From 0bbf2de242801bdf7001db7f85c5fb3b4016e9e1 Mon Sep 17 00:00:00 2001
From: Ken Sharp <ken.sharp@artifex.com>
Date: Tue, 16 Oct 2018 15:10:41 +0100
Subject: [PATCH] PDF interpreter - bug in growPDFobjects when repairing PDF
 file

Bug #699970 "bug in PDF repair"

The function growPDFobjects is used to increase the size of the Objects,
ObjectStream, Generations and IsGlobal records when the number of
objects being recorded exceeds the size of the current record.

The problem was that the code assumes Generations is a string, which it
normally is. However when we are repairing a PDF file, we turn the
string into an array, and if we need to increase the size of the
record we need to make a larger array, not a larger string.

This commit checks the current type of the Generations record and either
creates a large string or larger array, working from the type of the
existing record.
---
 Resource/Init/pdf_base.ps | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/Resource/Init/pdf_base.ps b/Resource/Init/pdf_base.ps
index 7ccd4cd..d9a85a2 100644
--- a/Resource/Init/pdf_base.ps
+++ b/Resource/Init/pdf_base.ps
@@ -394,8 +394,15 @@ currentdict /token_nofail_dict .undef
   dup Objects length gt {
     dup Objects exch array dup 3 1 roll copy pop /Objects exch def
   } if
-  dup Generations length gt {
-    dup Generations exch string dup 3 1 roll copy pop /Generations exch def
+  dup Generations length pstack gt {
+    %% Initiallly Generations is a string, but the xref rebuilding code
+    %% can convert it to an array (/setxrefentry in pdf_rbld.ps). So we
+    %% need to be able to deal with either case.
+    Generations type /stringtype eq {
+      dup Generations exch string dup 3 1 roll copy pop /Generations exch def
+    } {
+      dup Generations exch array dup 3 1 roll copy pop /Generations exch def
+    } ifelse
   } if
   dup IsGlobal length gt {
     dup IsGlobal exch string dup 3 1 roll copy pop /IsGlobal exch def
-- 
2.9.1