Throw looped exception in indirect objects

veraPDF · Oct 18, 2024 · 7d668d5 · 7d668d5
1 parent 29e0a76
commit 7d668d5
Show file tree

Hide file tree

Showing 2 changed files with 23 additions and 7 deletions.
diff --git a/src/main/java/org/verapdf/cos/COSIndirect.java b/src/main/java/org/verapdf/cos/COSIndirect.java
@@ -24,8 +24,10 @@
 import org.verapdf.as.io.ASInputStream;
 import org.verapdf.cos.visitor.ICOSVisitor;
 import org.verapdf.cos.visitor.IVisitor;
+import org.verapdf.exceptions.LoopedException;
 
 import java.util.Collection;
+import java.util.HashSet;
 import java.util.Set;
 
 /**
@@ -430,9 +432,26 @@ public boolean setKey(final COSKey key, final COSDocument document) {
         return true;
     }
 
+    private COSObject getChildObject() {
+        return this.document != null ? this.document.getObject(key) : this.child;
+    }
+
     @Override
     public COSObject getDirect() {
-        return this.document != null ? this.document.getObject(key) : this.child;
+        COSObject object = getChildObject();
+        if (object.isIndirect()) {
+            Set<COSKey> keys = new HashSet<>();
+            keys.add(getObjectKey());
+            while (object.isIndirect()) {
+                COSKey key = object.getObjectKey();
+                if (keys.contains(key)) {
+                    throw new LoopedException("Loop in indirect references starting from indirect object " + getObjectKey());
+                }
+                keys.add(key);
+                object = ((COSIndirect)object.get()).getChildObject();
+            }
+        }
+        return object;
     }
 
     @Override

diff --git a/src/main/java/org/verapdf/parser/PDFParser.java b/src/main/java/org/verapdf/parser/PDFParser.java
@@ -300,13 +300,10 @@ public COSObject getObject(final long offset) throws IOException {
 
         COSObject obj = nextObject();
 
-        if (obj.getType() == COSObjType.COS_STREAM) {
+        if (!obj.isIndirect() && obj.getType() == COSObjType.COS_STREAM && this.document.isEncrypted()) {
             try {
-                if (this.document.isEncrypted()) {
-                    this.document.getStandardSecurityHandler().decryptStream(
-                            (COSStream) obj.getDirectBase(), new COSKey((int) number,
-                                    (int) generation));
-                }
+                this.document.getStandardSecurityHandler().decryptStream((COSStream) obj.getDirectBase(), 
+                        new COSKey((int) number, (int) generation));
             } catch (GeneralSecurityException e) {
                 throw new IOException(getErrorMessage("Stream cannot be decrypted"), e);
             }