Infinite loop in xref table causes OOM

[nfmueller]

I've come across a PDF with the following xref table:

xref
7 1
0000061582 00000 n
22 27
0000061874 00000 n
0000063938 00000 n
0000066501 00000 n
0000068901 00000 n
0000071884 00000 n
0000072433 00000 n
0000073108 00000 n
0000073531 00000 n
0000074050 00000 n
0000074586 00000 n
0000075238 00000 n
0000075711 00000 n
0000076290 00000 n
0000076914 00000 n
0000077676 00000 n
0000078196 00000 n
0000078828 00000 n
0000079281 00000 n
0000079840 00000 n
0000080317 00000 n
0000080908 00000 n
0000083108 00000 n
0000085841 00000 n
0000088817 00000 n
0000092520 00000 n
0000092720 00000 n
0000092954 00000 n

trailer
<</Info 21 0 R/ID[<C55DAE5127C23AC8A732EE9B88B971D8><6D23C287DC7BC30F645F94862D2B65F0>]/Root 20 0 R/Size 49/Prev 93188>>
startxref
93188
%%EOF

When I attempted to create a new PdfReader from this document, my application crashed with an OOM error.
Upon debugging, it looks like there is an infinite loop in the readXref() method:

    while (true) {
      PdfNumber prev = (PdfNumber) trailer2.get(PdfName.PREV);
      if (prev == null)
        break;
      tokens.seek(prev.intValue());
      trailer2 = readXrefSection();
    }

as prev.intValue() is the same value as the startxref, which leads to a continuous allocation of memory until it crashes.

pdfinfo (by xdpfreader) confirms this:

:~ $ pdfinfo brokenpdf.pdf
Syntax Warning: Infinite loop in xref table
Syntax Error: Catalog object is wrong type (null)
Syntax Error: Couldn't read page catalog
Syntax Warning: PDF file is damaged - attempting to reconstruct xref table...
CreationDate:   Tue Nov 30 17:12:33 2021
ModDate:        Tue Nov 30 17:12:33 2021
Tagged:         no
Form:           none
Pages:          1
Encrypted:      no
Page size:      595 x 842 pts (A4) (rotated 0 degrees)
File size:      93915 bytes
Optimized:      no
PDF version:    1.4

I'm not very familiar with the pdf spec, so I'm not entirely sure if there is any other information needed. Please let me know if more info is necessary.

[mkl-public]

It is a good idea to prevent such endless loops.

Can you share the PDF in question for analysis and tests?

[nfmueller]

Unfortunately, the full pdf contains private/sensitive information and I'm not able to share it. I can share header data/data if it doesn't contain the private/sensitive info, if I'm directed on what data to share?

[mkl-public]

If you cannot share it, that's ok.

I merely prefer real-life test files, if only to be able to later point out that some error situation is not academical but real life.

[mkl-public]

Some test files:

• https://github.com/mkl-public/testarea-itext7/raw/master/src/test/resources/mkl/testarea/itext7/meta/loopInXref-stream-single.pdf
• https://github.com/mkl-public/testarea-itext7/raw/master/src/test/resources/mkl/testarea/itext7/meta/loopInXref-stream-double.pdf
• https://github.com/mkl-public/testarea-itext7/raw/master/src/test/resources/mkl/testarea/itext7/meta/loopInXref-table-single.pdf
• https://github.com/mkl-public/testarea-itext7/raw/master/src/test/resources/mkl/testarea/itext7/meta/loopInXref-table-double.pdf