Fix ArrayIndexOutOfBoundsException while opening invalid document with huge object reference

DEVSIX-7948

Author: introfog

kernel/src/main/java/com/itextpdf/kernel/pdf/MemoryLimitsAwareHandler.java

@@ -204,7 +204,7 @@ public void setMaxNumberOfElementsInXrefStructure(int maxNumberOfElementsInXrefS
     public void checkIfXrefStructureExceedsTheLimit(int requestedCapacity) {
         // Objects in xref structures are using 1-based indexes, so to store maxNumberOfElementsInXrefStructure
         // amount of elements we need maxNumberOfElementsInXrefStructure + 1 capacity.
-        if (requestedCapacity - 1 > maxNumberOfElementsInXrefStructure) {
+        if (requestedCapacity - 1 > maxNumberOfElementsInXrefStructure || requestedCapacity < 0) {
             throw new MemoryLimitsAwareException(KernelExceptionMessageConstant.XREF_STRUCTURE_SIZE_EXCEEDED_THE_LIMIT);
         }
     }

kernel/src/main/java/com/itextpdf/kernel/pdf/PdfXrefTable.java

@@ -27,6 +27,8 @@ This file is part of the iText (R) project.
 import com.itextpdf.io.logs.IoLogMessageConstant;
 import com.itextpdf.io.source.ByteUtils;
 import com.itextpdf.kernel.actions.data.ITextCoreProductData;
+import com.itextpdf.kernel.exceptions.KernelExceptionMessageConstant;
+import com.itextpdf.kernel.exceptions.PdfException;
 
 import java.io.IOException;
 import java.util.ArrayList;
@@ -435,7 +437,7 @@ void initFreeReferencesList(PdfDocument pdfDocument) {
         // ensure zero object is free
         xref[0].setState(PdfObject.FREE);
         TreeSet<Integer> freeReferences = new TreeSet<>();
-        for (int i = 1; i < size(); ++i) {
+        for (int i = 1; i < size() && i < xref.length; ++i) {
             PdfIndirectReference ref = xref[i];
             if (ref == null || ref.isFree()) {
                 freeReferences.add(i);

kernel/src/test/java/com/itextpdf/kernel/pdf/PdfXrefTableTest.java

@@ -22,12 +22,19 @@ This file is part of the iText (R) project.
  */
 package com.itextpdf.kernel.pdf;
 
+import com.itextpdf.io.logs.IoLogMessageConstant;
+import com.itextpdf.kernel.exceptions.KernelExceptionMessageConstant;
+import com.itextpdf.kernel.exceptions.PdfException;
 import com.itextpdf.kernel.utils.CompareTool;
+import com.itextpdf.test.AssertUtil;
 import com.itextpdf.test.ExtendedITextTest;
+import com.itextpdf.test.LogLevelConstants;
+import com.itextpdf.test.annotations.LogMessage;
+import com.itextpdf.test.annotations.LogMessages;
 import com.itextpdf.test.annotations.type.IntegrationTest;
 
+import java.io.ByteArrayOutputStream;
 import java.io.IOException;
-
 import org.junit.AfterClass;
 import org.junit.Assert;
 import org.junit.BeforeClass;
@@ -37,23 +44,45 @@ This file is part of the iText (R) project.
 @Category(IntegrationTest.class)
 public class PdfXrefTableTest extends ExtendedITextTest {
 
-    public static final String sourceFolder = "./src/test/resources/com/itextpdf/kernel/pdf/PdfXrefTableTest/";
-    public static final String destinationFolder = "./target/test/com/itextpdf/kernel/pdf/PdfXrefTableTest/";
+    public static final String SOURCE_FOLDER = "./src/test/resources/com/itextpdf/kernel/pdf/PdfXrefTableTest/";
+    public static final String DESTINATION_FOLDER = "./target/test/com/itextpdf/kernel/pdf/PdfXrefTableTest/";
 
     @BeforeClass
     public static void beforeClass() {
-        createOrClearDestinationFolder(destinationFolder);
+        createOrClearDestinationFolder(DESTINATION_FOLDER);
     }
 
     @AfterClass
     public static void afterClass() {
-        CompareTool.cleanup(destinationFolder);
+        CompareTool.cleanup(DESTINATION_FOLDER);
+    }
+
+    @Test
+    @LogMessages(messages = {
+            @LogMessage(messageTemplate = IoLogMessageConstant.XREF_ERROR_WHILE_READING_TABLE_WILL_BE_REBUILT, logLevel = LogLevelConstants.ERROR)
+    })
+    public void openInvalidDocWithHugeRefTest() {
+        String inputFile = SOURCE_FOLDER + "invalidDocWithHugeRef.pdf";
+        AssertUtil.doesNotThrow(() -> new PdfDocument(new PdfReader(inputFile)));
     }
-    
+
+    @Test
+    @LogMessages(messages = {
+            @LogMessage(messageTemplate = IoLogMessageConstant.XREF_ERROR_WHILE_READING_TABLE_WILL_BE_REBUILT, logLevel = LogLevelConstants.ERROR)
+    })
+    public void openWithWriterInvalidDocWithHugeRefTest() {
+        String inputFile = SOURCE_FOLDER + "invalidDocWithHugeRef.pdf";
+        ByteArrayOutputStream outputStream = new com.itextpdf.io.source.ByteArrayOutputStream();
+
+        Exception e = Assert.assertThrows(PdfException.class, () ->
+                new PdfDocument(new PdfReader(inputFile), new PdfWriter(outputStream)));
+        Assert.assertEquals(KernelExceptionMessageConstant.XREF_STRUCTURE_SIZE_EXCEEDED_THE_LIMIT, e.getMessage());
+    }
+
     @Test
     public void testCreateAndUpdateXMP() throws IOException {
-        String created = destinationFolder + "testCreateAndUpdateXMP_create.pdf";
-        String updated = destinationFolder + "testCreateAndUpdateXMP_update.pdf";
+        String created = DESTINATION_FOLDER + "testCreateAndUpdateXMP_create.pdf";
+        String updated = DESTINATION_FOLDER + "testCreateAndUpdateXMP_update.pdf";
         PdfDocument pdfDocument = new PdfDocument(CompareTool.createTestPdfWriter(created));
         pdfDocument.addNewPage();
 
@@ -93,9 +122,9 @@ public void testCreateAndUpdateXMP() throws IOException {
 
     @Test
     public void testCreateAndUpdateTwiceXMP() throws IOException {
-        String created = destinationFolder + "testCreateAndUpdateTwiceXMP_create.pdf";
-        String updated = destinationFolder + "testCreateAndUpdateTwiceXMP_update.pdf";
-        String updatedAgain = destinationFolder + "testCreateAndUpdateTwiceXMP_updatedAgain.pdf";
+        String created = DESTINATION_FOLDER + "testCreateAndUpdateTwiceXMP_create.pdf";
+        String updated = DESTINATION_FOLDER + "testCreateAndUpdateTwiceXMP_update.pdf";
+        String updatedAgain = DESTINATION_FOLDER + "testCreateAndUpdateTwiceXMP_updatedAgain.pdf";
         PdfDocument pdfDocument = new PdfDocument(CompareTool.createTestPdfWriter(created));
         pdfDocument.addNewPage();