Defer search for catalog so it can be found inside object streams too.

2 files changed, 28 insertions, 27 deletions

diff --git a/mupdf/pdf_repair.c b/mupdf/pdf_repair.c
index 3b062e79..a3f2653c 100644
--- a/mupdf/pdf_repair.c
+++ b/mupdf/pdf_repair.c
@@ -13,7 +13,7 @@ struct entry
 };
 
 static fz_error
-fz_repairobj(fz_stream *file, char *buf, int cap, int *stmofsp, int *stmlenp, int *isroot)
+fz_repairobj(fz_stream *file, char *buf, int cap, int *stmofsp, int *stmlenp)
 {
 	fz_error error;
 	pdf_token_e tok;
@@ -23,7 +23,6 @@ fz_repairobj(fz_stream *file, char *buf, int cap, int *stmofsp, int *stmlenp, in
 
 	*stmofsp = 0;
 	*stmlenp = -1;
-	*isroot = 0;
 
 	stmlen = 0;
 
@@ -39,10 +38,6 @@ fz_repairobj(fz_stream *file, char *buf, int cap, int *stmofsp, int *stmlenp, in
 		if (error)
 			return fz_rethrow(error, "cannot parse object");
 
-		obj = fz_dictgets(dict, "Type");
-		if (fz_isname(obj) && !strcmp(fz_toname(obj), "Catalog"))
-			*isroot = 1;
-
 		obj = fz_dictgets(dict, "Length");
 		if (fz_isint(obj))
 			stmlen = fz_toint(obj);
@@ -181,7 +176,6 @@ pdf_repairxref(pdf_xref *xref, char *buf, int bufsize)
 	int num = 0;
 	int gen = 0;
 	int tmpofs, numofs = 0, genofs = 0;
-	int isroot, rootnum = 0, rootgen = 0;
 	int stmlen, stmofs = 0;
 	pdf_token_e tok;
 	int next;
@@ -236,19 +230,13 @@ pdf_repairxref(pdf_xref *xref, char *buf, int bufsize)
 
 		if (tok == PDF_TOBJ)
 		{
-			error = fz_repairobj(xref->file, buf, bufsize, &stmofs, &stmlen, &isroot);
+			error = fz_repairobj(xref->file, buf, bufsize, &stmofs, &stmlen);
 			if (error)
 			{
 				error = fz_rethrow(error, "cannot parse object (%d %d R)", num, gen);
 				goto cleanup;
 			}
 
-			if (isroot) {
-				pdf_logxref("found catalog: (%d %d R)\n", num, gen);
-				rootnum = num;
-				rootgen = gen;
-			}
-
 			if (listlen + 1 == listcap)
 			{
 				listcap = (listcap * 3) / 2;
@@ -293,11 +281,7 @@ pdf_repairxref(pdf_xref *xref, char *buf, int bufsize)
 			break;
 	}
 
-	if (rootnum == 0)
-	{
-		error = fz_throw("cannot find catalog object");
-		goto cleanup;
-	}
+	/* create a repaired trailer, Root will be added later */
 
 	xref->trailer = fz_newdict(4);
 
@@ -305,10 +289,6 @@ pdf_repairxref(pdf_xref *xref, char *buf, int bufsize)
 	fz_dictputs(xref->trailer, "Size", obj);
 	fz_dropobj(obj);
 
-	obj = fz_newindirect(rootnum, rootgen, xref);
-	fz_dictputs(xref->trailer, "Root", obj);
-	fz_dropobj(obj);
-
 	if (encrypt)
 	{
 		fz_dictputs(xref->trailer, "Encrypt", encrypt);
diff --git a/mupdf/pdf_xref.c b/mupdf/pdf_xref.c
index aece3cb1..61b0c80a 100644
--- a/mupdf/pdf_xref.c
+++ b/mupdf/pdf_xref.c
@@ -531,10 +531,9 @@ pdf_openxrefwithstream(pdf_xref **xrefp, fz_stream *file, char *password)
 {
 	pdf_xref *xref;
 	fz_error error;
-	fz_obj *encrypt;
-	fz_obj *id;
-
-	int repaired = 0;
+	fz_obj *encrypt, *id;
+	fz_obj *dict, *obj;
+	int i, repaired = 0;
 
 	xref = fz_malloc(sizeof(pdf_xref));
 
@@ -597,6 +596,28 @@ pdf_openxrefwithstream(pdf_xref **xrefp, fz_stream *file, char *password)
 			pdf_freexref(xref);
 			return fz_rethrow(error, "cannot repair document");
 		}
+
+		for (i = 1; i < xref->len; i++)
+		{
+			if (xref->table[i].type == 0 || xref->table[i].type == 'f')
+				continue;
+
+			error = pdf_loadobject(&dict, xref, i, 0);
+			if (error)
+				return fz_rethrow(error, "cannot repair document");
+
+			obj = fz_dictgets(dict, "Type");
+			if (fz_isname(obj) && !strcmp(fz_toname(obj), "Catalog"))
+			{
+				pdf_logxref("found catalog: (%d %d R)\n", i, 0);
+
+				obj = fz_newindirect(i, 0, xref);
+				fz_dictputs(xref->trailer, "Root", obj);
+				fz_dropobj(obj);
+			}
+
+			fz_dropobj(dict);
+		}
 	}
 
 	*xrefp = xref;