Coverage Report

Created: 2026-07-12 06:46

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/xpdf-4.06/xpdf/Parser.cc
Line
Count
Source
1
//========================================================================
2
//
3
// Parser.cc
4
//
5
// Copyright 1996-2003 Glyph & Cog, LLC
6
//
7
//========================================================================
8
9
#include <aconf.h>
10
11
#include <stddef.h>
12
#include <string.h>
13
#include "gmempp.h"
14
#include "Object.h"
15
#include "Array.h"
16
#include "Dict.h"
17
#include "Decrypt.h"
18
#include "Parser.h"
19
#include "XRef.h"
20
#include "Error.h"
21
22
560k
Parser::Parser(XRef *xrefA, Lexer *lexerA, GBool allowStreamsA) {
23
560k
  xref = xrefA;
24
560k
  lexer = lexerA;
25
560k
  inlineImg = 0;
26
560k
  allowStreams = allowStreamsA;
27
560k
  lexer->getObj(&buf1);
28
560k
  lexer->getObj(&buf2);
29
560k
}
30
31
560k
Parser::~Parser() {
32
560k
  buf1.free();
33
560k
  buf2.free();
34
560k
  delete lexer;
35
560k
}
36
37
Object *Parser::getObj(Object *obj, GBool simpleOnly,
38
           Guchar *fileKey,
39
           CryptAlgorithm encAlgorithm, int keyLength,
40
194M
           int objNum, int objGen, int recursion) {
41
194M
  char *key;
42
194M
  Stream *str;
43
194M
  Object obj2;
44
194M
  int num;
45
194M
  DecryptStream *decrypt;
46
194M
  GString *s, *s2;
47
194M
  int c;
48
49
  // refill buffer after inline image data
50
194M
  if (inlineImg == 2) {
51
59.7k
    buf1.free();
52
59.7k
    buf2.free();
53
59.7k
    lexer->getObj(&buf1);
54
59.7k
    lexer->getObj(&buf2);
55
59.7k
    inlineImg = 0;
56
59.7k
  }
57
58
  // array
59
194M
  if (!simpleOnly && recursion < objectRecursionLimit && buf1.isCmd("[")) {
60
1.43M
    shift();
61
1.43M
    obj->initArray(xref);
62
32.6M
    while (!buf1.isCmd("]") && !buf1.isEOF())
63
31.1M
      obj->arrayAdd(getObj(&obj2, gFalse, fileKey, encAlgorithm, keyLength,
64
31.1M
         objNum, objGen, recursion + 1));
65
1.43M
    if (buf1.isEOF())
66
1.06M
      error(errSyntaxError, getPos(), "End of file inside array");
67
1.43M
    shift();
68
69
  // dictionary or stream
70
192M
  } else if (!simpleOnly && recursion < objectRecursionLimit &&
71
48.0M
       buf1.isCmd("<<")) {
72
623k
    shift();
73
623k
    obj->initDict(xref);
74
5.92M
    while (!buf1.isCmd(">>") && !buf1.isEOF()) {
75
5.31M
      if (!buf1.isName()) {
76
2.74M
  error(errSyntaxError, getPos(),
77
2.74M
        "Dictionary key must be a name object");
78
2.74M
  shift();
79
2.74M
      } else {
80
2.56M
  key = copyString(buf1.getName());
81
2.56M
  shift();
82
2.56M
  if (buf1.isEOF() || buf1.isError()) {
83
11.3k
    gfree(key);
84
11.3k
    break;
85
11.3k
  }
86
2.55M
  obj->dictAdd(key, getObj(&obj2, gFalse,
87
2.55M
         fileKey, encAlgorithm, keyLength,
88
2.55M
         objNum, objGen, recursion + 1));
89
2.55M
      }
90
5.31M
    }
91
623k
    if (buf1.isEOF())
92
42.6k
      error(errSyntaxError, getPos(), "End of file inside dictionary");
93
    // stream objects are not allowed inside content streams or
94
    // object streams
95
623k
    if (allowStreams && buf2.isCmd("stream")) {
96
148k
      if ((str = makeStream(obj, fileKey, encAlgorithm, keyLength,
97
148k
          objNum, objGen, recursion + 1))) {
98
139k
  obj->initStream(str);
99
139k
      } else {
100
9.33k
  obj->free();
101
9.33k
  obj->initError();
102
9.33k
      }
103
475k
    } else {
104
475k
      shift();
105
475k
    }
106
107
  // indirect reference or integer
108
192M
  } else if (buf1.isInt()) {
109
22.8M
    num = buf1.getInt();
110
22.8M
    shift();
111
22.8M
    if (buf1.isInt() && buf2.isCmd("R")) {
112
788k
      int gen = buf1.getInt();
113
788k
      if (num >= 0 && gen >= 0) {
114
786k
  obj->initRef(num, gen);
115
786k
      } else {
116
1.26k
  error(errSyntaxError, getPos(),
117
1.26k
        "Negative number or generation in indirect reference");
118
1.26k
  obj->initError();
119
1.26k
      }
120
788k
      shift();
121
788k
      shift();
122
22.0M
    } else {
123
22.0M
      obj->initInt(num);
124
22.0M
    }
125
126
  // string
127
169M
  } else if (buf1.isString() && fileKey) {
128
8.76k
    s = buf1.getString();
129
8.76k
    s2 = new GString();
130
8.76k
    obj2.initNull();
131
8.76k
    decrypt = new DecryptStream(new MemStream(s->getCString(), 0,
132
8.76k
                s->getLength(), &obj2),
133
8.76k
        fileKey, encAlgorithm, keyLength,
134
8.76k
        objNum, objGen);
135
8.76k
    decrypt->reset();
136
302k
    while ((c = decrypt->getChar()) != EOF) {
137
293k
      s2->append((char)c);
138
293k
    }
139
8.76k
    delete decrypt;
140
8.76k
    obj->initString(s2);
141
8.76k
    shift();
142
143
  // simple object
144
169M
  } else {
145
169M
    buf1.copy(obj);
146
169M
    shift();
147
169M
  }
148
149
194M
  return obj;
150
194M
}
151
152
Stream *Parser::makeStream(Object *dict, Guchar *fileKey,
153
         CryptAlgorithm encAlgorithm, int keyLength,
154
148k
         int objNum, int objGen, int recursion) {
155
  // get stream start position
156
148k
  lexer->skipToNextLine();
157
148k
  Stream *curStr = lexer->getStream();
158
148k
  if (!curStr) {
159
839
    return NULL;
160
839
  }
161
147k
  GFileOffset pos = curStr->getPos();
162
163
147k
  GBool haveLength = gFalse;
164
147k
  GFileOffset length = 0;
165
147k
  GFileOffset endPos;
166
167
  // check for length in damaged file
168
147k
  if (xref && xref->getStreamEnd(pos, &endPos)) {
169
110k
    length = endPos - pos;
170
110k
    haveLength = gTrue;
171
172
  // get length from the stream object
173
110k
  } else {
174
37.5k
    Object obj;
175
37.5k
    dict->dictLookup("Length", &obj, recursion);
176
37.5k
    if (obj.isInt()) {
177
27.1k
      length = (GFileOffset)(Guint)obj.getInt();
178
27.1k
      haveLength = gTrue;
179
27.1k
    } else {
180
10.4k
      error(errSyntaxError, getPos(),
181
10.4k
      "Missing or invalid 'Length' attribute in stream");
182
10.4k
    }
183
37.5k
    obj.free();
184
37.5k
  }
185
186
  // in badly damaged PDF files, we can run off the end of the input
187
  // stream immediately after the "stream" token
188
147k
  if (!lexer->getStream()) {
189
0
    return NULL;
190
0
  }
191
192
  // copy the base stream (Lexer will free stream objects when it gets
193
  // to end of stream -- which can happen in the shift() calls below)
194
147k
  BaseStream *baseStr =
195
147k
      (BaseStream *)lexer->getStream()->getBaseStream()->copy();
196
197
  // 'Length' attribute is missing -- search for 'endstream'
198
147k
  if (!haveLength) {
199
10.4k
    GBool foundEndstream = gFalse;
200
10.4k
    char endstreamBuf[8];
201
10.4k
    if ((curStr = lexer->getStream())) {
202
10.4k
      int c;
203
5.95M
      while ((c = curStr->getChar()) != EOF) {
204
5.94M
  if (c == 'e' &&
205
140k
      curStr->getBlock(endstreamBuf, 8) == 8 &&
206
139k
      !memcmp(endstreamBuf, "ndstream", 8)) {
207
1.95k
    length = curStr->getPos() - 9 - pos;
208
1.95k
    foundEndstream = gTrue;
209
1.95k
    break;
210
1.95k
  }
211
5.94M
      }
212
10.4k
    }
213
10.4k
    if (!foundEndstream) {
214
8.49k
      error(errSyntaxError, getPos(), "Couldn't find 'endstream' for stream");
215
8.49k
      delete baseStr;
216
8.49k
      return NULL;
217
8.49k
    }
218
10.4k
  }
219
220
  // make new base stream
221
139k
  Stream *str = baseStr->makeSubStream(pos, gTrue, length, dict);
222
223
  // look for the 'endstream' marker
224
139k
  if (haveLength) {
225
    // skip over stream data
226
137k
    lexer->setPos(pos + length);
227
228
    // check for 'endstream'
229
    // NB: we never reuse the Parser object to parse objects after a
230
    // stream, and we could (if the PDF file is damaged) be in the
231
    // middle of binary data at this point, so we check the stream
232
    // data directly for 'endstream', rather than calling shift() to
233
    // parse objects
234
137k
    GBool foundEndstream = gFalse;
235
137k
    char endstreamBuf[8];
236
137k
    if ((curStr = lexer->getStream())) {
237
      // skip up to 100 whitespace chars
238
137k
      int c;
239
148k
      for (int i = 0; i < 100; ++i) {
240
148k
  c = curStr->getChar();
241
148k
  if (!Lexer::isSpace(c)) {
242
137k
    break;
243
137k
  }
244
148k
      }
245
137k
      if (c == 'e') {
246
113k
  if (curStr->getBlock(endstreamBuf, 8) == 8 &&
247
113k
      !memcmp(endstreamBuf, "ndstream", 8)) {
248
111k
    foundEndstream = gTrue;
249
111k
  }
250
113k
      }
251
137k
    }
252
137k
    if (!foundEndstream) {
253
25.4k
      error(errSyntaxError, getPos(), "Missing 'endstream'");
254
      // kludge for broken PDF files: just add 5k to the length, and
255
      // hope it's enough
256
      // (dict is now owned by str, so we need to copy it before deleting str)
257
25.4k
      Object obj;
258
25.4k
      dict->copy(&obj);
259
25.4k
      delete str;
260
25.4k
      length += 5000;
261
25.4k
      str = baseStr->makeSubStream(pos, gTrue, length, &obj);
262
25.4k
    }
263
137k
  }
264
265
  // free the copied base stream
266
139k
  delete baseStr;
267
268
  // handle decryption
269
139k
  if (fileKey) {
270
    // the 'Crypt' filter is used to mark unencrypted metadata streams
271
    //~ this should also check for an empty DecodeParams entry
272
2.12k
    GBool encrypted = gTrue;
273
2.12k
    Object obj;
274
2.12k
    dict->dictLookup("Filter", &obj, recursion);
275
2.12k
    if (obj.isName("Crypt")) {
276
0
      encrypted = gFalse;
277
2.12k
    } else if (obj.isArray() && obj.arrayGetLength() >= 1) {
278
8
      Object obj2;
279
8
      if (obj.arrayGet(0, &obj2)->isName("Crypt")) {
280
0
  encrypted = gFalse;
281
0
      }
282
8
      obj2.free();
283
8
    }
284
2.12k
    obj.free();
285
2.12k
    if (encrypted) {
286
2.12k
      str = new DecryptStream(str, fileKey, encAlgorithm, keyLength,
287
2.12k
            objNum, objGen);
288
2.12k
    }
289
2.12k
  }
290
291
  // get filters
292
139k
  str = str->addFilters(dict, recursion);
293
294
139k
  return str;
295
147k
}
296
297
203M
void Parser::shift() {
298
203M
  if (inlineImg > 0) {
299
83.1k
    if (inlineImg < 2) {
300
71.4k
      ++inlineImg;
301
71.4k
    } else {
302
      // in a damaged content stream, if 'ID' shows up in the middle
303
      // of a dictionary, we need to reset
304
11.6k
      inlineImg = 0;
305
11.6k
    }
306
203M
  } else if (buf2.isCmd("ID")) {
307
71.4k
    lexer->skipChar();    // skip char after 'ID' command
308
71.4k
    inlineImg = 1;
309
71.4k
  }
310
203M
  buf1.free();
311
203M
  buf1 = buf2;
312
203M
  if (inlineImg > 0)    // don't buffer inline image data
313
142k
    buf2.initNull();
314
203M
  else
315
203M
    lexer->getObj(&buf2);
316
203M
}