4 files changed, 16 insertions, 40 deletions

diff --git a/core/fpdfapi/parser/cpdf_cross_ref_table.cpp b/core/fpdfapi/parser/cpdf_cross_ref_table.cpp
index d25c5e0167..77c0e8136c 100644
--- a/core/fpdfapi/parser/cpdf_cross_ref_table.cpp
+++ b/core/fpdfapi/parser/cpdf_cross_ref_table.cpp
@@ -4,21 +4,11 @@
 
 #include "core/fpdfapi/parser/cpdf_cross_ref_table.h"
 
-#include <algorithm>
 #include <utility>
 
 #include "core/fpdfapi/parser/cpdf_dictionary.h"
-#include "core/fpdfapi/parser/cpdf_number.h"
 #include "core/fpdfapi/parser/cpdf_parser.h"
 
-namespace {
-
-constexpr char kXRefStm[] = "XRefStm";
-constexpr char kPrev[] = "Prev";
-constexpr char kSize[] = "Size";
-
-}  // namespace
-
 // static
 std::unique_ptr<CPDF_CrossRefTable> CPDF_CrossRefTable::MergeUp(
     std::unique_ptr<CPDF_CrossRefTable> current,
@@ -112,24 +102,16 @@ void CPDF_CrossRefTable::Update(
   UpdateTrailer(std::move(new_cross_ref->trailer_));
 }
 
-void CPDF_CrossRefTable::ShrinkObjectMap(uint32_t max_size) {
-  if (max_size == 0) {
+void CPDF_CrossRefTable::ShrinkObjectMap(uint32_t objnum) {
+  if (objnum == 0) {
     objects_info_.clear();
     return;
   }
 
-  objects_info_.erase(objects_info_.lower_bound(max_size), objects_info_.end());
-}
-
-uint32_t CPDF_CrossRefTable::GetSize() const {
-  const uint32_t size_from_objects_num =
-      objects_info_.empty() ? 0 : (objects_info_.rbegin()->first + 1);
-  const int size_from_trailer = trailer() ? trailer()->GetIntegerFor(kSize) : 0;
-  if (size_from_trailer <= 0)
-    return size_from_objects_num;
+  objects_info_.erase(objects_info_.lower_bound(objnum), objects_info_.end());
 
-  return std::max(static_cast<uint32_t>(size_from_trailer),
-                  size_from_objects_num);
+  if (!pdfium::ContainsKey(objects_info_, objnum - 1))
+    objects_info_[objnum - 1].pos = 0;
 }
 
 void CPDF_CrossRefTable::UpdateInfo(
@@ -167,11 +149,8 @@ void CPDF_CrossRefTable::UpdateTrailer(
     return;
   }
 
-  new_trailer->RemoveFor(kXRefStm);
-  new_trailer->RemoveFor(kPrev);
-  new_trailer->SetNewFor<CPDF_Number>(
-      kSize, std::max(trailer_->GetIntegerFor(kSize),
-                      new_trailer->GetIntegerFor(kSize)));
+  new_trailer->SetFor("XRefStm", trailer_->RemoveFor("XRefStm"));
+  new_trailer->SetFor("Prev", trailer_->RemoveFor("Prev"));
 
   for (auto it = new_trailer->begin(); it != new_trailer->end();) {
     const ByteString key = it->first;
diff --git a/core/fpdfapi/parser/cpdf_cross_ref_table.h b/core/fpdfapi/parser/cpdf_cross_ref_table.h
index d8bda7125f..9631216b0c 100644
--- a/core/fpdfapi/parser/cpdf_cross_ref_table.h
+++ b/core/fpdfapi/parser/cpdf_cross_ref_table.h
@@ -60,12 +60,7 @@ class CPDF_CrossRefTable {
 
   void Update(std::unique_ptr<CPDF_CrossRefTable> new_cross_ref);
 
-  void ShrinkObjectMap(uint32_t max_size);
-
-  // The total number of entries in the file’s cross-reference table, as
-  // defined by the combination of the original section and all update
-  // section.
-  uint32_t GetSize() const;
+  void ShrinkObjectMap(uint32_t objnum);
 
  private:
   void UpdateInfo(std::map<uint32_t, ObjectInfo>&& new_objects_info);
diff --git a/core/fpdfapi/parser/cpdf_parser.cpp b/core/fpdfapi/parser/cpdf_parser.cpp
index 9bb9bf22d7..029851570a 100644
--- a/core/fpdfapi/parser/cpdf_parser.cpp
+++ b/core/fpdfapi/parser/cpdf_parser.cpp
@@ -72,8 +72,9 @@ CPDF_Parser::~CPDF_Parser() {
 }
 
 uint32_t CPDF_Parser::GetLastObjNum() const {
-  const uint32_t size = m_CrossRefTable->GetSize();
-  return size ? size - 1 : 0;
+  return m_CrossRefTable->objects_info().empty()
+             ? 0
+             : m_CrossRefTable->objects_info().rbegin()->first;
 }
 
 bool CPDF_Parser::IsValidObjectNumber(uint32_t objnum) const {
@@ -114,8 +115,8 @@ bool CPDF_Parser::IsObjectFree(uint32_t objnum) const {
   return GetObjectType(objnum) == ObjectType::kFree;
 }
 
-void CPDF_Parser::ShrinkObjectMap(uint32_t max_size) {
-  m_CrossRefTable->ShrinkObjectMap(max_size);
+void CPDF_Parser::ShrinkObjectMap(uint32_t objnum) {
+  m_CrossRefTable->ShrinkObjectMap(objnum);
 }
 
 bool CPDF_Parser::InitSyntaxParser(
@@ -741,7 +742,8 @@ bool CPDF_Parser::LoadCrossRefV5(FX_FILESIZE* pos, bool bMainXRef) {
     const uint8_t* segstart = pData + segindex * totalWidth;
     FX_SAFE_UINT32 dwMaxObjNum = startnum;
     dwMaxObjNum += count;
-    uint32_t dwV5Size = m_CrossRefTable->GetSize();
+    uint32_t dwV5Size =
+        m_CrossRefTable->objects_info().empty() ? 0 : GetLastObjNum() + 1;
     if (!dwMaxObjNum.IsValid() || dwMaxObjNum.ValueOrDie() > dwV5Size)
       continue;
 
diff --git a/core/fpdfapi/parser/cpdf_parser.h b/core/fpdfapi/parser/cpdf_parser.h
index 4ddeae8d87..83d722f88f 100644
--- a/core/fpdfapi/parser/cpdf_parser.h
+++ b/core/fpdfapi/parser/cpdf_parser.h
@@ -145,7 +145,7 @@ class CPDF_Parser {
   Error LoadLinearizedMainXRefTable();
   const CPDF_ObjectStream* GetObjectStream(uint32_t object_number);
   std::unique_ptr<CPDF_LinearizedHeader> ParseLinearizedHeader();
-  void ShrinkObjectMap(uint32_t max_size);
+  void ShrinkObjectMap(uint32_t size);
   // A simple check whether the cross reference table matches with
   // the objects.
   bool VerifyCrossRefV4();