Coverage Report

Created: 2026-07-04 07:15

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/xpdf-4.06/xpdf/Parser.cc
Line
Count
Source
1
//========================================================================
2
//
3
// Parser.cc
4
//
5
// Copyright 1996-2003 Glyph & Cog, LLC
6
//
7
//========================================================================
8
9
#include <aconf.h>
10
11
#include <stddef.h>
12
#include <string.h>
13
#include "gmempp.h"
14
#include "Object.h"
15
#include "Array.h"
16
#include "Dict.h"
17
#include "Decrypt.h"
18
#include "Parser.h"
19
#include "XRef.h"
20
#include "Error.h"
21
22
403k
Parser::Parser(XRef *xrefA, Lexer *lexerA, GBool allowStreamsA) {
23
403k
  xref = xrefA;
24
403k
  lexer = lexerA;
25
403k
  inlineImg = 0;
26
403k
  allowStreams = allowStreamsA;
27
403k
  lexer->getObj(&buf1);
28
403k
  lexer->getObj(&buf2);
29
403k
}
30
31
403k
Parser::~Parser() {
32
403k
  buf1.free();
33
403k
  buf2.free();
34
403k
  delete lexer;
35
403k
}
36
37
Object *Parser::getObj(Object *obj, GBool simpleOnly,
38
           Guchar *fileKey,
39
           CryptAlgorithm encAlgorithm, int keyLength,
40
172M
           int objNum, int objGen, int recursion) {
41
172M
  char *key;
42
172M
  Stream *str;
43
172M
  Object obj2;
44
172M
  int num;
45
172M
  DecryptStream *decrypt;
46
172M
  GString *s, *s2;
47
172M
  int c;
48
49
  // refill buffer after inline image data
50
172M
  if (inlineImg == 2) {
51
59.0k
    buf1.free();
52
59.0k
    buf2.free();
53
59.0k
    lexer->getObj(&buf1);
54
59.0k
    lexer->getObj(&buf2);
55
59.0k
    inlineImg = 0;
56
59.0k
  }
57
58
  // array
59
172M
  if (!simpleOnly && recursion < objectRecursionLimit && buf1.isCmd("[")) {
60
711k
    shift();
61
711k
    obj->initArray(xref);
62
20.7M
    while (!buf1.isCmd("]") && !buf1.isEOF())
63
20.0M
      obj->arrayAdd(getObj(&obj2, gFalse, fileKey, encAlgorithm, keyLength,
64
20.0M
         objNum, objGen, recursion + 1));
65
711k
    if (buf1.isEOF())
66
405k
      error(errSyntaxError, getPos(), "End of file inside array");
67
711k
    shift();
68
69
  // dictionary or stream
70
171M
  } else if (!simpleOnly && recursion < objectRecursionLimit &&
71
9.91M
       buf1.isCmd("<<")) {
72
612k
    shift();
73
612k
    obj->initDict(xref);
74
16.8M
    while (!buf1.isCmd(">>") && !buf1.isEOF()) {
75
16.2M
      if (!buf1.isName()) {
76
13.5M
  error(errSyntaxError, getPos(),
77
13.5M
        "Dictionary key must be a name object");
78
13.5M
  shift();
79
13.5M
      } else {
80
2.69M
  key = copyString(buf1.getName());
81
2.69M
  shift();
82
2.69M
  if (buf1.isEOF() || buf1.isError()) {
83
41.2k
    gfree(key);
84
41.2k
    break;
85
41.2k
  }
86
2.65M
  obj->dictAdd(key, getObj(&obj2, gFalse,
87
2.65M
         fileKey, encAlgorithm, keyLength,
88
2.65M
         objNum, objGen, recursion + 1));
89
2.65M
      }
90
16.2M
    }
91
612k
    if (buf1.isEOF())
92
39.9k
      error(errSyntaxError, getPos(), "End of file inside dictionary");
93
    // stream objects are not allowed inside content streams or
94
    // object streams
95
612k
    if (allowStreams && buf2.isCmd("stream")) {
96
111k
      if ((str = makeStream(obj, fileKey, encAlgorithm, keyLength,
97
111k
          objNum, objGen, recursion + 1))) {
98
102k
  obj->initStream(str);
99
102k
      } else {
100
8.60k
  obj->free();
101
8.60k
  obj->initError();
102
8.60k
      }
103
500k
    } else {
104
500k
      shift();
105
500k
    }
106
107
  // indirect reference or integer
108
170M
  } else if (buf1.isInt()) {
109
4.55M
    num = buf1.getInt();
110
4.55M
    shift();
111
4.55M
    if (buf1.isInt() && buf2.isCmd("R")) {
112
557k
      int gen = buf1.getInt();
113
557k
      if (num >= 0 && gen >= 0) {
114
552k
  obj->initRef(num, gen);
115
552k
      } else {
116
4.36k
  error(errSyntaxError, getPos(),
117
4.36k
        "Negative number or generation in indirect reference");
118
4.36k
  obj->initError();
119
4.36k
      }
120
557k
      shift();
121
557k
      shift();
122
3.99M
    } else {
123
3.99M
      obj->initInt(num);
124
3.99M
    }
125
126
  // string
127
166M
  } else if (buf1.isString() && fileKey) {
128
20.5k
    s = buf1.getString();
129
20.5k
    s2 = new GString();
130
20.5k
    obj2.initNull();
131
20.5k
    decrypt = new DecryptStream(new MemStream(s->getCString(), 0,
132
20.5k
                s->getLength(), &obj2),
133
20.5k
        fileKey, encAlgorithm, keyLength,
134
20.5k
        objNum, objGen);
135
20.5k
    decrypt->reset();
136
915k
    while ((c = decrypt->getChar()) != EOF) {
137
894k
      s2->append((char)c);
138
894k
    }
139
20.5k
    delete decrypt;
140
20.5k
    obj->initString(s2);
141
20.5k
    shift();
142
143
  // simple object
144
166M
  } else {
145
166M
    buf1.copy(obj);
146
166M
    shift();
147
166M
  }
148
149
172M
  return obj;
150
172M
}
151
152
Stream *Parser::makeStream(Object *dict, Guchar *fileKey,
153
         CryptAlgorithm encAlgorithm, int keyLength,
154
111k
         int objNum, int objGen, int recursion) {
155
  // get stream start position
156
111k
  lexer->skipToNextLine();
157
111k
  Stream *curStr = lexer->getStream();
158
111k
  if (!curStr) {
159
3.19k
    return NULL;
160
3.19k
  }
161
108k
  GFileOffset pos = curStr->getPos();
162
163
108k
  GBool haveLength = gFalse;
164
108k
  GFileOffset length = 0;
165
108k
  GFileOffset endPos;
166
167
  // check for length in damaged file
168
108k
  if (xref && xref->getStreamEnd(pos, &endPos)) {
169
55.2k
    length = endPos - pos;
170
55.2k
    haveLength = gTrue;
171
172
  // get length from the stream object
173
55.2k
  } else {
174
53.1k
    Object obj;
175
53.1k
    dict->dictLookup("Length", &obj, recursion);
176
53.1k
    if (obj.isInt()) {
177
32.0k
      length = (GFileOffset)(Guint)obj.getInt();
178
32.0k
      haveLength = gTrue;
179
32.0k
    } else {
180
21.1k
      error(errSyntaxError, getPos(),
181
21.1k
      "Missing or invalid 'Length' attribute in stream");
182
21.1k
    }
183
53.1k
    obj.free();
184
53.1k
  }
185
186
  // in badly damaged PDF files, we can run off the end of the input
187
  // stream immediately after the "stream" token
188
108k
  if (!lexer->getStream()) {
189
0
    return NULL;
190
0
  }
191
192
  // copy the base stream (Lexer will free stream objects when it gets
193
  // to end of stream -- which can happen in the shift() calls below)
194
108k
  BaseStream *baseStr =
195
108k
      (BaseStream *)lexer->getStream()->getBaseStream()->copy();
196
197
  // 'Length' attribute is missing -- search for 'endstream'
198
108k
  if (!haveLength) {
199
21.1k
    GBool foundEndstream = gFalse;
200
21.1k
    char endstreamBuf[8];
201
21.1k
    if ((curStr = lexer->getStream())) {
202
21.1k
      int c;
203
7.14M
      while ((c = curStr->getChar()) != EOF) {
204
7.14M
  if (c == 'e' &&
205
244k
      curStr->getBlock(endstreamBuf, 8) == 8 &&
206
242k
      !memcmp(endstreamBuf, "ndstream", 8)) {
207
15.7k
    length = curStr->getPos() - 9 - pos;
208
15.7k
    foundEndstream = gTrue;
209
15.7k
    break;
210
15.7k
  }
211
7.14M
      }
212
21.1k
    }
213
21.1k
    if (!foundEndstream) {
214
5.40k
      error(errSyntaxError, getPos(), "Couldn't find 'endstream' for stream");
215
5.40k
      delete baseStr;
216
5.40k
      return NULL;
217
5.40k
    }
218
21.1k
  }
219
220
  // make new base stream
221
102k
  Stream *str = baseStr->makeSubStream(pos, gTrue, length, dict);
222
223
  // look for the 'endstream' marker
224
102k
  if (haveLength) {
225
    // skip over stream data
226
87.2k
    lexer->setPos(pos + length);
227
228
    // check for 'endstream'
229
    // NB: we never reuse the Parser object to parse objects after a
230
    // stream, and we could (if the PDF file is damaged) be in the
231
    // middle of binary data at this point, so we check the stream
232
    // data directly for 'endstream', rather than calling shift() to
233
    // parse objects
234
87.2k
    GBool foundEndstream = gFalse;
235
87.2k
    char endstreamBuf[8];
236
87.2k
    if ((curStr = lexer->getStream())) {
237
      // skip up to 100 whitespace chars
238
87.2k
      int c;
239
206k
      for (int i = 0; i < 100; ++i) {
240
205k
  c = curStr->getChar();
241
205k
  if (!Lexer::isSpace(c)) {
242
86.1k
    break;
243
86.1k
  }
244
205k
      }
245
87.2k
      if (c == 'e') {
246
57.7k
  if (curStr->getBlock(endstreamBuf, 8) == 8 &&
247
57.4k
      !memcmp(endstreamBuf, "ndstream", 8)) {
248
55.4k
    foundEndstream = gTrue;
249
55.4k
  }
250
57.7k
      }
251
87.2k
    }
252
87.2k
    if (!foundEndstream) {
253
31.7k
      error(errSyntaxError, getPos(), "Missing 'endstream'");
254
      // kludge for broken PDF files: just add 5k to the length, and
255
      // hope it's enough
256
      // (dict is now owned by str, so we need to copy it before deleting str)
257
31.7k
      Object obj;
258
31.7k
      dict->copy(&obj);
259
31.7k
      delete str;
260
31.7k
      length += 5000;
261
31.7k
      str = baseStr->makeSubStream(pos, gTrue, length, &obj);
262
31.7k
    }
263
87.2k
  }
264
265
  // free the copied base stream
266
102k
  delete baseStr;
267
268
  // handle decryption
269
102k
  if (fileKey) {
270
    // the 'Crypt' filter is used to mark unencrypted metadata streams
271
    //~ this should also check for an empty DecodeParams entry
272
7.17k
    GBool encrypted = gTrue;
273
7.17k
    Object obj;
274
7.17k
    dict->dictLookup("Filter", &obj, recursion);
275
7.17k
    if (obj.isName("Crypt")) {
276
71
      encrypted = gFalse;
277
7.10k
    } else if (obj.isArray() && obj.arrayGetLength() >= 1) {
278
1.25k
      Object obj2;
279
1.25k
      if (obj.arrayGet(0, &obj2)->isName("Crypt")) {
280
0
  encrypted = gFalse;
281
0
      }
282
1.25k
      obj2.free();
283
1.25k
    }
284
7.17k
    obj.free();
285
7.17k
    if (encrypted) {
286
7.10k
      str = new DecryptStream(str, fileKey, encAlgorithm, keyLength,
287
7.10k
            objNum, objGen);
288
7.10k
    }
289
7.17k
  }
290
291
  // get filters
292
102k
  str = str->addFilters(dict, recursion);
293
294
102k
  return str;
295
108k
}
296
297
190M
void Parser::shift() {
298
190M
  if (inlineImg > 0) {
299
533k
    if (inlineImg < 2) {
300
296k
      ++inlineImg;
301
296k
    } else {
302
      // in a damaged content stream, if 'ID' shows up in the middle
303
      // of a dictionary, we need to reset
304
237k
      inlineImg = 0;
305
237k
    }
306
190M
  } else if (buf2.isCmd("ID")) {
307
296k
    lexer->skipChar();    // skip char after 'ID' command
308
296k
    inlineImg = 1;
309
296k
  }
310
190M
  buf1.free();
311
190M
  buf1 = buf2;
312
190M
  if (inlineImg > 0)    // don't buffer inline image data
313
592k
    buf2.initNull();
314
190M
  else
315
190M
    lexer->getObj(&buf2);
316
190M
}