Skip to content

Object stream parsing can exhaust PCRE JIT and read a missing capture #835

Description

@NiekNijland

Description

Parser::parseObject() separates an object-stream index from its body with a nested repeated regular expression, ignores the result of preg_match(), and then unconditionally reads capture 3.

On PHP 8.5 with PCRE 10.47, a synthetic object stream containing about 4,000 object/offset pairs makes the match return false with JIT stack limit exhausted. The subsequent array access raises Undefined array key 3.

The expression also eventually reaches the recursion limit with JIT disabled, so changing PCRE limits is not a durable solution.

Minimal reproduction

The existing ParserSub::exposedParseObject() test helper can reproduce this without a PDF fixture by passing an ObjStm structure containing 4,000 synthetic object-number offset pairs followed by simple null objects.

Expected behavior

Use the object-stream dictionary's required /N and /First entries to bound and separate the index, parse exactly N object/offset pairs with non-recursive logic, and reject malformed counts or offsets with a deterministic exception.

No PDF content or customer data is needed for the regression.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions