[Poppler-bugs] [Bug 99416] Sign PDF with digital signature

[bugzilla-daemon at freedesktop.org]

https://bugs.freedesktop.org/show_bug.cgi?id=99416

--- Comment #15 from Adrian Johnson <ajohnson at redneon.com> ---
+  char buf[24];
+  time_t now = time(nullptr);
+  size_t size = strftime(buf, 24, "D:%Y%m%d%H%M%S%z", localtime(&now));
+  if (size >= 2 && size < 22)
+  {
+    // put timezone info into single quotes
+    buf[size] = buf[size-1];
+    buf[size-1] = buf[size-2];
+    buf[size-2] = '\'';
+    buf[++size] = '\'';
+    buf[++size] = '\0';
+    GooString gTime(buf, size);
+    vObj.dictAdd(copyString("M"), Object(gTime.copy()));
+  }

PDF date format uses a single quote to separate the time zone hour and minute,
not enclose the minutes. strftime "%z" on windows returns the timezone name,
not the offset.

We already have a time to PDF date function: DateInfo::timeToDateString(). It
doesn't currently add the timezone but I'll fix that that when I submit some
win32 patches I am working on.

FormWidgetSignature::prepareSignature is writing the entire PDF to memory. It
would be better to write it to a temp file then search it on disk. I don't like
the way you search the PDF file for matching strings. It could end up matching
some random data in another stream. It would be better to get the offset of the
dict object you want to search and start the search for there for up to some
reasonable maximum.

eg

XRefEntry *entry = doc->getXRef()->getEntry(ref);
Goffset objOffset = entry->offset;

Also, don't search for %%EOF to get the file size. Use
doc->getBaseStream()->getLength() or Gfseek(f, 0, SEEK_END), Gftell().

I don't fully understand what signDocument() and prepareSignature() are doing.
Which means some comments would be helpful. It appears you are saving the PDF,
computing the signature, updating the signature object, then saving the PDF
again. This assumes that the second save will produce an identical file except
for the updated signature. I'm not sure if we can assume this will always be
true.

My naive understanding is that we could just create a signature dict with a
dummy signature and offsets (large enough for any size, XRef allows up to 10
digits), save the PDF, compute the signature, and overwrite the dummy signature
and offsets in the disk file with the real signature. What am I missing?

-- 
You are receiving this mail because:
You are on the CC list for the bug.
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.freedesktop.org/archives/poppler-bugs/attachments/20170828/7764e423/attachment.html>