diff --git a/crates/pdf/src/object.rs b/crates/pdf/src/object.rs index cdbb9733a..79a91dde8 100644 --- a/crates/pdf/src/object.rs +++ b/crates/pdf/src/object.rs @@ -275,19 +275,26 @@ fn hexv(c: u8) -> u8 { } } -fn decode_name(w: &[u8]) -> String { - let mut out = vec![]; +/// The bytes of a name token (after its `/`), with `#xx` escapes decoded. +pub(crate) fn name_bytes(w: &[u8]) -> impl Iterator { let mut i = 0; - while i < w.len() { - if w[i] == b'#' && w.get(i + 1).is_some_and(u8::is_ascii_hexdigit) && w.get(i + 2).is_some_and(u8::is_ascii_hexdigit) { - out.push((hexv(w[i + 1]) << 4) | hexv(w[i + 2])); - i += 3; - } else { - out.push(w[i]); - i += 1; + std::iter::from_fn(move || { + let c = *w.get(i)?; + match (c, w.get(i + 1), w.get(i + 2)) { + (b'#', Some(&hi), Some(&lo)) if hi.is_ascii_hexdigit() && lo.is_ascii_hexdigit() => { + i += 3; + Some((hexv(hi) << 4) | hexv(lo)) + } + _ => { + i += 1; + Some(c) + } } - } - String::from_utf8_lossy(&out).into_owned() + }) +} + +fn decode_name(w: &[u8]) -> String { + String::from_utf8_lossy(&name_bytes(w).collect::>()).into_owned() } pub fn parse_num(w: &[u8]) -> Option { diff --git a/crates/pdf/src/read.rs b/crates/pdf/src/read.rs index 927e82752..799a00ff8 100644 --- a/crates/pdf/src/read.rs +++ b/crates/pdf/src/read.rs @@ -11,7 +11,7 @@ use craft_pdf::syntax::object::{Dict as PdfDict, MaybeRef, Name, ObjRef, Object, use craft_pdf::syntax::xref::XRef; use crate::Error; -use crate::object::{Dict, File, Lexer, Obj}; +use crate::object::{Dict, File, Lexer, Obj, is_delim, is_white, name_bytes}; const MAX_OBJECTS: usize = 100_000; const MAX_VALUES: usize = 1_000_000; @@ -19,11 +19,12 @@ const MAX_DEPTH: usize = 64; const MAX_BYTES: usize = 512 * 1024 * 1024; /// How far after each `trailer` marker the encryption pre-scan lexes. A classic trailer /// dictionary is a few hundred bytes. If the lexer reaches the window's end, the dictionary -/// may start or continue past it, so the file is refused when `/Encrypt` appears anywhere past -/// the window. This fallback is conservative: it refuses on any `/Encrypt` text there, which -/// in practice only encrypted files contain. The pre-scan stays linear in file size, at most -/// `MAX_OBJECTS` windows (about 400 MB) and one search for `/Encrypt`, even when a marker is -/// followed by an unterminated string or dictionary the lexer would follow to the end. +/// may start or continue past it, so the file is refused when a name token that decodes to +/// `Encrypt`, in any spelling (`/Encrypt`, `/Encr#79pt`), ends past the window. This fallback +/// is conservative: it refuses on any such name there, which in practice only encrypted files +/// contain. The pre-scan stays linear in file size, at most `MAX_OBJECTS` windows (about 400 MB) +/// and one search for the name, even when a marker is followed by an unterminated string or +/// dictionary the lexer would follow to the end. const TRAILER_WINDOW: usize = 4 * 1024; fn limit(what: &str) -> Error { @@ -50,7 +51,14 @@ fn open_inner(bytes: &[u8]) -> Result { // Preserve the app's refusal of encrypted PDFs, including empty-user-password files. // Classic trailer dictionaries use the existing lexer; xref-stream dictionaries below // are read by the shared parser. This does not parse document objects a second time. - let last_encrypt = LazyCell::new(|| bytes.windows(8).rposition(|word| word == b"/Encrypt")); + // Where the last name token decoding to `Encrypt` (escaped or not) ends, searched at most once. + // Each token scan stops at the next `/`, so the search is linear. + let last_encrypt = LazyCell::new(|| { + bytes.iter().enumerate().rev().filter(|&(_, &c)| c == b'/').find_map(|(at, _)| { + let token = bytes.get(at + 1..).unwrap_or_default().split(|&c| is_white(c) || is_delim(c)).next().unwrap_or_default(); + name_bytes(token).eq(*b"Encrypt").then_some(at + 1 + token.len()) + }) + }); let mut markers = 0; for (offset, word) in bytes.windows(7).enumerate() { if word == b"trailer" { @@ -64,8 +72,9 @@ fn open_inner(bytes: &[u8]) -> Result { let mut lexer = Lexer::new(window, 0); let encrypt = matches!(lexer.next(), Some(Obj::Dict(dict)) if dict.contains_key("Encrypt")); // Whatever it returned, a lexer at the window's end (one past it after an unterminated - // hex string) may have stopped before the dictionary started or partway through it. - let cut = lexer.pos >= window.len() && last_encrypt.is_some_and(|at| at.saturating_add(8) > end); + // hex string) may have stopped before the dictionary started or partway through it, so + // an `Encrypt` name in any spelling that ends past the window refuses the file. + let cut = lexer.pos >= window.len() && last_encrypt.is_some_and(|name_end| name_end > end); if encrypt || cut { return Err(Error::Encrypted); } diff --git a/crates/pdf/src/tests/reader.rs b/crates/pdf/src/tests/reader.rs index 748ea0c87..de6c0a311 100644 --- a/crates/pdf/src/tests/reader.rs +++ b/crates/pdf/src/tests/reader.rs @@ -109,6 +109,22 @@ fn an_encrypt_entry_past_the_trailer_window_is_refused() { assert_eq!(parse(encrypted.as_bytes()), Err(Error::Encrypted)); } +#[test] +fn an_escaped_encrypt_entry_past_the_trailer_window_is_refused() { + // A name may write any byte as `#` and two hex digits, so these keys all read as /Encrypt and + // the past-the-window fallback refuses them. The decoys decode to other names and still open. + let plain = String::from_utf8(document("", &[])).unwrap(); + let doc = parse(plain.as_bytes()).unwrap(); + let filler = "x".repeat(8 * 1024); + let trailer = |key: &str| plain.replace("/Root 1 0 R >>", &format!("/Root 1 0 R /Filler ({filler}) {key} 9 0 R >>")); + for key in ["/Encr#79pt", "/#45#6E#63rypt", "/E#6e#63rypt"] { + assert_eq!(parse(trailer(key).as_bytes()), Err(Error::Encrypted), "{key}"); + } + for decoy in ["/Encrypted", "/Encr#7Apt"] { + assert_eq!(parse(trailer(decoy).as_bytes()).as_ref(), Ok(&doc), "{decoy}"); + } +} + #[test] fn an_encrypt_entry_after_a_window_cut_before_the_trailer_dictionary_is_refused() { // The 4 KiB pre-scan window ends in the whitespace before the trailer dictionary (the lexer