ROB: Deal with wrong size for incremental PDF files (#3495)

Author: stefan6419846

pypdf/_writer.py

@@ -78,7 +78,7 @@
 from .constants import FieldDictionaryAttributes as FA
 from .constants import PageAttributes as PG
 from .constants import TrailerKeys as TK
-from .errors import PyPdfError
+from .errors import PdfReadError, PyPdfError
 from .generic import (
     PAGE_FIT,
     ArrayObject,
@@ -1253,13 +1253,27 @@ def clone_reader_document_root(self, reader: PdfReader) -> None:
         self._root_object = reader.root_object.clone(self)
         self._pages = self._root_object.raw_get("/Pages")
 
-        assert len(self._objects) <= cast(int, reader.trailer["/Size"])  # for pytest
+        if len(self._objects) > cast(int, reader.trailer["/Size"]):
+            if self.strict:
+                raise PdfReadError(
+                    f"Object count {len(self._objects)} exceeds defined trailer size {reader.trailer['/Size']}"
+                )
+            logger_warning(
+                f"Object count {len(self._objects)} exceeds defined trailer size {reader.trailer['/Size']}",
+                __name__
+            )
+
         # must be done here before rewriting
         if self.incremental:
             self._original_hash = [
                 (obj.hash_bin() if obj is not None else 0) for obj in self._objects
             ]
-        self._flatten()
+
+        try:
+            self._flatten()
+        except IndexError:
+            raise PdfReadError("Got index error while flattening.")
+
         assert self.flattened_pages is not None
         for p in self.flattened_pages:
             self._replace_object(cast(IndirectObject, p.indirect_reference).idnum, p)

tests/test_writer.py

@@ -20,7 +20,7 @@
     Transformation,
 )
 from pypdf.annotations import Link
-from pypdf.errors import DeprecationError, PageSizeNotDefinedError, PyPdfError
+from pypdf.errors import DeprecationError, PageSizeNotDefinedError, PdfReadError, PyPdfError
 from pypdf.generic import (
     ArrayObject,
     ByteStringObject,
@@ -2851,3 +2851,26 @@ def test_unterminated_object__with_incremental_writer():
     writer.write(fi)
     b = fi.getvalue()
     assert b[-39:] == b"\nendstream\nendobj\nstartxref\n1240\n%%EOF\n"
+
+
+def test_wrong_size_in_incremental_pdf(caplog):
+    source_data = RESOURCE_ROOT.joinpath("crazyones.pdf").read_bytes()
+    writer = PdfWriter(BytesIO(source_data), incremental=True)
+    writer._add_object(DictionaryObject())
+
+    incremental_data = BytesIO()
+    writer.write(incremental_data)
+    modified_data = incremental_data.getvalue().replace(b"/Size 25", b"/Size 2")
+
+    writer = PdfWriter(BytesIO(modified_data), incremental=False)
+    assert "Object count 19 exceeds defined trailer size 2" in caplog.text
+    assert len(writer._objects) == 20
+
+    caplog.clear()
+    writer = PdfWriter(incremental=False)
+    writer.strict = True
+    with pytest.raises(expected_exception=PdfReadError, match=r"^Object count 19 exceeds defined trailer size 2$"):
+        writer.clone_reader_document_root(reader=PdfReader(BytesIO(modified_data)))
+
+    with pytest.raises(expected_exception=PdfReadError, match=r"^Got index error while flattening\.$"):
+        PdfWriter(BytesIO(modified_data), incremental=True)