[poppler] poppler/PDFDoc.cc poppler/PDFDoc.h poppler/XRef.cc poppler/XRef.h

[GitLab Mirror]

 poppler/PDFDoc.cc |   11 +++--------
 poppler/PDFDoc.h  |    7 -------
 poppler/XRef.cc   |   17 +++++++++--------
 poppler/XRef.h    |    5 +++--
 4 files changed, 15 insertions(+), 25 deletions(-)

New commits:
commit 8ef16f82b1f0f085d9501978bb85a792f46d8ab2
Author: Albert Astals Cid <aacid at kde.org>
Date:   Sun Nov 29 19:41:45 2020 +0100

    Be more strict in XRef::createDocInfoIfNeeded
    
    Info needs to be a Dict and an indirect object in the trailer dict
    
    oss-fuzz/28057

diff --git a/poppler/PDFDoc.cc b/poppler/PDFDoc.cc
index 1fe9af29..bc03cdb1 100644
--- a/poppler/PDFDoc.cc
+++ b/poppler/PDFDoc.cc
@@ -732,12 +732,6 @@ bool PDFDoc::isLinearized(bool tryingToReconstruct)
     }
 }
 
-void PDFDoc::setDocInfoModified(Object *infoObj)
-{
-    Object infoObjRef = getDocInfoNF();
-    xref->setModifiedObject(infoObj, infoObjRef.getRef());
-}
-
 void PDFDoc::setDocInfoStringEntry(const char *key, GooString *value)
 {
     bool removeEntry = !value || value->getLength() == 0 || value->hasJustUnicodeMarker();
@@ -751,7 +745,8 @@ void PDFDoc::setDocInfoStringEntry(const char *key, GooString *value)
         return;
     }
 
-    infoObj = createDocInfoIfNoneExists();
+    Ref infoObjRef;
+    infoObj = xref->createDocInfoIfNeeded(&infoObjRef);
     if (removeEntry) {
         infoObj.dictSet(key, Object(objNull));
     } else {
@@ -762,7 +757,7 @@ void PDFDoc::setDocInfoStringEntry(const char *key, GooString *value)
         // Info dictionary is empty. Remove it altogether.
         removeDocInfo();
     } else {
-        setDocInfoModified(&infoObj);
+        xref->setModifiedObject(&infoObj, infoObjRef);
     }
 }
 
diff --git a/poppler/PDFDoc.h b/poppler/PDFDoc.h
index c25abff8..0faef013 100644
--- a/poppler/PDFDoc.h
+++ b/poppler/PDFDoc.h
@@ -238,10 +238,6 @@ public:
     Object getDocInfo() { return xref->getDocInfo(); }
     Object getDocInfoNF() { return xref->getDocInfoNF(); }
 
-    // Create and return the document's Info dictionary if none exists.
-    // Otherwise return the existing one.
-    Object createDocInfoIfNoneExists() { return xref->createDocInfoIfNoneExists(); }
-
     // Remove the document's Info dictionary and update the trailer dictionary.
     void removeDocInfo() { xref->removeDocInfo(); }
 
@@ -360,9 +356,6 @@ private:
     Goffset getMainXRefEntriesOffset(bool tryingToReconstruct = false);
     long long strToLongLong(const char *s);
 
-    // Mark the document's Info dictionary as modified.
-    void setDocInfoModified(Object *infoObj);
-
     const GooString *fileName;
 #ifdef _WIN32
     wchar_t *fileNameU;
diff --git a/poppler/XRef.cc b/poppler/XRef.cc
index 30a1d1b1..c672e45c 100644
--- a/poppler/XRef.cc
+++ b/poppler/XRef.cc
@@ -1223,20 +1223,21 @@ Object XRef::getDocInfoNF()
     return trailerDict.dictLookupNF("Info").copy();
 }
 
-Object XRef::createDocInfoIfNoneExists()
+Object XRef::createDocInfoIfNeeded(Ref *ref)
 {
-    Object obj = getDocInfo();
+    Object obj = trailerDict.getDict()->lookup("Info", ref);
+    getDocInfo();
 
-    if (obj.isDict()) {
+    if (obj.isDict() && *ref != Ref::INVALID()) {
+        // Info is valid if it's a dict and to pointed by an indirect reference
         return obj;
-    } else if (!obj.isNull()) {
-        // DocInfo exists, but isn't a dictionary (doesn't comply with the PDF reference)
-        removeDocInfo();
     }
 
+    removeDocInfo();
+
     obj = Object(new Dict(this));
-    const Ref ref = addIndirectObject(&obj);
-    trailerDict.dictSet("Info", Object(ref));
+    *ref = addIndirectObject(&obj);
+    trailerDict.dictSet("Info", Object(*ref));
 
     return obj;
 }
diff --git a/poppler/XRef.h b/poppler/XRef.h
index 7418458b..d697ad83 100644
--- a/poppler/XRef.h
+++ b/poppler/XRef.h
@@ -155,9 +155,10 @@ public:
     Object getDocInfo();
     Object getDocInfoNF();
 
-    // Create and return the document's Info dictionary if none exists.
+    // Create and return the document's Info dictionary if needed.
     // Otherwise return the existing one.
-    Object createDocInfoIfNoneExists();
+    // Returns in the given parameter the Ref the Info is in
+    Object createDocInfoIfNeeded(Ref *ref);
 
     // Remove the document's Info dictionary and update the trailer dictionary.
     void removeDocInfo();