From 2d3e8bbb4c883c228f897f1ab670ab250078cc8b Mon Sep 17 00:00:00 2001
From: notmasteryet <async.processingjs@yahoo.com>
Date: Mon, 26 Sep 2011 21:17:16 -0500
Subject: [PATCH] Better 'EI' matching (ref #536)

---
 pdf.js | 37 ++++++++++++++++++++++++++++++-------
 1 file changed, 30 insertions(+), 7 deletions(-)

diff --git a/pdf.js b/pdf.js
index 449fd9c16..ba05dd1ff 100644
--- a/pdf.js
+++ b/pdf.js
@@ -2832,14 +2832,37 @@ var Parser = (function parserParser() {
       // parse image stream
       var startPos = stream.pos;
 
-      var c1 = stream.getChar();
-      var c2 = stream.getChar();
-      while (!(c1 == 'E' && c2 == 'I') && c2 != null) {
-        c1 = c2;
-        c2 = stream.getChar();
+      // searching for the /\sEI\s/
+      var state = 0, ch;
+      while (state != 4 && (ch = stream.getByte()) != null) {
+        switch (ch) {
+          case 0x20:
+          case 0x0D:
+          case 0x0A:
+            state = state === 3 ? 4 : 1;
+            break;
+          case 0x45:
+            state = state === 1 ? 2 : 0;
+            break;
+          case 0x49:
+            state = state === 2 ? 3 : 0;
+            break;
+          default:
+            state = 0;
+            break;
+        }
       }
 
-      var length = (stream.pos - 2) - startPos;
+      // TODO improve the small images performance to remove the limit
+      var inlineImgLimit = 500;
+      if (++this.inlineImg >= inlineImgLimit) {
+        if (this.inlineImg === inlineImgLimit)
+          warn('Too many inline images');
+        this.shift();
+        return null;
+      }
+
+      var length = (stream.pos - 4) - startPos;
       var imageStream = stream.makeSubStream(startPos, length, dict);
       if (cipherTransform)
         imageStream = cipherTransform.createStream(imageStream);
@@ -4377,7 +4400,7 @@ var PartialEvaluator = (function partialEvaluator() {
           fnArray.push(fn);
           argsArray.push(args);
           args = [];
-        } else {
+        } else if (obj != null) {
           assertWellFormed(args.length <= 33, 'Too many arguments');
           args.push(obj);
         }