Avoid adding stream objects directly to arrays in CPDF_SyntaxParser
In https://pdfium-review.googlesource.com/115611, CPDF_SyntaxParser
received the same check when adding to dictionaries. Make the behavior
consistent for arrays.
Bug: 324483125,pdfium:2119
Change-Id: I14d54020573ad02470648e14ffb59eac041ebe4b
Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/116531
Reviewed-by: Tom Sepez <tsepez@chromium.org>
Reviewed-by: Thomas Sepez <tsepez@google.com>
Commit-Queue: Lei Zhang <thestig@chromium.org>
diff --git a/core/fpdfapi/parser/cpdf_syntax_parser.cpp b/core/fpdfapi/parser/cpdf_syntax_parser.cpp
index 7b35697..e72d393 100644
--- a/core/fpdfapi/parser/cpdf_syntax_parser.cpp
+++ b/core/fpdfapi/parser/cpdf_syntax_parser.cpp
@@ -541,7 +541,10 @@
auto pArray = pdfium::MakeRetain<CPDF_Array>();
while (RetainPtr<CPDF_Object> pObj =
GetObjectBodyInternal(pObjList, ParseType::kLoose)) {
- pArray->Append(std::move(pObj));
+ // `pObj` cannot be a stream, per ISO 32000-1:2008 section 7.3.8.1.
+ if (!pObj->IsStream()) {
+ pArray->Append(std::move(pObj));
+ }
}
return (parse_type == ParseType::kLoose || m_WordBuffer[0] == ']')
? std::move(pArray)
