[PDFBOX-5112] Add more checks to PDFXrefStreamParser and reduce memory footprint

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.0.22, 3.0.0 PDFBox
• Fix Version/s: 2.0.23, 3.0.0 PDFBox
• Component/s: Parsing
• Labels: CVE-2021-27906
• External issue URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27906
• Assignee: Andreas Lehmkühler
• Reporter: Andreas Lehmkühler
• Created: 02/Mar/21 07:03
• Updated: 18/Jun/23 08:44
• Resolved: 02/Mar/21 16:39

Description

PDFBOX-5108 already added a check of the dictionary values of a compressed cross reference stream, but there are some more values which should be checked before parsing the stream. There is some room for reducing the memory footprint as well. PDFBox should calculate the object numbers during parsing the stream instead of creating a whole list of them before parsing the stream.

Issue Links

• is related to: PDFBOX-5623 Signature Image not Rendered starting with PDFBox 2.0.23 + patch provided