pdf_repair.c: Skip first comment after version marker.

Some particularly broken generators forget to terminate the
comment with a newline. Skip the comment character so we'll
get some garbage tokens that we can ignore, rather than
consuming the innocent objects that follow on the same line
as the %.

1 files changed, 9 insertions, 2 deletions

diff --git a/pdf/pdf_repair.c b/pdf/pdf_repair.c
index 32dcf2b4..141cc361 100644
--- a/pdf/pdf_repair.c
+++ b/pdf/pdf_repair.c
@@ -201,7 +201,7 @@ pdf_repair_xref(pdf_xref *xref, char *buf, int bufsize)
 	int stm_len, stm_ofs = 0;
 	int tok;
 	int next;
-	int i, n;
+	int i, n, c;
 
 	fz_seek(xref->file, 0, 0);
 
@@ -222,11 +222,18 @@ pdf_repair_xref(pdf_xref *xref, char *buf, int bufsize)
 	{
 		if (memcmp(buf + i, "%PDF", 4) == 0)
 		{
-			fz_seek(xref->file, i + 7, 0); /* skip "%PDF-X.Y" */
+			fz_seek(xref->file, i + 8, 0); /* skip "%PDF-X.Y" */
 			break;
 		}
 	}
 
+	/* skip comment line after version marker since some generators
+	 * forget to terminate the comment with a newline */
+	c = fz_read_byte(xref->file);
+	while (c >= 0 && (c == ' ' || c == '%'))
+		c = fz_read_byte(xref->file);
+	fz_unread_byte(xref->file);
+
 	while (1)
 	{
 		tmpofs = fz_tell(xref->file);