Invalid reference in stream "Length" causes endless parsing

[fancycode]

Unfortunately I can't share the document, but here are some information on the problem:

• PDF is about 150 MBytes
• One of the streams has a Length entry that references another object.

<< ... /Length 880 0 R ... >>

• The referenced object 880 has this entry in the xref table (i.e. it's marked as free):

0000001044 00000 f

• The referenced object 880 is not in the PDF and the position 1044 points into the stream data of another object.

When parsing the stream, the length is parsed with

pdfcpu/pkg/pdfcpu/read.go

Line 2302 in 7188e6a

if sd.StreamLength, err = int64Object(c, ctx, *sd.StreamLengthObjNr); err != nil {

pdfcpu/pkg/pdfcpu/read.go

Line 2190 in 7188e6a

i, err := dereferencedInteger(c, ctx, objNr)

pdfcpu/pkg/pdfcpu/read.go

Line 2157 in 7188e6a

o, err := dereferencedObject(c, ctx, objNr)

pdfcpu/pkg/pdfcpu/read.go

Line 2141 in 7188e6a

o, err := ParseObjectWithContext(c, ctx, *entry.Offset, objNr, *entry.Generation)

Now, the (invalid) offset is used to parse the object

pdfcpu/pkg/pdfcpu/read.go

Line 1982 in 7188e6a

if rd, err = newPositionedReader(ctx.Read.RS, &offset); err != nil {

and the loop in

pdfcpu/pkg/pdfcpu/read.go

Line 1739 in 7188e6a

for endInd < 0 && streamInd < 0 {

never terminates. It reads the file in 1024 byte increments but doesn't terminate after a couple of minutes when I cancelled it.

My suggestion is to ignore the missing Length reference and fix the stream length in

pdfcpu/pkg/pdfcpu/read.go

Line 2326 in 7188e6a

if fixLength || l != *sd.StreamLength {