[PDFBOX-4997] Incremental update adds certain objects not marked as needing update

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.0.21, 3.0.0 PDFBox
• Fix Version/s: 2.0.22, 3.0.0 PDFBox
• Component/s: Writing
• Assignee: Tilman Hausherr
• Reporter: Michael Klink
• Created: 20/Oct/20 13:15
• Updated: 20/Dec/20 18:47
• Resolved: 20/Oct/20 17:59

Description

This bug causes the eSignature DSS issue DSS-2260.

If during an incremental update an indirect object containing only a name object is checked for need of writing, it always is added to the objects to write and, therefore, eventually written to the update section.

For example in the attached document signed-000.pdf each page has a color space resource entry CS1 referring to the indirect object 54 containing only the name object, DeviceGray. Whenever a page is marked as needing an update, the bug causes object 54 also to be written even if it is not changed at all.

While this seems like a minor annoyance only, it has serious repercussions: In multi-signature use cases this makes Adobe Reader claim previous signatures to be broken whenever a new signature with visualization is added using PDFBox, see also DSS-2260.

---

The cause of the bug is org.apache.pdfbox.pdfwriter.COSWriter.addObjectToWrite(COSBase) where the following if clause attempts to determine whether the inspected object does not need to be written:

if (actual != null && objectKeys.containsKey(actual) 
    && object instanceof COSUpdateInfo && !((COSUpdateInfo)object).isNeedToBeUpdated() 
    && cosBase instanceof COSUpdateInfo && !((COSUpdateInfo)cosBase).isNeedToBeUpdated() )
{
    return;
}

Here cosBase contains the content of the indirect object, in the case in question the COSName DeviceGray. As COSName does not implement COSUpdateInfo, the condition never evaluates to true, so the flow never returns here but instead always continues with the following lines where the object is added to the collection of objects to write.

Issue Links

• is duplicated by: PDFBOX-4995 Multiple PDF signatures with image
• links to: DSS-2260 - Multiple PADeS signatures with images do not work