fix recent regressions

* at one place, code returns from inside an fz_try which borks up the
error stack

* pdf_load_xref wrongly assumes that at least one non-empty xref has
been read if there were no errors thrown during parsing

* pdf_repair_xref skips integers when object numbers are out of range

2 files changed, 6 insertions, 8 deletions

diff --git a/source/pdf/pdf-repair.c b/source/pdf/pdf-repair.c
index 421696a2..86888089 100644
--- a/source/pdf/pdf-repair.c
+++ b/source/pdf/pdf-repair.c
@@ -335,15 +335,10 @@ pdf_repair_xref(pdf_document *xref, pdf_lexbuf *buf)
 					break;
 				}
 
-				if (num <= 0)
+				if (num <= 0 || num > MAX_OBJECT_NUMBER)
 				{
 					fz_warn(ctx, "ignoring object with invalid object number (%d %d R)", num, gen);
-					continue;
-				}
-				else if (num > MAX_OBJECT_NUMBER)
-				{
-					fz_warn(ctx, "ignoring object with invalid object number (%d %d R)", num, gen);
-					continue;
+					goto have_next_token;
 				}
 
 				gen = fz_clampi(gen, 0, 65535);
diff --git a/source/pdf/pdf-xref.c b/source/pdf/pdf-xref.c
index d4b94e3f..ad771df3 100644
--- a/source/pdf/pdf-xref.c
+++ b/source/pdf/pdf-xref.c
@@ -613,7 +613,7 @@ read_xref_section(pdf_document *xref, int ofs, pdf_lexbuf *buf, ofs_list *offset
 		if (i < offsets->len)
 		{
 			fz_warn(ctx, "ignoring xref recursion with offset %d", ofs);
-			return 0;
+			break;
 		}
 		if (offsets->len == offsets->max)
 		{
@@ -704,6 +704,9 @@ pdf_load_xref(pdf_document *xref, pdf_lexbuf *buf)
 
 	pdf_read_xref_sections(xref, xref->startxref, buf);
 
+	if (pdf_xref_len(xref) == 0)
+		fz_throw(ctx, FZ_ERROR_GENERIC, "found xref was empty");
+
 	/* broken pdfs where first object is not free */
 	if (pdf_get_xref_entry(xref, 0)->type != 'f')
 		fz_throw(ctx, FZ_ERROR_GENERIC, "first object in xref is not free");