[Libreoffice-commits] core.git: xmlsecurity/inc xmlsecurity/source

[Miklos Vajna]

 xmlsecurity/inc/pdfio/pdfdocument.hxx    |    2 ++
 xmlsecurity/source/pdfio/pdfdocument.cxx |   17 ++++++++++++++---
 2 files changed, 16 insertions(+), 3 deletions(-)

New commits:
commit 5d34de5f276cf19f6c8702c8bce093470969cd52
Author: Miklos Vajna <vmiklos at collabora.co.uk>
Date:   Tue Nov 8 15:56:03 2016 +0100

    xmlsecurity PDF verify: fix handling of xref stream free objects
    
    In case our xref table doesn't have an entry for "free" object types,
    then the table size won't provide a valid id for a next object. That
    resulted in creating all new objects with the same ID.
    
    With this, our verifier at least can see the new signature when
    appending one to a signed PDF 1.6 file.
    
    Change-Id: Iac39a400706cfcd23dd814d2b81cb8b950c69fc6
    Reviewed-on: https://gerrit.libreoffice.org/30704
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Miklos Vajna <vmiklos at collabora.co.uk>

diff --git a/xmlsecurity/inc/pdfio/pdfdocument.hxx b/xmlsecurity/inc/pdfio/pdfdocument.hxx
index e733822..d90fdf5 100644
--- a/xmlsecurity/inc/pdfio/pdfdocument.hxx
+++ b/xmlsecurity/inc/pdfio/pdfdocument.hxx
@@ -53,6 +53,8 @@ enum class TokenizeMode
 /// The type column of an entry in a cross-reference stream.
 enum class XRefEntryType
 {
+    /// xref "f" or xref stream "0".
+    FREE,
     /// xref "n" or xref stream "1".
     NOT_COMPRESSED,
     /// xref stream "2.
diff --git a/xmlsecurity/source/pdfio/pdfdocument.cxx b/xmlsecurity/source/pdfio/pdfdocument.cxx
index ff8aac9..2af2da8 100644
--- a/xmlsecurity/source/pdfio/pdfdocument.cxx
+++ b/xmlsecurity/source/pdfio/pdfdocument.cxx
@@ -1304,13 +1304,24 @@ void PDFDocument::ReadXRefStream(SvStream& rStream)
             nGenerationNumber = (nGenerationNumber << 8) + nCh;
         }
 
-        // "n" entry of the xref table
-        if (nType == 1 || nType == 2)
+        // Ignore invalid nType.
+        if (nType <= 2)
         {
             if (m_aXRef.find(nIndex) == m_aXRef.end())
             {
                 XRefEntry aEntry;
-                aEntry.m_eType = nType == 1 ? XRefEntryType::NOT_COMPRESSED : XRefEntryType::COMPRESSED;
+                switch (nType)
+                {
+                case 0:
+                    aEntry.m_eType = XRefEntryType::FREE;
+                    break;
+                case 1:
+                    aEntry.m_eType = XRefEntryType::NOT_COMPRESSED;
+                    break;
+                case 2:
+                    aEntry.m_eType = XRefEntryType::COMPRESSED;
+                    break;
+                }
                 aEntry.m_nOffset = nStreamOffset;
                 aEntry.m_nGenerationNumber = nGenerationNumber;
                 m_aXRef[nIndex] = aEntry;