diff --git a/src/core/xref.js b/src/core/xref.js index 37256085e..568c44cad 100644 --- a/src/core/xref.js +++ b/src/core/xref.js @@ -323,17 +323,29 @@ class XRef { offset = 0, generation = 0; for (j = 0; j < typeFieldWidth; ++j) { - type = (type << 8) | stream.getByte(); + const typeByte = stream.getByte(); + if (typeByte === -1) { + throw new FormatError("Invalid XRef byteWidths 'type'."); + } + type = (type << 8) | typeByte; } // if type field is absent, its default value is 1 if (typeFieldWidth === 0) { type = 1; } for (j = 0; j < offsetFieldWidth; ++j) { - offset = (offset << 8) | stream.getByte(); + const offsetByte = stream.getByte(); + if (offsetByte === -1) { + throw new FormatError("Invalid XRef byteWidths 'offset'."); + } + offset = (offset << 8) | offsetByte; } for (j = 0; j < generationFieldWidth; ++j) { - generation = (generation << 8) | stream.getByte(); + const generationByte = stream.getByte(); + if (generationByte === -1) { + throw new FormatError("Invalid XRef byteWidths 'generation'."); + } + generation = (generation << 8) | generationByte; } const entry = {}; entry.offset = offset; diff --git a/test/pdfs/.gitignore b/test/pdfs/.gitignore index 1b7bd6cee..1e0488f11 100644 --- a/test/pdfs/.gitignore +++ b/test/pdfs/.gitignore @@ -488,3 +488,4 @@ !rc_annotation.pdf !issue14267.pdf !PDFBOX-4352-0.pdf +!REDHAT-1531897-0.pdf diff --git a/test/pdfs/REDHAT-1531897-0.pdf b/test/pdfs/REDHAT-1531897-0.pdf new file mode 100644 index 000000000..8978e307c Binary files /dev/null and b/test/pdfs/REDHAT-1531897-0.pdf differ diff --git a/test/unit/api_spec.js b/test/unit/api_spec.js index 9a5428bb1..f61d19a35 100644 --- a/test/unit/api_spec.js +++ b/test/unit/api_spec.js @@ -458,6 +458,26 @@ describe("api", function () { await loadingTask.destroy(); }); + + it("creates pdf doc from PDF file with bad XRef byteWidths", async function () { + // A corrupt PDF file, where the XRef /W-array have (some) bogus entries. + const loadingTask = getDocument( + buildGetDocumentParams("REDHAT-1531897-0.pdf") + ); + expect(loadingTask instanceof PDFDocumentLoadingTask).toEqual(true); + + try { + await loadingTask.promise; + + // Shouldn't get here. + expect(false).toEqual(true); + } catch (reason) { + expect(reason instanceof InvalidPDFException).toEqual(true); + expect(reason.message).toEqual("Invalid PDF structure."); + } + + await loadingTask.destroy(); + }); }); describe("PDFWorker", function () {