PDFBOX-5177: don't use number of objects to initialize list of object…

…s, don't read beyond the part of the stream reserved for object numbers

git-svn-id: https://svn.apache.org/repos/asf/pdfbox/branches/2.0@1889168 13f79535-47bb-0310-9956-ffa450edef68

pdfbox/src/main/java/org/apache/pdfbox/pdfparser/PDFObjectStreamParser.java

@@ -92,7 +92,7 @@ public void parse() throws IOException
         try
         {
             Map<Integer, Long> offsets = readOffsets();
-            streamObjects = new ArrayList<COSObject>( numberOfObjects );
+            streamObjects = new ArrayList<COSObject>(offsets.size());
             for (Entry<Integer, Long> offset : offsets.entrySet())
             {
                 COSBase cosObject = parseObject(offset.getKey());
@@ -128,8 +128,14 @@ private Map<Integer, Long> readOffsets() throws IOException
         // but we can't rely on that, so that we have to sort the offsets
         // as the sequential parsers relies on it, see PDFBOX-4927
         Map<Integer, Long> objectNumbers = new TreeMap<Integer, Long>();
+        long firstObjectPosition = seqSource.getPosition() + firstObject - 1;
         for (int i = 0; i < numberOfObjects; i++)
         {
+            // don't read beyond the part of the stream reserved for the object numbers
+            if (seqSource.getPosition() >= firstObjectPosition)
+            {
+                break;
+            }
             long objectNumber = readObjectNumber();
             int offset = (int) readLong();
             objectNumbers.put(offset, objectNumber);