[jira] [Updated] (PDFBOX-1639) Infinite loop with PDFParser used by tika.

["Eric Leleu (JIRA)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/PDFBOX-1639?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Eric Leleu updated PDFBOX-1639:
-------------------------------

    Attachment: PDFBox-1639.patch

Hi,

Here is my patch proposal. 
If the objectNumber is too long (more than 10 digits) I'm throwing an IllegalArgumentException because it might be in a malicious PDF (as Timo wrote).

If there are no objection, I will commit this fix this week-end.

BR,
Eric
                
> Infinite loop with PDFParser used by tika.
> ------------------------------------------
>
>                 Key: PDFBOX-1639
>                 URL: https://issues.apache.org/jira/browse/PDFBOX-1639
>             Project: PDFBox
>          Issue Type: Bug
>          Components: Parsing
>    Affects Versions: 1.7.1, 1.8.2, 2.0.0
>            Reporter: Eric Leleu
>            Assignee: Eric Leleu
>         Attachments: PDFBox-1639.patch
>
>
> Hi,
> I encountered an issue in a production environment that cause a disk full error. :(
> Tika uses the PDFParser with the "forceParsing" boolean set to true in order to continue the parsing even if an error occurs.
> Two PDFs have an object number greater than the max int value so the readInt() method fails.
> Due to the "forceParsing" boolean, the parser try to go to the next object but it can't because on error the readInt method backtrack the read bytes and so 
> the "skipToNextObj" method does nothing and we try to parse the same object indefinitely...
> The COSObjectKey object already uses a long as object numder, so we should read a long instead of an integer during the parsing process using a "readLong" method to manage too large objects numbers.
> Are you agreed with that ?
> BR,
> Eric

--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira