Description
Parser::parseObject() separates an object-stream index from its body with a nested repeated regular expression, ignores the result of preg_match(), and then unconditionally reads capture 3.
On PHP 8.5 with PCRE 10.47, a synthetic object stream containing about 4,000 object/offset pairs makes the match return false with JIT stack limit exhausted. The subsequent array access raises Undefined array key 3.
The expression also eventually reaches the recursion limit with JIT disabled, so changing PCRE limits is not a durable solution.
Minimal reproduction
The existing ParserSub::exposedParseObject() test helper can reproduce this without a PDF fixture by passing an ObjStm structure containing 4,000 synthetic object-number offset pairs followed by simple null objects.
Expected behavior
Use the object-stream dictionary's required /N and /First entries to bound and separate the index, parse exactly N object/offset pairs with non-recursive logic, and reject malformed counts or offsets with a deterministic exception.
No PDF content or customer data is needed for the regression.
Description
Parser::parseObject()separates an object-stream index from its body with a nested repeated regular expression, ignores the result ofpreg_match(), and then unconditionally reads capture 3.On PHP 8.5 with PCRE 10.47, a synthetic object stream containing about 4,000 object/offset pairs makes the match return
falsewithJIT stack limit exhausted. The subsequent array access raisesUndefined array key 3.The expression also eventually reaches the recursion limit with JIT disabled, so changing PCRE limits is not a durable solution.
Minimal reproduction
The existing
ParserSub::exposedParseObject()test helper can reproduce this without a PDF fixture by passing anObjStmstructure containing 4,000 syntheticobject-number offsetpairs followed by simplenullobjects.Expected behavior
Use the object-stream dictionary's required
/Nand/Firstentries to bound and separate the index, parse exactlyNobject/offset pairs with non-recursive logic, and reject malformed counts or offsets with a deterministic exception.No PDF content or customer data is needed for the regression.