Add check for length of arrays and dictionaries

DEVSIX-4050

Author: dzmitry.kachkou

pdfa/src/main/java/com/itextpdf/pdfa/PdfAConformanceException.java

@@ -113,6 +113,8 @@ public class PdfAConformanceException extends PdfException {
     public static final String THE_DOCUMENT_DOES_NOT_CONTAIN_A_PDFA_OUTPUTINTENT_BUT_PAGE_CONTAINS_TRANSPARENCY_AND_DOES_NOT_CONTAIN_BLENDING_COLOR_SPACE = "If the document does not contain a OutputIntent, then page with transparency shall include the dictionary with Group key that include a CS with blending colour space";
     public static final String JPEG2000_ENUMERATED_COLOUR_SPACE_19_CIEJAB_SHALL_NOT_BE_USED = "jpeg2000 enumerated colour space 19 (CIEJab) shall not be used";
     public static final String LZWDECODE_FILTER_IS_NOT_PERMITTED = "LZWDecode filter is not permitted";
+    public static final String MAXIMUM_ARRAY_CAPACITY_IS_EXCEEDED = "Maximum array capacity is exceeded";
+    public static final String MAXIMUM_DICTIONARY_CAPACITY_IS_EXCEEDED = "Maximum dictionary capacity is exceeded";
     public static final String MIME_TYPE_SHALL_BE_SPECIFIED_USING_THE_SUBTYPE_KEY_OF_THE_FILE_SPECIFICATION_STREAM_DICTIONARY = "Mime type shall be specified using the subtype key of the file specification stream dictionary";
     public static final String N_KEY_SHALL_BE_APPEARANCE_SUBDICTIONARY = "If an annotation dictionary's Subtype key has a value of Widget and its FT key has a value of Btn, the value of the N key shall be an appearance subdictionary";
     public static final String NAMED_ACTION_TYPE_0_IS_NOT_ALLOWED = "Named action type {0} not allowed";

pdfa/src/main/java/com/itextpdf/pdfa/checker/PdfA1Checker.java

@@ -309,12 +309,15 @@ protected void checkContentStreamObject(PdfObject object) {
                 checkPdfString((PdfString) object);
                 break;
             case PdfObject.ARRAY:
-                for (PdfObject obj : (PdfArray) object) {
+                PdfArray array = (PdfArray) object;
+                checkPdfArray(array);
+                for (PdfObject obj : array) {
                     checkContentStreamObject(obj);
                 }
                 break;
             case PdfObject.DICTIONARY:
                 PdfDictionary dictionary = (PdfDictionary) object;
+                checkPdfDictionary(dictionary);
                 for (PdfObject obj : dictionary.values()) {
                     checkContentStreamObject(obj);
                 }
@@ -451,8 +454,24 @@ protected double getMaxRealValue() {
         return 32767;
     }
 
+    @Override
+    protected void checkPdfArray(PdfArray array) {
+        if (array.size() > getMaxArrayCapacity()) {
+            throw new PdfAConformanceException(PdfAConformanceException.MAXIMUM_ARRAY_CAPACITY_IS_EXCEEDED);
+        }
+    }
+
+    @Override
+    protected void checkPdfDictionary(PdfDictionary dictionary) {
+        if (dictionary.size() > getMaxDictionaryCapacity()) {
+            throw new PdfAConformanceException(PdfAConformanceException.MAXIMUM_DICTIONARY_CAPACITY_IS_EXCEEDED);
+        }
+    }
+
     @Override
     protected void checkPdfStream(PdfStream stream) {
+        checkPdfDictionary(stream);
+
         if (stream.containsKey(PdfName.F) || stream.containsKey(PdfName.FFilter) || stream.containsKey(PdfName.FDecodeParams)) {
             throw new PdfAConformanceException(PdfAConformanceException.STREAM_OBJECT_DICTIONARY_SHALL_NOT_CONTAIN_THE_F_FFILTER_OR_FDECODEPARAMS_KEYS);
         }
@@ -647,4 +666,12 @@ protected PdfArray getFormFields(PdfArray array) {
         }
         return fields;
     }
+
+    private int getMaxArrayCapacity() {
+        return 8191;
+    }
+
+    private int getMaxDictionaryCapacity() {
+        return 4095;
+    }
 }

pdfa/src/main/java/com/itextpdf/pdfa/checker/PdfA2Checker.java

@@ -332,6 +332,15 @@ protected double getMaxRealValue() {
     protected int getMaxStringLength() {
         return 32767;
     }
+    @Override
+    protected void checkPdfArray(PdfArray array) {
+        // currently no validation for arrays is implemented for PDF/A 2
+    }
+
+    @Override
+    protected void checkPdfDictionary(PdfDictionary dictionary) {
+        // currently no validation for dictionaries is implemented for PDF/A 2
+    }
 
     @Override
     protected void checkAnnotation(PdfDictionary annotDic) {
@@ -547,6 +556,7 @@ protected void checkFileSpec(PdfDictionary fileSpec) {
 
     @Override
     protected void checkPdfStream(PdfStream stream) {
+        checkPdfDictionary(stream);
 
         if (stream.containsKey(PdfName.F) || stream.containsKey(PdfName.FFilter) || stream.containsKey(PdfName.FDecodeParams)) {
             throw new PdfAConformanceException(PdfAConformanceException.STREAM_OBJECT_DICTIONARY_SHALL_NOT_CONTAIN_THE_F_FFILTER_OR_FDECODEPARAMS_KEYS);

pdfa/src/main/java/com/itextpdf/pdfa/checker/PdfAChecker.java

@@ -202,14 +202,17 @@ public void checkPdfObject(PdfObject obj) {
                 checkPdfString((PdfString) obj);
                 break;
             case PdfObject.ARRAY:
-                checkArrayRecursively((PdfArray) obj);
+                PdfArray array = (PdfArray) obj;
+                checkPdfArray(array);
+                checkArrayRecursively(array);
                 break;
             case PdfObject.DICTIONARY:
                 PdfDictionary dict = (PdfDictionary) obj;
                 PdfName type = dict.getAsName(PdfName.Type);
                 if (PdfName.Filespec.equals(type)) {
                     checkFileSpec(dict);
                 }
+                checkPdfDictionary(dict);
                 checkDictionaryRecursively(dict);
                 break;
             case PdfObject.STREAM:
@@ -415,6 +418,8 @@ protected void checkContentStreamObject(PdfObject object) {
     protected abstract void checkOutputIntents(PdfDictionary catalog);
     protected abstract void checkPageObject(PdfDictionary page, PdfDictionary pageResources);
     protected abstract void checkPageSize(PdfDictionary page);
+    protected abstract void checkPdfArray(PdfArray array);
+    protected abstract void checkPdfDictionary(PdfDictionary dictionary);
     protected abstract void checkPdfNumber(PdfNumber number);
     protected abstract void checkPdfStream(PdfStream stream);
     protected abstract void checkPdfString(PdfString string);