summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--vcl/source/filter/ipdf/pdfdocument.cxx9
-rw-r--r--xmlsecurity/qa/unit/pdfsigning/data/tdf114460.pdfbin0 -> 12669 bytes
-rw-r--r--xmlsecurity/qa/unit/pdfsigning/pdfsigning.cxx2
3 files changed, 11 insertions, 0 deletions
diff --git a/vcl/source/filter/ipdf/pdfdocument.cxx b/vcl/source/filter/ipdf/pdfdocument.cxx
index 6921683d5054..af1eea1f57cf 100644
--- a/vcl/source/filter/ipdf/pdfdocument.cxx
+++ b/vcl/source/filter/ipdf/pdfdocument.cxx
@@ -2015,11 +2015,20 @@ bool PDFLiteralStringElement::Read(SvStream& rStream)
nPrevCh = ch;
rStream.ReadChar(ch);
+ // Start with 1 nesting level as we read a '(' above already.
+ int nDepth = 1;
OStringBuffer aBuf;
while (!rStream.eof())
{
+ if (ch == '(' && nPrevCh != '\\')
+ ++nDepth;
+
if (ch == ')' && nPrevCh != '\\')
+ --nDepth;
+
+ if (nDepth == 0)
{
+ // ')' of the outermost '(' is reached.
m_aValue = aBuf.makeStringAndClear();
SAL_INFO("vcl.filter", "PDFLiteralStringElement::Read: m_aValue is '" << m_aValue << "'");
return true;
diff --git a/xmlsecurity/qa/unit/pdfsigning/data/tdf114460.pdf b/xmlsecurity/qa/unit/pdfsigning/data/tdf114460.pdf
new file mode 100644
index 000000000000..a736e5bb90cd
--- /dev/null
+++ b/xmlsecurity/qa/unit/pdfsigning/data/tdf114460.pdf
Binary files differ
diff --git a/xmlsecurity/qa/unit/pdfsigning/pdfsigning.cxx b/xmlsecurity/qa/unit/pdfsigning/pdfsigning.cxx
index b36d926a4a34..cb7fd4cfe945 100644
--- a/xmlsecurity/qa/unit/pdfsigning/pdfsigning.cxx
+++ b/xmlsecurity/qa/unit/pdfsigning/pdfsigning.cxx
@@ -450,6 +450,8 @@ void PDFSigningTest::testTokenize()
// File that's intentionally smaller than 1024 bytes.
"small.pdf",
"tdf107149.pdf",
+ // Nested parentheses were not handled.
+ "tdf114460.pdf",
};
for (const auto& rName : aNames)