + 1) sizeof(xref_entry), "repair xref table");
45	83.8k	if (ctx->xref_table->xref == NULL){
46	0	gs_free_object(ctx->memory, ctx->xref_table, "failed to allocate xref table entries for repair");
47	0	ctx->xref_table = NULL;
48	0	return_error(gs_error_VMerror);
49	0	}
50	83.8k	memset(ctx->xref_table->xref, 0x00, (obj + 1) * sizeof(xref_entry));
51	83.8k	ctx->xref_table->ctx = ctx;
52	83.8k	ctx->xref_table->type = PDF_XREF_TABLE;
53	83.8k	ctx->xref_table->xref_size = obj + 1;
54		#if REFCNT_DEBUG
55		ctx->xref_table->UID = ctx->ref_UID++;
56		outprintf(ctx->memory, "Allocated xref table with UID %"PRIi64"\n", ctx->xref_table->UID);
57		#endif
58	83.8k	pdfi_countup(ctx->xref_table);
59	4.01M	} else {
60	4.01M	if (ctx->xref_table->xref_size < (obj + 1)) {
61	1.91M	xref_entry *new_xrefs;
62
63	1.91M	new_xrefs = (xref_entry )gs_alloc_bytes(ctx->memory, (size_t)(obj + 1) sizeof(xref_entry), "read_xref_stream allocate xref table entries");
64	1.91M	if (new_xrefs == NULL){
65	0	pdfi_countdown(ctx->xref_table);
66	0	ctx->xref_table = NULL;
67	0	return_error(gs_error_VMerror);
68	0	}
69	1.91M	memset(new_xrefs, 0x00, (obj + 1) * sizeof(xref_entry));
70	1.91M	memcpy(new_xrefs, ctx->xref_table->xref, ctx->xref_table->xref_size * sizeof(xref_entry));
71	1.91M	gs_free_object(ctx->memory, ctx->xref_table->xref, "reallocated xref entries");
72	1.91M	ctx->xref_table->xref = new_xrefs;
73	1.91M	ctx->xref_table->xref_size = obj + 1;
74	1.91M	}
75	4.01M	}
76	4.10M	ctx->xref_table->xref[obj].compressed = false;
77	4.10M	ctx->xref_table->xref[obj].free = false;
78	4.10M	ctx->xref_table->xref[obj].object_num = obj;
79	4.10M	ctx->xref_table->xref[obj].u.uncompressed.generation_num = gen;
80	4.10M	ctx->xref_table->xref[obj].u.uncompressed.offset = offset;
81	4.10M	return 0;
82	4.10M	}
83
84		int pdfi_repair_file(pdf_context *ctx)
85	1.03M	{
86	1.03M	int code = 0;
87	1.03M	gs_offset_t offset, saved_offset;
88	1.03M	int64_t object_num = 0, generation_num = 0;
89	1.03M	int i;
90	1.03M	gs_offset_t outer_saved_offset[3];
91
92	1.03M	if (ctx->repaired) {
93	933k	pdfi_set_error(ctx, 0, NULL, E_PDF_UNREPAIRABLE, "pdfi_repair_file", (char *)"%% Trying to repair file for second time -- unrepairable");
94	933k	return_error(gs_error_undefined);
95	933k	}
96
97	105k	saved_offset = pdfi_unread_tell(ctx);
98
99	105k	ctx->repaired = true;
100	105k	if ((code = pdfi_set_error_stop(ctx, gs_note_error(gs_error_ioerror), NULL, E_PDF_REPAIRED, "pdfi_repair_file", NULL)) < 0)
101	0	return code;
102
103	105k	ctx->repairing = true;
104
105	105k	pdfi_clearstack(ctx);
106
107	105k	if(ctx->args.pdfdebug)
108	0	outprintf(ctx->memory, "%% Error encountered in opening PDF file, attempting repair\n");
109
110		/* First try to locate a %PDF header. If we can't find one, abort this, the file is too broken
111		* and may not even be a PDF file.
112		*/
113	105k	pdfi_seek(ctx, ctx->main_stream, 0, SEEK_SET);
114	105k	{
115	105k	static const char test[] = "%PDF";
116	105k	int index = 0;
117
118	422k	do {
119	422k	int c = pdfi_read_byte(ctx, ctx->main_stream);
120	422k	if (c < 0)
121	0	goto exit;
122
123	422k	if (c == test[index])
124	422k	index++;
125	0	else
126	0	index = 0;
127	422k	} while (index < 4);
128	105k	if (index != 4) {
129	0	code = gs_note_error(gs_error_undefined);
130	0	goto exit;
131	0	}
132	105k	pdfi_unread(ctx, ctx->main_stream, (byte *)test, 4);
133	105k	pdfi_skip_comment(ctx, ctx->main_stream);
134	105k	}
135	105k	if (ctx->main_stream->eof == true) {
136	923	code = gs_note_error(gs_error_ioerror);
137	923	goto exit;
138	923	}
139
140		/* First pass, identify all the objects of the form x y obj */
141
142	4.02M	do {
143	4.02M	code = pdfi_skip_white(ctx, ctx->main_stream);
144	4.02M	if (code < 0) {
145	0	if (code != gs_error_VMerror && code != gs_error_ioerror) {
146	0	pdfi_clearstack(ctx);
147	0	continue;
148	0	} else
149	0	goto exit;
150	0	}
151	4.02M	offset = pdfi_unread_tell(ctx);
152	4.02M	outer_saved_offset[0] = outer_saved_offset[1] = outer_saved_offset[2] = 0;
153	30.1M	do {
154	30.1M	outer_saved_offset[0] = outer_saved_offset[1];
155	30.1M	outer_saved_offset[1] = outer_saved_offset[2];
156	30.1M	outer_saved_offset[2] = pdfi_unread_tell(ctx);
157
158	30.1M	object_num = 0;
159
160	30.1M	code = pdfi_read_token(ctx, ctx->main_stream, 0, 0);
161	30.1M	if (code < 0) {
162	981k	if (code != gs_error_VMerror && code != gs_error_ioerror) {
163	981k	pdfi_clearstack(ctx);
164	981k	continue;
165	981k	} else
166	226	goto exit;
167	981k	}
168	29.1M	if (pdfi_count_stack(ctx) > 0) {
169	28.2M	if (pdfi_type_of(ctx->stack_top[-1]) == PDF_FAST_KEYWORD) {
170	7.90M	pdf_obj *k = ctx->stack_top[-1];
171	7.90M	pdf_num *n;
172
173	7.90M	if (k == PDF_TOKEN_AS_OBJ(TOKEN_OBJ)) {
174	3.98M	gs_offset_t saved_offset[3];
175
176	3.98M	offset = outer_saved_offset[0];
177
178	3.98M	saved_offset[0] = saved_offset[1] = saved_offset[2] = 0;
179
180	3.98M	if (pdfi_count_stack(ctx) < 3 \|\| pdfi_type_of(ctx->stack_top[-3]) != PDF_INT \|\| pdfi_type_of(ctx->stack_top[-2]) != PDF_INT) {
181	16.8k	pdfi_clearstack(ctx);
182	16.8k	continue;
183	16.8k	}
184	3.96M	n = (pdf_num *)ctx->stack_top[-3];
185	3.96M	object_num = n->value.i;
186	3.96M	n = (pdf_num *)ctx->stack_top[-2];
187	3.96M	generation_num = n->value.i;
188	3.96M	pdfi_clearstack(ctx);
189
190	117M	do {
191		/* move all the saved offsets up by one */
192	117M	saved_offset[0] = saved_offset[1];
193	117M	saved_offset[1] = saved_offset[2];
194	117M	saved_offset[2] = pdfi_unread_tell(ctx);
195
196	117M	code = pdfi_read_token(ctx, ctx->main_stream, 0, 0);
197	117M	if (code < 0) {
198	792k	if (code != gs_error_VMerror && code != gs_error_ioerror)
199	792k	continue;
200	100	goto exit;
201	792k	}
202	116M	if (code == 0 && ctx->main_stream->eof)
203	21.8k	break;
204
205	116M	if (pdfi_type_of(ctx->stack_top[-1]) == PDF_FAST_KEYWORD) {
206	4.37M	pdf_obj *k = ctx->stack_top[-1];
207
208	4.37M	if (k == PDF_TOKEN_AS_OBJ(TOKEN_OBJ)) {
209		/* Found obj while looking for endobj, store the existing 'obj'
210		* and start afresh.
211		*/
212	105k	code = pdfi_repair_add_object(ctx, object_num, generation_num, offset);
213	105k	if (pdfi_count_stack(ctx) < 3 \|\| pdfi_type_of(ctx->stack_top[-3]) != PDF_INT \|\| pdfi_type_of(ctx->stack_top[-2]) != PDF_INT) {
214	10.4k	pdfi_clearstack(ctx);
215	10.4k	break;
216	10.4k	}
217	95.2k	n = (pdf_num *)ctx->stack_top[-3];
218	95.2k	object_num = n->value.i;
219	95.2k	n = (pdf_num *)ctx->stack_top[-2];
220	95.2k	generation_num = n->value.i;
221	95.2k	pdfi_clearstack(ctx);
222	95.2k	offset = saved_offset[0];
223	95.2k	continue;
224	105k	}
225
226	4.26M	if (k == PDF_TOKEN_AS_OBJ(TOKEN_ENDOBJ)) {
227	2.39M	code = pdfi_repair_add_object(ctx, object_num, generation_num, offset);
228	2.39M	if (code < 0)
229	148	goto exit;
230	2.39M	pdfi_clearstack(ctx);
231	2.39M	break;
232	2.39M	} else {
233	1.87M	if (k == PDF_TOKEN_AS_OBJ(TOKEN_STREAM)) {
234	1.54M	static const char test[] = "endstream";
235	1.54M	int index = 0;
236
237	5.16G	do {
238	5.16G	int c = pdfi_read_byte(ctx, ctx->main_stream);
239	5.16G	if (c == EOFC)
240	29.8k	break;
241	5.16G	if (c < 0)
242	0	goto exit;
243	5.16G	if (c == test[index])
244	42.7M	index++;
245	5.12G	else if (c == test[0]) /* Pesky 'e' appears twice */
246	394k	index = 1;
247	5.12G	else
248	5.12G	index = 0;
249	5.16G	} while (index < 9);
250	1.54M	do {
251	1.54M	code = pdfi_read_bare_keyword(ctx, ctx->main_stream);
252	1.54M	if (code == gs_error_VMerror \|\| code == gs_error_ioerror)
253	0	goto exit;
254	1.54M	if (code < 0) {
255		/* Something went wrong and we couldn't read a token, consume one byte and retry */
256	0	(void)pdfi_read_byte(ctx, ctx->main_stream);
257	1.54M	} else {
258	1.54M	if (code == TOKEN_ENDOBJ \|\| code == TOKEN_INVALID_KEY) {
259	1.54M	code = pdfi_repair_add_object(ctx, object_num, generation_num, offset);
260	1.54M	if (code == gs_error_VMerror \|\| code == gs_error_ioerror)
261	0	goto exit;
262	1.54M	break;
263	1.54M	}
264	1.54M	}
265	1.54M	} while(ctx->main_stream->eof == false);
266	1.54M	pdfi_clearstack(ctx);
267	1.54M	break;
268	1.54M	} else {
269	329k	pdfi_clearstack(ctx);
270	329k	}
271	1.87M	}
272	4.26M	}
273	116M	} while(1);
274	3.96M	break;
275	3.96M	} else {
276	3.91M	if (k == PDF_TOKEN_AS_OBJ(TOKEN_ENDOBJ)) {
277	50.0k	pdfi_clearstack(ctx);
278	50.0k	} else
279	3.86M	if (k == PDF_TOKEN_AS_OBJ(TOKEN_STARTXREF)) {
280	22.1k	code = pdfi_read_token(ctx, ctx->main_stream, 0, 0);
281	22.1k	if (code < 0 && code != gs_error_VMerror && code != gs_error_ioerror)
282	34	continue;
283	22.0k	if (code < 0)
284	0	goto exit;
285	22.0k	pdfi_clearstack(ctx);
286	3.84M	} else {
287	3.84M	if (k == PDF_TOKEN_AS_OBJ(TOKEN_TRAILER)) {
288	76.4k	code = pdfi_read_bare_object(ctx, ctx->main_stream, 0, 0, 0);
289	76.4k	if (code == 0 && pdfi_count_stack(ctx) > 0 && pdfi_type_of(ctx->stack_top[-1]) == PDF_DICT) {
290	42.0k	if (ctx->Trailer) {
291	13.3k	pdf_dict d = (pdf_dict )ctx->stack_top[-1];
292	13.3k	bool known = false;
293
294	13.3k	code = pdfi_dict_known(ctx, d, "Root", &known);
295	13.3k	if (code == 0 && known) {
296	9.31k	pdfi_countdown(ctx->Trailer);
297	9.31k	ctx->Trailer = (pdf_dict *)ctx->stack_top[-1];
298	9.31k	pdfi_countup(ctx->Trailer);
299	9.31k	}
300	28.6k	} else {
301	28.6k	ctx->Trailer = (pdf_dict *)ctx->stack_top[-1];
302	28.6k	pdfi_countup(ctx->Trailer);
303	28.6k	}
304	42.0k	}
305	76.4k	}
306	3.84M	pdfi_clearstack(ctx);
307	3.84M	}
308	3.91M	}
309	3.91M	code = pdfi_skip_white(ctx, ctx->main_stream);
310	3.91M	if (code < 0) {
311	0	if (code != gs_error_VMerror && code != gs_error_ioerror) {
312	0	pdfi_clearstack(ctx);
313	0	continue;
314	0	} else
315	0	goto exit;
316	0	}
317	3.91M	}
318	24.2M	if (pdfi_count_stack(ctx) > 0 && pdfi_type_of(ctx->stack_top[-1]) != PDF_INT)
319	4.03M	pdfi_clearstack(ctx);
320	24.2M	}
321	29.1M	} while (ctx->main_stream->eof == false);
322	4.02M	} while(ctx->main_stream->eof == false);
323
324	104k	pdfi_seek(ctx, ctx->main_stream, 0, SEEK_SET);
325	104k	ctx->main_stream->eof = false;
326
327		/* Second pass, examine every object we have located to see if its an ObjStm */
328	104k	if (ctx->xref_table == NULL \|\| ctx->xref_table->xref_size < 1) {
329	8.25k	code = gs_note_error(gs_error_syntaxerror);
330	8.25k	goto exit;
331	8.25k	}
332
333	253M	for (i=1;i < ctx->xref_table->xref_size;i++) {
334	253M	if (ctx->xref_table->xref[i].object_num != 0) {
335		/* At this stage, all the objects we've found must be uncompressed */
336	5.78M	if (ctx->xref_table->xref[i].u.uncompressed.offset > ctx->main_stream_length) {
337		/* This can only happen if we had read an xref table before we tried to repair
338		* the file, and the table has entries we didn't find in the file. So
339		* mark the entry as free, and offset of 0, and just carry on.
340		*/
341	11.5k	ctx->xref_table->xref[i].free = 1;
342	11.5k	ctx->xref_table->xref[i].u.uncompressed.offset = 0;
343	11.5k	continue;
344	11.5k	}
345
346	5.77M	pdfi_seek(ctx, ctx->main_stream, ctx->xref_table->xref[i].u.uncompressed.offset, SEEK_SET);
347	180M	do {
348	180M	code = pdfi_read_token(ctx, ctx->main_stream, 0, 0);
349	180M	if (ctx->main_stream->eof == true \|\| (code < 0 && code != gs_error_ioerror && code != gs_error_VMerror)) {
350		/* object offset is beyond EOF or object is broken (possibly due to multiple xref
351		* errors) ignore the error and carry on, if the object gets used then we will
352		* error out at that point.
353		*/
354	261k	code = 0;
355	261k	break;
356	261k	}
357	180M	if (code < 0)
358	0	goto exit;
359	180M	if (pdfi_type_of(ctx->stack_top[-1]) == PDF_FAST_KEYWORD) {
360	14.7M	pdf_obj *k = ctx->stack_top[-1];
361
362	14.7M	if (k == PDF_TOKEN_AS_OBJ(TOKEN_OBJ)) {
363	4.92M	continue;
364	4.92M	}
365	9.82M	if (k == PDF_TOKEN_AS_OBJ(TOKEN_ENDOBJ)) {
366	4.00M	if (pdfi_count_stack(ctx) > 1) {
367	3.96M	if (pdfi_type_of(ctx->stack_top[-2]) == PDF_DICT) {
368	2.52M	pdf_dict d = (pdf_dict )ctx->stack_top[-2];
369	2.52M	pdf_obj *o = NULL;
370
371	2.52M	code = pdfi_dict_knownget_type(ctx, d, "Type", PDF_NAME, &o);
372	2.52M	if (code < 0) {
373	272	pdfi_clearstack(ctx);
374	272	continue;
375	272	}
376	2.52M	if (code > 0) {
377	1.21M	pdf_name n = (pdf_name )o;
378
379	1.21M	if (pdfi_name_is(n, "Catalog")) {
380	131k	pdfi_countdown(ctx->Root); /* In case it was already set */
381	131k	ctx->Root = (pdf_dict *)ctx->stack_top[-2];
382	131k	pdfi_countup(ctx->Root);
383	131k	}
384	1.21M	}
385	2.52M	pdfi_countdown(o);
386	2.52M	}
387	3.96M	}
388	4.00M	pdfi_clearstack(ctx);
389	4.00M	break;
390	4.00M	}
391	5.82M	if (k == PDF_TOKEN_AS_OBJ(TOKEN_STREAM)) {
392	1.50M	pdf_dict *d;
393	1.50M	pdf_name *n = NULL;
394
395	1.50M	if (pdfi_count_stack(ctx) <= 1) {
396	1.89k	pdfi_clearstack(ctx);
397	1.89k	break;;
398	0	}
399	1.50M	d = (pdf_dict *)ctx->stack_top[-2];
400	1.50M	if (pdfi_type_of(d) != PDF_DICT) {
401	27.7k	pdfi_clearstack(ctx);
402	27.7k	break;;
403	0	}
404	1.47M	code = pdfi_dict_knownget_type(ctx, d, "Type", PDF_NAME, (pdf_obj **)&n);
405	1.47M	if (code < 0) {
406	65	if ((code = pdfi_set_error_stop(ctx, code, NULL, E_PDF_UNREPAIRABLE, "pdfi_repair_file", NULL)) < 0) {
407	0	pdfi_clearstack(ctx);
408	0	goto exit;
409	0	}
410	65	}
411	1.47M	if (code > 0) {
412	665k	if (pdfi_name_is(n, "ObjStm")) {
413	69.5k	int64_t N;
414	69.5k	int obj_num, offset;
415	69.5k	int j;
416	69.5k	pdf_c_stream *compressed_stream;
417	69.5k	pdf_stream *stream;
418
419	69.5k	offset = pdfi_unread_tell(ctx);
420	69.5k	pdfi_seek(ctx, ctx->main_stream, offset, SEEK_SET);
421
422	69.5k	code = pdfi_obj_dict_to_stream(ctx, d, &stream, true);
423	69.5k	if (code == 0)
424	69.5k	code = pdfi_filter(ctx, stream, ctx->main_stream, &compressed_stream, false);
425
426	69.5k	pdfi_countdown(stream);
427
428	69.5k	if (code == 0) {
429	69.0k	code = pdfi_dict_get_int(ctx, d, "N", &N);
430	69.0k	if (code == 0) {
431	2.30M	for (j=0;j < N; j++) {
432	2.23M	code = pdfi_read_bare_int(ctx, compressed_stream, &obj_num);
433	2.23M	if (code <= 0)
434	6.73k	break;
435	2.23M	else {
436	2.23M	code = pdfi_read_bare_int(ctx, compressed_stream, &offset);
437	2.23M	if (code > 0) {
438	2.22M	if (obj_num < 1) {
439	72	pdfi_close_file(ctx, compressed_stream);
440	72	pdfi_countdown(n);
441	72	pdfi_clearstack(ctx);
442	72	code = gs_note_error(gs_error_rangecheck);
443	72	goto exit;
444	72	}
445	2.22M	if (obj_num >= ctx->xref_table->xref_size)
446	69.4k	code = pdfi_repair_add_object(ctx, obj_num, 0, 0);
447
448	2.22M	if (code >= 0) {
449	2.22M	ctx->xref_table->xref[obj_num].compressed = true;
450	2.22M	ctx->xref_table->xref[obj_num].free = false;
451	2.22M	ctx->xref_table->xref[obj_num].object_num = obj_num;
452	2.22M	ctx->xref_table->xref[obj_num].u.compressed.compressed_stream_num = i;
453	2.22M	ctx->xref_table->xref[obj_num].u.compressed.object_index = j;
454	2.22M	}
455	2.22M	}
456	2.23M	}
457	2.23M	}
458	68.9k	}
459	69.0k	pdfi_close_file(ctx, compressed_stream);
460	69.0k	}
461	69.5k	if (code < 0) {
462	4.92k	if ((code = pdfi_set_error_stop(ctx, code, NULL, E_PDF_UNREPAIRABLE, "pdfi_repair_file", NULL)) < 0) {
463	0	pdfi_countdown(n);
464	0	pdfi_clearstack(ctx);
465	0	goto exit;
466	0	}
467	4.92k	}
468	69.5k	}
469	665k	}
470	1.47M	pdfi_countdown(n);
471	1.47M	pdfi_clearstack(ctx);
472	1.47M	break;
473	1.47M	}
474	5.82M	}
475	180M	} while (1);
476	5.77M	}
477	253M	}
478
479	105k	exit:
480	105k	if (code > 0)
481	31.1k	code = 0;
482	105k	pdfi_seek(ctx, ctx->main_stream, saved_offset, SEEK_SET);
483	105k	ctx->main_stream->eof = false;
484	105k	ctx->repairing = false;
485	105k	return code;
486	96.0k	}