diff options
| author | Miklos Vajna <vmiklos@collabora.co.uk> | 2016-11-08 15:56:03 +0100 |
|---|---|---|
| committer | Miklos Vajna <vmiklos@collabora.co.uk> | 2016-11-08 16:47:58 +0000 |
| commit | 5d34de5f276cf19f6c8702c8bce093470969cd52 (patch) | |
| tree | 656b06a2884a1448bdd80740c1dada48e72b5592 | |
| parent | 3f213154e2d4d9447fff161624196597bb59b9ed (diff) | |
xmlsecurity PDF verify: fix handling of xref stream free objects
In case our xref table doesn't have an entry for "free" object types,
then the table size won't provide a valid id for a next object. That
resulted in creating all new objects with the same ID.
With this, our verifier at least can see the new signature when
appending one to a signed PDF 1.6 file.
Change-Id: Iac39a400706cfcd23dd814d2b81cb8b950c69fc6
Reviewed-on: https://gerrit.libreoffice.org/30704
Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Miklos Vajna <vmiklos@collabora.co.uk>
| -rw-r--r-- | xmlsecurity/inc/pdfio/pdfdocument.hxx | 2 | ||||
| -rw-r--r-- | xmlsecurity/source/pdfio/pdfdocument.cxx | 17 |
2 files changed, 16 insertions, 3 deletions
diff --git a/xmlsecurity/inc/pdfio/pdfdocument.hxx b/xmlsecurity/inc/pdfio/pdfdocument.hxx index e733822de38a..d90fdf50245b 100644 --- a/xmlsecurity/inc/pdfio/pdfdocument.hxx +++ b/xmlsecurity/inc/pdfio/pdfdocument.hxx @@ -53,6 +53,8 @@ enum class TokenizeMode /// The type column of an entry in a cross-reference stream. enum class XRefEntryType { + /// xref "f" or xref stream "0". + FREE, /// xref "n" or xref stream "1". NOT_COMPRESSED, /// xref stream "2. diff --git a/xmlsecurity/source/pdfio/pdfdocument.cxx b/xmlsecurity/source/pdfio/pdfdocument.cxx index ff8aac99cda9..2af2da8f164f 100644 --- a/xmlsecurity/source/pdfio/pdfdocument.cxx +++ b/xmlsecurity/source/pdfio/pdfdocument.cxx @@ -1304,13 +1304,24 @@ void PDFDocument::ReadXRefStream(SvStream& rStream) nGenerationNumber = (nGenerationNumber << 8) + nCh; } - // "n" entry of the xref table - if (nType == 1 || nType == 2) + // Ignore invalid nType. + if (nType <= 2) { if (m_aXRef.find(nIndex) == m_aXRef.end()) { XRefEntry aEntry; - aEntry.m_eType = nType == 1 ? XRefEntryType::NOT_COMPRESSED : XRefEntryType::COMPRESSED; + switch (nType) + { + case 0: + aEntry.m_eType = XRefEntryType::FREE; + break; + case 1: + aEntry.m_eType = XRefEntryType::NOT_COMPRESSED; + break; + case 2: + aEntry.m_eType = XRefEntryType::COMPRESSED; + break; + } aEntry.m_nOffset = nStreamOffset; aEntry.m_nGenerationNumber = nGenerationNumber; m_aXRef[nIndex] = aEntry; |