Look for %PDF marker when repairing files, to stop the lexer from dying on random garbage at the beginning of files.

1 files changed, 17 insertions, 3 deletions

diff --git a/mupdf/pdf_repair.c b/mupdf/pdf_repair.c
index 1652073a..9f30a690 100644
--- a/mupdf/pdf_repair.c
+++ b/mupdf/pdf_repair.c
@@ -131,9 +131,8 @@ pdf_repairxref(pdf_xref *xref, char *buf, int bufsize)
 	int isroot, rootnum = 0, rootgen = 0;
 	int stmlen, stmofs = 0;
 	pdf_token_e tok;
-	int len;
 	int next;
-	int i;
+	int i, n;
 
 	pdf_logxref("repairxref %p\n", xref);
 
@@ -143,6 +142,21 @@ pdf_repairxref(pdf_xref *xref, char *buf, int bufsize)
 	listcap = 1024;
 	list = fz_malloc(listcap * sizeof(struct entry));
 
+	/* look for '%PDF' version marker within first kilobyte of file */
+	n = fz_read(xref->file, (unsigned char *)buf, MAX(bufsize, 1024));
+	if (n < 0)
+		return fz_rethrow(n, "cannot read from file");
+
+	fz_seek(xref->file, 0, 0);
+	for (i = 0; i < n - 4; i++)
+	{
+		if (memcmp(buf + i, "%PDF", 4) == 0)
+		{
+			fz_seek(xref->file, i, 0);
+			break;
+		}
+	}
+
 	while (1)
 	{
 		tmpofs = fz_tell(xref->file);
@@ -152,7 +166,7 @@ pdf_repairxref(pdf_xref *xref, char *buf, int bufsize)
 			goto cleanup;
 		}
 
-		error = pdf_lex(&tok, xref->file, buf, bufsize, &len);
+		error = pdf_lex(&tok, xref->file, buf, bufsize, &n);
 		if (error)
 		{
 			fz_catch(error, "ignoring the rest of the file");