(pdfbox-jbig2) branch master updated: PDFBOX-6159: check symInRefSize for overshoot; fix check start position; seek to correct position after reading (if symInRefSize larger than actual size)

[tilman]

This is an automated email from the ASF dual-hosted git repository.

tilman pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/pdfbox-jbig2.git


The following commit(s) were added to refs/heads/master by this push:
     new b4ada76  PDFBOX-6159: check symInRefSize for overshoot; fix check 
start position; seek to correct position after reading (if symInRefSize larger 
than actual size)
b4ada76 is described below

commit b4ada760a683ad9f8e40c3db8da0f228c0af35f3
Author: Tilman Hausherr <til...@apache.org>
AuthorDate: Sat Jan 31 18:42:55 2026 +0100

    PDFBOX-6159: check symInRefSize for overshoot; fix check start position; 
seek to correct position after reading (if symInRefSize larger than actual size)
---
 .../org/apache/pdfbox/jbig2/segments/SymbolDictionary.java     | 10 +++++-----
 src/main/java/org/apache/pdfbox/jbig2/segments/TextRegion.java |  7 ++++---
 2 files changed, 9 insertions(+), 8 deletions(-)

diff --git 
a/src/main/java/org/apache/pdfbox/jbig2/segments/SymbolDictionary.java 
b/src/main/java/org/apache/pdfbox/jbig2/segments/SymbolDictionary.java
index 4ec5ef5..390b311 100644
--- a/src/main/java/org/apache/pdfbox/jbig2/segments/SymbolDictionary.java
+++ b/src/main/java/org/apache/pdfbox/jbig2/segments/SymbolDictionary.java
@@ -654,13 +654,13 @@ public class SymbolDictionary implements Dictionary
             rdx = (int) StandardTables.getTable(15).decode(subInputStream);
             rdy = (int) StandardTables.getTable(15).decode(subInputStream);
 
-            streamPosition0 = subInputStream.getStreamPosition();
-
             /* 5) a) */
             symInRefSize = StandardTables.getTable(1).decode(subInputStream);
 
             /* 5) b) - Skip over remaining bits */
             subInputStream.skipBits();
+
+            streamPosition0 = subInputStream.getStreamPosition();
         }
         else
         {
@@ -678,13 +678,13 @@ public class SymbolDictionary implements Dictionary
         /* 7) */
         if (isHuffmanEncoded)
         {
-            subInputStream.skipBits();
-            // Make sure that the processed bytes are equal to the value read 
in step 5 a)
-            if (subInputStream.getStreamPosition() != streamPosition0 + 
symInRefSize)
+            // Make sure that the processed bytes are not more than 
symInRefSize
+            if (subInputStream.getStreamPosition() > streamPosition0 + 
symInRefSize)
             {
                 throw new IOException("Refinement bitmap bytes expected: " + 
symInRefSize +
                         ", bytes read: " + (subInputStream.getStreamPosition() 
- streamPosition0));
             }
+            subInputStream.seek(streamPosition0 + symInRefSize); // needed if 
less
         }
     }
 
diff --git a/src/main/java/org/apache/pdfbox/jbig2/segments/TextRegion.java 
b/src/main/java/org/apache/pdfbox/jbig2/segments/TextRegion.java
index 942b7df..a460de7 100644
--- a/src/main/java/org/apache/pdfbox/jbig2/segments/TextRegion.java
+++ b/src/main/java/org/apache/pdfbox/jbig2/segments/TextRegion.java
@@ -654,12 +654,12 @@ public class TextRegion implements Region
 
             /* 5) */
             long symInRefSize = 0;
-            long streamPosition0 = subInputStream.getStreamPosition();
             if (isHuffmanEncoded)
             {
                 symInRefSize = decodeSymInRefSize();
                 subInputStream.skipBits();
             }
+            long streamPosition0 = subInputStream.getStreamPosition();
 
             /* 6) */
             final Bitmap ibo = symbols.get((int) id);
@@ -683,12 +683,13 @@ public class TextRegion implements Region
             /* 7 */
             if (isHuffmanEncoded)
             {
-                subInputStream.skipBits();
-                if (subInputStream.getStreamPosition() != streamPosition0 + 
symInRefSize)
+                // Make sure that the processed bytes are not more than 
symInRefSize
+                if (subInputStream.getStreamPosition() > streamPosition0 + 
symInRefSize)
                 {
                     throw new IOException("Refinement bitmap bytes expected: " 
+ symInRefSize +
                             ", bytes read: " + 
(subInputStream.getStreamPosition() - streamPosition0));
                 }
+                subInputStream.seek(streamPosition0 + symInRefSize); // needed 
if less
             }
         }
         return ib;