GhostPDF - fix another category of broken PDF files

Bug #706500 "regression: new PDF engine can't handle a PDF file"

In this case the PDF file has been edited, and the original xref table
is invalid:

xref
1 7
0000000000 65535 f
0000000009 00000 n

That should, of course, be "0 7". The fact that it is '1' means we read
the expected offsets off by one each time. So object 0 gets read as
object 1 (which is then defined as a free object. Object 1 gets read
as object 2, so object 2 has the offset which points to object 1, etc.

So when we try to get the first page, object 4, we actually read object
3. Nothing is wrong apart from the fact that it's the wrong object but
obviously we check what object we got, and return an error because it
isn't the object we wanted.

This commit simply inserts another attempt to repair the file if
dereferencing an object results in no error, but no object was read
(can't see any way this is possible, but still) or the object we read
was a token not a PDF object, or the object number didn't match the
expected number (this case).

1 files changed, 9 insertions, 1 deletions

diff --git a/pdf/pdf_deref.c b/pdf/pdf_deref.c
index 632b6a9b1..ad6e1f577 100644
--- a/pdf/pdf_deref.c
+++ b/pdf/pdf_deref.c
@@ -1026,12 +1026,20 @@ static int pdfi_dereference_main(pdf_context *ctx, uint64_t obj, uint64_t gen, p
                     }
                 }
             } else {
-                pdfi_pop(ctx, 1);
+                int code1 = 0;
+
+                if (pdfi_count_stack(ctx) > 0)
+                    pdfi_pop(ctx, 1);
+
                 if (entry->free) {
                     dmprintf1(ctx->memory, "Dereference of free object %"PRIu64", next object number as offset failed, returning NULL object.\n", entry->object_num);
                     *object = PDF_NULL_OBJ;
                     return 0;
                 }
+                code1 = pdfi_repair_file(ctx);
+                if (code1 == 0)
+                    return pdfi_dereference_main(ctx, obj, gen, object, cache);
+                /* Repair failed, just give up and return an error */
                 code = gs_note_error(gs_error_undefined);
                 goto error;
             }