Fix free entry handling for cross reference v4 reading.

core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "parser_int.h"
 
 #include <set>
 #include <utility>
@@ skipping 320 matching lines @@
   if (m_V5Type[objnum] == 1) {
     return m_CrossRef[objnum];
   }
   if (m_V5Type[objnum] == 2) {
     return m_CrossRef[(int32_t)m_CrossRef[objnum]];
   }
   return 0;
 }
 
 FX_BOOL CPDF_Parser::LoadAllCrossRefV4(FX_FILESIZE xrefpos) {
-  if (!LoadCrossRefV4(xrefpos, 0, TRUE, FALSE)) {
+  if (!LoadCrossRefV4(xrefpos, 0, TRUE)) {
     return FALSE;
   }
   m_pTrailer = LoadTrailerV4();
   if (m_pTrailer == NULL) {
     return FALSE;
   }
   int32_t xrefsize = GetDirectInteger(m_pTrailer, FX_BSTRC("Size"));
   if (xrefsize <= 0 || xrefsize > (1 << 20)) {
     return FALSE;
   }
   m_CrossRef.SetSize(xrefsize);
   m_V5Type.SetSize(xrefsize);
   CFX_FileSizeArray CrossRefList, XRefStreamList;
   CrossRefList.Add(xrefpos);
   XRefStreamList.Add(GetDirectInteger(m_pTrailer, FX_BSTRC("XRefStm")));
   if (!CheckDirectType(m_pTrailer, FX_BSTRC("Prev"), PDFOBJ_NUMBER)) {
     return FALSE;
   }
   FX_FILESIZE newxrefpos = GetDirectInteger(m_pTrailer, FX_BSTRC("Prev"));
   if (newxrefpos == xrefpos) {
     return FALSE;
   }
   xrefpos = newxrefpos;
   while (xrefpos) {
     CrossRefList.InsertAt(0, xrefpos);
-    LoadCrossRefV4(xrefpos, 0, TRUE, FALSE);
+    LoadCrossRefV4(xrefpos, 0, TRUE);
     nonstd::unique_ptr<CPDF_Dictionary, ReleaseDeleter<CPDF_Dictionary>> pDict(
         LoadTrailerV4());
     if (!pDict)
       return FALSE;
 
     if (!CheckDirectType(pDict.get(), FX_BSTRC("Prev"), PDFOBJ_NUMBER))
       return FALSE;
 
     newxrefpos = GetDirectInteger(pDict.get(), FX_BSTRC("Prev"));
     if (newxrefpos == xrefpos)
       return FALSE;
 
     xrefpos = newxrefpos;
     XRefStreamList.InsertAt(0, pDict->GetInteger(FX_BSTRC("XRefStm")));
     m_Trailers.Add(pDict.release());
   }
   for (int32_t i = 0; i < CrossRefList.GetSize(); i++) {
-    if (!LoadCrossRefV4(CrossRefList[i], XRefStreamList[i], FALSE, i == 0))
+    if (!LoadCrossRefV4(CrossRefList[i], XRefStreamList[i], FALSE))
       return FALSE;
   }
   return TRUE;
 }
 FX_BOOL CPDF_Parser::LoadLinearizedAllCrossRefV4(FX_FILESIZE xrefpos,
                                                  FX_DWORD dwObjCount) {
   if (!LoadLinearizedCrossRefV4(xrefpos, dwObjCount)) {
     return FALSE;
   }
   m_pTrailer = LoadTrailerV4();
   if (m_pTrailer == NULL) {
     return FALSE;
   }
   int32_t xrefsize = GetDirectInteger(m_pTrailer, FX_BSTRC("Size"));
   if (xrefsize == 0) {
     return FALSE;
   }
   CFX_FileSizeArray CrossRefList, XRefStreamList;
   CrossRefList.Add(xrefpos);
   XRefStreamList.Add(GetDirectInteger(m_pTrailer, FX_BSTRC("XRefStm")));
   xrefpos = GetDirectInteger(m_pTrailer, FX_BSTRC("Prev"));
   while (xrefpos) {
     CrossRefList.InsertAt(0, xrefpos);
-    LoadCrossRefV4(xrefpos, 0, TRUE, FALSE);
+    LoadCrossRefV4(xrefpos, 0, TRUE);
     CPDF_Dictionary* pDict = LoadTrailerV4();
     if (pDict == NULL) {
       return FALSE;
     }
     xrefpos = GetDirectInteger(pDict, FX_BSTRC("Prev"));
     XRefStreamList.InsertAt(0, pDict->GetInteger(FX_BSTRC("XRefStm")));
     m_Trailers.Add(pDict);
   }
   for (int32_t i = 1; i < CrossRefList.GetSize(); i++)
-    if (!LoadCrossRefV4(CrossRefList[i], XRefStreamList[i], FALSE, i == 0)) {
+    if (!LoadCrossRefV4(CrossRefList[i], XRefStreamList[i], FALSE)) {
       return FALSE;
     }
   return TRUE;
 }
 FX_BOOL CPDF_Parser::LoadLinearizedCrossRefV4(FX_FILESIZE pos,
                                               FX_DWORD dwObjCount) {
   FX_FILESIZE dwStartPos = pos - m_Syntax.m_HeaderOffset;
   m_Syntax.RestorePos(dwStartPos);
   void* pResult =
       FXSYS_bsearch(&pos, m_SortedOffset.GetData(), m_SortedOffset.GetSize(),
@@ skipping 54 matching lines @@
   return TRUE;
 }
 
 bool CPDF_Parser::FindPosInOffsets(FX_FILESIZE pos) const {
   return FXSYS_bsearch(&pos, m_SortedOffset.GetData(), m_SortedOffset.GetSize(),
                        sizeof(FX_FILESIZE), CompareFileSize);
 }
 
 bool CPDF_Parser::LoadCrossRefV4(FX_FILESIZE pos,
                                  FX_FILESIZE streampos,
-                                 FX_BOOL bSkip,
-                                 FX_BOOL bFirst) {
+                                 FX_BOOL bSkip) {
   m_Syntax.RestorePos(pos);
   if (m_Syntax.GetKeyword() != FX_BSTRC("xref"))
     return false;
 
   if (!FindPosInOffsets(pos))
     m_SortedOffset.Add(pos);
 
   if (streampos && !FindPosInOffsets(streampos))
       m_SortedOffset.Add(streampos);
 
   while (1) {
     FX_FILESIZE SavedPos = m_Syntax.SavePos();
     FX_BOOL bIsNumber;
     CFX_ByteString word = m_Syntax.GetNextWord(bIsNumber);
     if (word.IsEmpty())
       return false;
 
     if (!bIsNumber) {
       m_Syntax.RestorePos(SavedPos);
       break;
     }
     FX_DWORD start_objnum = FXSYS_atoi(word);
     if (start_objnum >= (1 << 20))
       return false;
 
     FX_DWORD count = m_Syntax.GetDirectNum();
     m_Syntax.ToNextWord();
     SavedPos = m_Syntax.SavePos();
-    FX_BOOL bFirstItem = FALSE;
     const int32_t recordsize = 20;
-    if (bFirst)
-      bFirstItem = TRUE;
     m_dwXrefStartObjNum = start_objnum;
     if (!bSkip) {
       std::vector<char> buf(1024 * recordsize + 1);
       char* pBuf = pdfium::vector_as_array(&buf);
       pBuf[1024 * recordsize] = '\0';
       int32_t nBlocks = count / 1024 + 1;
-      FX_BOOL bFirstBlock = TRUE;
       for (int32_t block = 0; block < nBlocks; block++) {
         int32_t block_size = block == nBlocks - 1 ? count % 1024 : 1024;
         m_Syntax.ReadBlock(reinterpret_cast<uint8_t*>(pBuf),
                            block_size * recordsize);
         for (int32_t i = 0; i < block_size; i++) {
           FX_DWORD objnum = start_objnum + block * 1024 + i;
           char* pEntry = pBuf + i * recordsize;
           if (pEntry[17] == 'f') {
-            if (bFirstItem) {
-              objnum = 0;
-              bFirstItem = FALSE;
-            }
-            if (bFirstBlock) {
-              FX_FILESIZE offset = (FX_FILESIZE)FXSYS_atoi64(pEntry);
-              int32_t version = FXSYS_atoi(pEntry + 11);
-              if (offset == 0 && version == 65535 && start_objnum != 0) {
-                start_objnum--;
-                objnum = 0;
-              }
-            }
             m_CrossRef.SetAtGrow(objnum, 0);
             m_V5Type.SetAtGrow(objnum, 0);
           } else {
             FX_FILESIZE offset = (FX_FILESIZE)FXSYS_atoi64(pEntry);
             if (offset == 0) {
               for (int32_t c = 0; c < 10; c++) {
                 if (!std::isdigit(pEntry[c]))
                   return false;
               }
             }
             m_CrossRef.SetAtGrow(objnum, offset);
             int32_t version = FXSYS_atoi(pEntry + 11);
             if (version >= 1) {
               m_bVersionUpdated = TRUE;
             }
             m_ObjVersion.SetAtGrow(objnum, version);
             if (m_CrossRef[objnum] < m_Syntax.m_FileLen &&
                 !FindPosInOffsets(m_CrossRef[objnum])) {
               m_SortedOffset.Add(m_CrossRef[objnum]);
             }
             m_V5Type.SetAtGrow(objnum, 1);
           }
-          if (bFirstBlock) {
-            bFirstBlock = FALSE;
-          }
         }
       }
     }
     m_Syntax.RestorePos(SavedPos + count * recordsize);
   }
   return !streampos || LoadCrossRefV5(&streampos, FALSE);
 }
 
 FX_BOOL CPDF_Parser::LoadAllCrossRefV5(FX_FILESIZE xrefpos) {
   if (!LoadCrossRefV5(&xrefpos, TRUE)) {
@@ skipping 971 matching lines @@
   if (!IsLinearizedFile(pFileAccess, offset)) {
     m_Syntax.m_pFileAccess = NULL;
     return StartParse(pFileAccess, bReParse, bOwnFileRead);
   }
   if (!bReParse) {
     m_pDocument = new CPDF_Document(this);
   }
   FX_FILESIZE dwFirstXRefOffset = m_Syntax.SavePos();
   FX_BOOL bXRefRebuilt = FALSE;
   FX_BOOL bLoadV4 = FALSE;
-  if (!(bLoadV4 = LoadCrossRefV4(dwFirstXRefOffset, 0, FALSE, FALSE)) &&
+  if (!(bLoadV4 = LoadCrossRefV4(dwFirstXRefOffset, 0, FALSE)) &&
       !LoadCrossRefV5(&dwFirstXRefOffset, TRUE)) {
     if (!RebuildCrossRef()) {
       return PDFPARSE_ERROR_FORMAT;
     }
     bXRefRebuilt = TRUE;
     m_LastXRefOffset = 0;
   }
   if (bLoadV4) {
     m_pTrailer = LoadTrailerV4();
     if (m_pTrailer == NULL) {
@@ skipping 3368 matching lines @@
   if (!m_pLinearizedDict)
     return -1;
   CPDF_Array* pRange = m_pLinearizedDict->GetArray(FX_BSTRC("H"));
   if (!pRange)
     return -1;
   CPDF_Object* pStreamLen = pRange->GetElementValue(1);
   if (!pStreamLen)
     return -1;
   return pStreamLen->GetInteger();
 }