1 // Copyright 2016 The PDFium Authors
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
4
5 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
6
7 #include "core/fpdfapi/parser/cpdf_linearized_header.h"
8
9 #include <algorithm>
10 #include <limits>
11 #include <utility>
12
13 #include "core/fpdfapi/parser/cpdf_array.h"
14 #include "core/fpdfapi/parser/cpdf_dictionary.h"
15 #include "core/fpdfapi/parser/cpdf_number.h"
16 #include "core/fpdfapi/parser/cpdf_parser.h"
17 #include "core/fpdfapi/parser/cpdf_syntax_parser.h"
18 #include "core/fxcrt/fx_safe_types.h"
19 #include "third_party/base/check.h"
20 #include "third_party/base/memory/ptr_util.h"
21
22 namespace {
23
24 constexpr FX_FILESIZE kLinearizedHeaderOffset = 9;
25 constexpr size_t kMaxInt = static_cast<size_t>(std::numeric_limits<int>::max());
26
27 template <class T>
IsValidNumericDictionaryValue(const CPDF_Dictionary * pDict,const ByteString & key,T min_value,bool must_exist=true)28 bool IsValidNumericDictionaryValue(const CPDF_Dictionary* pDict,
29 const ByteString& key,
30 T min_value,
31 bool must_exist = true) {
32 if (!pDict->KeyExist(key))
33 return !must_exist;
34 RetainPtr<const CPDF_Number> pNum = pDict->GetNumberFor(key);
35 if (!pNum || !pNum->IsInteger())
36 return false;
37 const int raw_value = pNum->GetInteger();
38 if (!pdfium::base::IsValueInRangeForNumericType<T>(raw_value))
39 return false;
40 return static_cast<T>(raw_value) >= min_value;
41 }
42
IsLinearizedHeaderValid(const CPDF_LinearizedHeader * header,FX_FILESIZE document_size)43 bool IsLinearizedHeaderValid(const CPDF_LinearizedHeader* header,
44 FX_FILESIZE document_size) {
45 DCHECK(header);
46 return header->GetFileSize() == document_size &&
47 header->GetFirstPageNo() < kMaxInt &&
48 header->GetFirstPageNo() < header->GetPageCount() &&
49 header->GetMainXRefTableFirstEntryOffset() < document_size &&
50 header->GetFirstPageEndOffset() < document_size &&
51 header->GetFirstPageObjNum() < CPDF_Parser::kMaxObjectNumber &&
52 header->GetLastXRefOffset() < document_size &&
53 header->GetHintStart() < document_size;
54 }
55
56 } // namespace
57
58 // static
Parse(CPDF_SyntaxParser * parser)59 std::unique_ptr<CPDF_LinearizedHeader> CPDF_LinearizedHeader::Parse(
60 CPDF_SyntaxParser* parser) {
61 parser->SetPos(kLinearizedHeaderOffset);
62
63 const auto pDict = ToDictionary(
64 parser->GetIndirectObject(nullptr, CPDF_SyntaxParser::ParseType::kLoose));
65
66 if (!pDict || !pDict->KeyExist("Linearized") ||
67 !IsValidNumericDictionaryValue<FX_FILESIZE>(pDict.Get(), "L", 1) ||
68 !IsValidNumericDictionaryValue<uint32_t>(pDict.Get(), "P", 0, false) ||
69 !IsValidNumericDictionaryValue<FX_FILESIZE>(pDict.Get(), "T", 1) ||
70 !IsValidNumericDictionaryValue<uint32_t>(pDict.Get(), "N", 1) ||
71 !IsValidNumericDictionaryValue<FX_FILESIZE>(pDict.Get(), "E", 1) ||
72 !IsValidNumericDictionaryValue<uint32_t>(pDict.Get(), "O", 1)) {
73 return nullptr;
74 }
75 // Move parser to the start of the xref table for the documents first page.
76 // (skpping endobj keyword)
77 if (parser->GetNextWord().word != "endobj")
78 return nullptr;
79
80 auto result = pdfium::WrapUnique(
81 new CPDF_LinearizedHeader(pDict.Get(), parser->GetPos()));
82
83 if (!IsLinearizedHeaderValid(result.get(), parser->GetDocumentSize()))
84 return nullptr;
85
86 return result;
87 }
88
CPDF_LinearizedHeader(const CPDF_Dictionary * pDict,FX_FILESIZE szLastXRefOffset)89 CPDF_LinearizedHeader::CPDF_LinearizedHeader(const CPDF_Dictionary* pDict,
90 FX_FILESIZE szLastXRefOffset)
91 : m_szFileSize(pDict->GetIntegerFor("L")),
92 m_dwFirstPageNo(pDict->GetIntegerFor("P")),
93 m_szMainXRefTableFirstEntryOffset(pDict->GetIntegerFor("T")),
94 m_PageCount(pDict->GetIntegerFor("N")),
95 m_szFirstPageEndOffset(pDict->GetIntegerFor("E")),
96 m_FirstPageObjNum(pDict->GetIntegerFor("O")),
97 m_szLastXRefOffset(szLastXRefOffset) {
98 RetainPtr<const CPDF_Array> pHintStreamRange = pDict->GetArrayFor("H");
99 const size_t nHintStreamSize =
100 pHintStreamRange ? pHintStreamRange->size() : 0;
101 if (nHintStreamSize == 2 || nHintStreamSize == 4) {
102 m_szHintStart = std::max(pHintStreamRange->GetIntegerAt(0), 0);
103 const FX_SAFE_UINT32 safe_hint_length = pHintStreamRange->GetIntegerAt(1);
104 if (safe_hint_length.IsValid())
105 m_HintLength = safe_hint_length.ValueOrDie();
106 }
107 }
108
109 CPDF_LinearizedHeader::~CPDF_LinearizedHeader() = default;
110
HasHintTable() const111 bool CPDF_LinearizedHeader::HasHintTable() const {
112 return GetPageCount() > 1 && GetHintStart() > 0 && GetHintLength() > 0;
113 }
114