Skip to content

Avoid recursive matching for object stream indexes - #836

Open
NiekNijland wants to merge 2 commits into
smalot:masterfrom
NiekNijland:codex/AA-1241-object-stream
Open

Avoid recursive matching for object stream indexes#836
NiekNijland wants to merge 2 commits into
smalot:masterfrom
NiekNijland:codex/AA-1241-object-stream

Conversation

@NiekNijland

Copy link
Copy Markdown

Fixes #835.

The object-stream parser currently separates the object index with a nested, recursive PCRE pattern. Large valid indexes can exhaust the PCRE JIT stack; preg_match then returns false and the parser reads missing captures.

This change:

  • uses the required ObjStm N and First metadata to separate the index from object bodies;
  • tokenizes the bounded index with a non-recursive whitespace split;
  • validates counts, numeric values, offsets, and duplicate offsets before parsing embedded objects;
  • preserves existing object-stream behavior for valid PDFs.

Verification:

  • regression fails before the change with Undefined array key warnings and 0 parsed objects;
  • focused object-stream tests: 3 tests, 6 assertions;
  • full PHPUnit suite: 195 tests, 1189 assertions;
  • PHP-CS-Fixer dry-run: clean;
  • PHPStan: clean.

@k00ni k00ni added the fix label Sep 1, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Object stream parsing can exhaust PCRE JIT and read a missing capture

2 participants