/*

  *  Copyright (C) 2007-2008, 2010 Sourcefire, Inc.

  *

  *  Authors: Nigel Horne, Török Edvin
  *
  *  Also based on Matt Olney's pdf parser in snort-nrt.

  *
  *  This program is free software; you can redistribute it and/or modify

  *  it under the terms of the GNU General Public License version 2 as
  *  published by the Free Software Foundation.

  *
  *  This program is distributed in the hope that it will be useful,
  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *
  *  You should have received a copy of the GNU General Public License
  *  along with this program; if not, write to the Free Software

  *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
  *  MA 02110-1301, USA.

  *
  * TODO: Embedded fonts
  * TODO: Predictor image handling

  */

 static	char	const	rcsid[] = "$Id: pdf.c,v 1.61 2007/02/12 20:46:09 njh Exp $";

 
 #if HAVE_CONFIG_H
 #include "clamav-config.h"
 #endif
 

 #include <stdio.h>
 #include <sys/types.h>
 #include <sys/stat.h>
 #include <ctype.h>
 #include <string.h>
 #include <fcntl.h>
 #include <stdlib.h>

 #include <errno.h>

 #ifdef	HAVE_LIMITS_H
 #include <limits.h>
 #endif

 #ifdef	HAVE_UNISTD_H
 #include <unistd.h>
 #endif

 #include <zlib.h>
 

 #include "clamav.h"
 #include "others.h"

 #include "pdf.h"

 #include "scanners.h"

 #include "fmap.h"

 #include "str.h"

 #include "bytecode.h"
 #include "bytecode_api.h"

 #ifdef	CL_DEBUG

 /*#define	SAVE_TMP	
  *Save the file being worked on in tmp */

 #endif
 

 static	int	asciihexdecode(const char *buf, off_t len, char *output);

 static	int	ascii85decode(const char *buf, off_t len, unsigned char *output);

 static	const	char	*pdf_nextlinestart(const char *ptr, size_t len);

 static	const	char	*pdf_nextobject(const char *ptr, size_t len);

 #if 1

 static int xrefCheck(const char *xref, const char *eof)
 {
     const char *q;

     while (xref < eof && (*xref == ' ' || *xref == '\n' || *xref == '\r'))

 	xref++;
     if (xref + 4 >= eof)
 	return -1;
     if (!memcmp(xref, "xref", 4)) {
 	cli_dbgmsg("cli_pdf: found xref\n");
 	return 0;
     }
     /* could be xref stream */
     for (q=xref; q+5 < eof; q++) {
 	if (!memcmp(q,"/XRef",4)) {
 	    cli_dbgmsg("cli_pdf: found /XRef\n");
 	    return 0;
 	}
     }
     return -1;
 }
 
 struct pdf_struct {
     struct pdf_obj *objs;
     unsigned nobjs;

     unsigned flags;

     const char *map;
     off_t size;
     off_t offset;

     off_t startoff;

     cli_ctx *ctx;
     const char *dir;
     unsigned files;

 };
 
 static const char *findNextNonWSBack(const char *q, const char *start)
 {
     while (q > start &&
 	   (*q == 0 || *q == 9 || *q == 0xa || *q == 0xc || *q == 0xd || *q == 0x20))
     {
 	q--;
     }
     return q;
 }
 

 static int find_stream_bounds(const char *start, off_t bytesleft, off_t bytesleft2, off_t *stream, off_t *endstream)

 {
     const char *q2, *q;
     if ((q2 = cli_memstr(start, bytesleft, "stream", 6))) {
 	q2 += 6;
 	if (q2[0] == '\xd' && q2[1] == '\xa')
 	    q2 += 2;
 	if (q2[0] == '\xa')
 	    q2++;
 	*stream = q2 - start;

 	bytesleft2 -= q2 - start;

 	q = q2;

 	q2 = cli_memstr(q, bytesleft2, "endstream", 9);

 	if (!q2)

 	    q2 = q + bytesleft2-9; /* till EOF */

 	*endstream = q2 - start;

 	if (*endstream < *stream)
 	    *endstream = *stream;

 	return 1;
     }
     return 0;
 }
 

 static int pdf_findobj(struct pdf_struct *pdf)

 {

     const char *start, *q, *q2, *q3, *eof;

     struct pdf_obj *obj;
     off_t bytesleft;
     unsigned genid, objid;
 
     pdf->nobjs++;
     pdf->objs = cli_realloc2(pdf->objs, sizeof(*pdf->objs)*pdf->nobjs);
     if (!pdf->objs) {

 	cli_warnmsg("cli_pdf: out of memory parsing objects (%u)\n", pdf->nobjs);

 	return -1;
     }
     obj = &pdf->objs[pdf->nobjs-1];

     memset(obj, 0, sizeof(*obj));

     start = pdf->map+pdf->offset;
     bytesleft = pdf->size - pdf->offset;
     q2 = cli_memstr(start, bytesleft, " obj", 4);
     if (!q2)
 	return 0;/* no more objs */
     bytesleft -= q2 - start;
     q = findNextNonWSBack(q2-1, start);
     while (q > start && isdigit(*q)) { q--; }
     genid = atoi(q);
     q = findNextNonWSBack(q-1,start);
     while (q > start && isdigit(*q)) { q--; }
     objid = atoi(q);
     obj->id = (objid << 8) | (genid&0xff);
     obj->start = q2+4 - pdf->map;
     obj->flags = 0;
     bytesleft -= 4;
     eof = pdf->map + pdf->size;
     q = pdf->map + obj->start;
     while (q < eof && bytesleft > 0) {

 	off_t p_stream, p_endstream;

 	q2 = pdf_nextobject(q, bytesleft);
 	if (!q2)

 	    q2 = pdf->map + pdf->size;

 	bytesleft -= q2 - q;

 	if (find_stream_bounds(q-1, q2-q, bytesleft + (q2-q), &p_stream, &p_endstream)) {

 	    obj->flags |= 1 << OBJ_STREAM;

 	    q2 = q-1 + p_endstream + 9;

 	    bytesleft -= q2 - q + 1;

 	    if (bytesleft < 0) {
 		obj->flags |= 1 << OBJ_TRUNCATED;
 		pdf->offset = pdf->size;
 		return 1;/* truncated */
 	    }

 	} else if ((q3 = cli_memstr(q-1, q2-q+1, "endobj", 6))) {
 	    q2 = q3 + 6;

 	    pdf->offset = q2 - pdf->map;
 	    return 1; /* obj found and offset positioned */
 	} else {

 	    q2++;

 	    bytesleft--;

 	}
 	q = q2;
     }

     obj->flags |= 1 << OBJ_TRUNCATED;
     pdf->offset = pdf->size;
     return 1;/* truncated */

 }
 

 static int filter_writen(struct pdf_struct *pdf, struct pdf_obj *obj,

 			 int fout, const char *buf, off_t len, off_t *sum)

 {
     if (cli_checklimits("pdf", pdf->ctx, *sum, 0, 0))
 	return len; /* pretend it was a successful write to suppress CL_EWRITE */
     *sum += len;
     return cli_writen(fout, buf, len);
 }
 

 static void pdfobj_flag(struct pdf_struct *pdf, struct pdf_obj *obj, enum pdf_flag flag)
 {
     const char *s= "";
     pdf->flags |= 1 << flag;
     if (!cli_debug_flag)
 	return;
     switch (flag) {
 	case UNTERMINATED_OBJ_DICT:
 	    s = "dictionary not terminated";
 	    break;
 	case ESCAPED_COMMON_PDFNAME:
 	    /* like /JavaScript */
 	    s = "escaped common pdfname";
 	    break;
 	case BAD_STREAM_FILTERS:
 	    s = "duplicate stream filters";
 	    break;
 	case BAD_PDF_VERSION:
 	    s = "bad pdf version";
 	    break;
 	case BAD_PDF_HEADERPOS:
 	    s = "bad pdf header position";
 	    break;
 	case BAD_PDF_TRAILER:
 	    s = "bad pdf trailer";
 	    break;
 	case BAD_PDF_TOOMANYOBJS:
 	    s = "too many pdf objs";
 	    break;
 	case BAD_FLATE:
 	    s = "bad deflate stream";
 	    break;

 	case BAD_FLATESTART:
 	    s = "bad deflate stream start";
 	    break;

 	case BAD_STREAMSTART:
 	    s = "bad stream start";
 	    break;
 	case UNKNOWN_FILTER:
 	    s = "unknown filter used";
 	    break;
 	case BAD_ASCIIDECODE:
 	    s = "bad ASCII decode";
 	    break;
 	case HEX_JAVASCRIPT:
 	    s = "hex javascript";
 	    break;
 	case BAD_INDOBJ:
 	    s = "referencing nonexistent obj";
 	    break;
 	case HAS_OPENACTION:
 	    s = "has /OpenAction";
 	    break;
 	case BAD_STREAMLEN:
 	    s = "bad /Length, too small";
 	    break;

 	case ENCRYPTED_PDF:
 	    s = "PDF is encrypted";
 	    break;

 	case LINEARIZED_PDF:
 	    s = "linearized PDF";
 	    break;

 	case MANY_FILTERS:
 	    s = "more than 2 filters per obj";
 	    break;

     }

     cli_dbgmsg("cli_pdf: %s flagged in object %u %u\n", s, obj->id>>8, obj->id&0xff);

 }
 

 static int filter_flatedecode(struct pdf_struct *pdf, struct pdf_obj *obj,

 			      const char *buf, off_t len, int fout, off_t *sum)

 {

     int skipped = 0;

     int zstat;

     z_stream stream;
     off_t nbytes;

     char output[BUFSIZ];

 
     if (len == 0)
 	return CL_CLEAN;

 
     if (*buf == '\r') {
 	buf++;
 	len--;
 	pdfobj_flag(pdf, obj, BAD_STREAMSTART);
 	/* PDF spec says stream is followed by \r\n or \n, but not \r alone.
 	 * Sample 0015315109, it has \r followed by zlib header.
 	 * Flag pdf as suspicious, and attempt to extract by skipping the \r.
 	 */
 	if (!len)
 	    return CL_CLEAN;
     }
 

     memset(&stream, 0, sizeof(stream));
     stream.next_in = (Bytef *)buf;
     stream.avail_in = len;

     stream.next_out = (Bytef *)output;

     stream.avail_out = sizeof(output);
 
     zstat = inflateInit(&stream);
     if(zstat != Z_OK) {
 	cli_warnmsg("cli_pdf: inflateInit failed\n");
 	return CL_EMEM;
     }
 
     nbytes = 0;
     while(stream.avail_in) {

 	int written;

 	zstat = inflate(&stream, Z_NO_FLUSH);	/* zlib */
 	switch(zstat) {
 	    case Z_OK:
 		if(stream.avail_out == 0) {
 		    if ((written=filter_writen(pdf, obj, fout, output, sizeof(output), sum))!=sizeof(output)) {
 			cli_errmsg("cli_pdf: failed to write output file\n");
 			inflateEnd(&stream);
 			return CL_EWRITE;
 		    }
 		    nbytes += written;

 		    stream.next_out = (Bytef *)output;

 		    stream.avail_out = sizeof(output);
 		}
 		continue;
 	    case Z_STREAM_END:
 	    default:

 		written = sizeof(output) - stream.avail_out;

 		if (!written && !nbytes && !skipped) {
 		    /* skip till EOL, and try inflating from there, sometimes
 		     * PDFs contain extra whitespace */
 		    const char *q = pdf_nextlinestart(buf, len);
 		    if (q) {
 			skipped = 1;
 			buf = q;
 			inflateEnd(&stream);
 			len -= q - buf;
 			stream.next_in = (Bytef *)buf;
 			stream.avail_in = len;
 			stream.next_out = (Bytef *)output;
 			stream.avail_out = sizeof(output);
 			zstat = inflateInit(&stream);
 			if(zstat != Z_OK) {
 			    cli_warnmsg("cli_pdf: inflateInit failed\n");
 			    return CL_EMEM;
 			}
 			pdfobj_flag(pdf, obj, BAD_FLATESTART);
 			continue;
 		    }
 		}
 

 		if (filter_writen(pdf, obj, fout, output, written, sum)!=written) {
 		    cli_errmsg("cli_pdf: failed to write output file\n");
 		    inflateEnd(&stream);
 		    return CL_EWRITE;
 		}
 		nbytes += written;
 		stream.next_out = (Bytef *)output;
 		stream.avail_out = sizeof(output);

 		if (zstat == Z_STREAM_END)
 		    break;

 		if(stream.msg)
 		    cli_dbgmsg("cli_pdf: after writing %lu bytes, got error \"%s\" inflating PDF stream in %u %u obj\n",
 			       (unsigned long)nbytes,
 			       stream.msg, obj->id>>8, obj->id&0xff);
 		else
 		    cli_dbgmsg("cli_pdf: after writing %lu bytes, got error %d inflating PDF stream in %u %u obj\n",
 			       (unsigned long)nbytes, zstat, obj->id>>8, obj->id&0xff);

 		/* mark stream as bad only if not encrypted */

 		inflateEnd(&stream);

 		if (!nbytes) {
 		    cli_dbgmsg("cli_pdf: dumping raw stream (probably encrypted)\n");
 		    if (filter_writen(pdf, obj, fout, buf, len, sum) != len) {
 			cli_errmsg("cli_pdf: failed to write output file\n");
 			return CL_EWRITE;
 		    }
 		    pdfobj_flag(pdf, obj, BAD_FLATESTART);
 		} else {
 		    pdfobj_flag(pdf, obj, BAD_FLATE);
 		}

 		return CL_CLEAN;
 	}
 	break;
     }
 
     if(stream.avail_out != sizeof(output)) {
 	if(filter_writen(pdf, obj, fout, output, sizeof(output) - stream.avail_out, sum) < 0) {
 	    cli_errmsg("cli_pdf: failed to write output file\n");
 	    inflateEnd(&stream);
 	    return CL_EWRITE;
 	}
     }
 
     inflateEnd(&stream);
     return CL_CLEAN;
 }
 
 static struct pdf_obj *find_obj(struct pdf_struct *pdf,
 				struct pdf_obj *obj, uint32_t objid)
 {

     unsigned j;
     unsigned i;
 
     /* search starting at previous obj (if exists) */
     if (obj != pdf->objs)
 	i = obj - pdf->objs;
     else
 	i = 0;

     for (j=i;j<pdf->nobjs;j++) {
 	obj = &pdf->objs[j];
 	if (obj->id == objid)
 	    return obj;
     }
     /* restart search from beginning if not found */
     for (j=0;j<i;j++) {
 	obj = &pdf->objs[j];
 	if (obj->id == objid)
 	    return obj;
     }
     return NULL;
 }
 
 static int find_length(struct pdf_struct *pdf,
 		       struct pdf_obj *obj,
 		       const char *start, off_t len)
 {
     int length;
     const char *q;
     q = cli_memstr(start, len, "/Length", 7);
     if (!q)
 	return 0;
     q++;
     len -= q - start;
     start = pdf_nextobject(q, len);
     if (!start)
 	return 0;

     /* len -= start - q; */

     q = start;
     length = atoi(q);
     while (isdigit(*q)) q++;
     if (*q == ' ') {
 	int genid;
 	q++;
 	genid = atoi(q);
 	while(isdigit(*q)) q++;
 	if (q[0] == ' ' && q[1] == 'R') {
 	    cli_dbgmsg("cli_pdf: length is in indirect object %u %u\n", length, genid);
 	    obj = find_obj(pdf, obj, (length << 8) | (genid&0xff));
 	    if (!obj) {
 		cli_dbgmsg("cli_pdf: indirect object not found\n");
 		return 0;
 	    }
 	    q = pdf_nextobject(pdf->map+obj->start, pdf->size - obj->start);
 	    length = atoi(q);
 	}
     }

     /* limit length */
     if (start - pdf->map + length+5 > pdf->size) {
 	length = pdf->size - (start - pdf->map)-5;
     }

     return length;
 }
 

 #define DUMP_MASK ((1 << OBJ_FILTER_FLATE) | (1 << OBJ_FILTER_DCT) | (1 << OBJ_FILTER_AH) | (1 << OBJ_FILTER_A85) | (1 << OBJ_EMBEDDED_FILE) | (1 << OBJ_JAVASCRIPT) | (1 << OBJ_OPENACTION))

 static int obj_size(struct pdf_struct *pdf, struct pdf_obj *obj, int binary)

 {

     unsigned i = obj - pdf->objs;

     i++;
     if (i < pdf->nobjs) {

 	int s = pdf->objs[i].start - obj->start - 4;

 	if (s > 0) {
 	    if (!binary) {
 		const char *p = pdf->map + obj->start;
 		const char *q = p + s;
 		while (q > p && (isspace(*q) || isdigit(*q)))
 		       q--;
 		if (q > p+5 && !memcmp(q-5,"endobj",6))
 		    q -= 6;
 		q = findNextNonWSBack(q, p);
 		q++;
 		return q - p;
 	    }

 	    return s;

 	}

     }

     if (binary)
 	return pdf->size - obj->start;
     return pdf->offset - obj->start - 6;

 }
 

 static int run_pdf_hooks(struct pdf_struct *pdf, enum pdf_phase phase, int fd,
 			 int dumpid)
 {
     int ret;
     struct cli_bc_ctx *bc_ctx;
     cli_ctx *ctx = pdf->ctx;
     fmap_t *map;
 
     bc_ctx = cli_bytecode_context_alloc();
     if (!bc_ctx) {
 	cli_errmsg("cli_pdf: can't allocate memory for bc_ctx");
 	return CL_EMEM;
     }
 
     map = *ctx->fmap;
     if (fd != -1) {
 	map = fmap(fd, 0, 0);
 	if (!map) {
 	    cli_warnmsg("can't mmap pdf extracted obj\n");
 	    map = *ctx->fmap;
 	    fd = -1;
 	}
     }
     cli_bytecode_context_setpdf(bc_ctx, phase, pdf->nobjs, pdf->objs,
 				&pdf->flags, pdf->size, pdf->startoff);
     cli_bytecode_context_setctx(bc_ctx, ctx);
     ret = cli_bytecode_runhook(ctx, ctx->engine, bc_ctx, BC_PDF, map, ctx->virname);
     cli_bytecode_context_destroy(bc_ctx);
     if (fd != -1) {
 	funmap(map);
     }
     return ret;
 }
 

 static int pdf_extract_obj(struct pdf_struct *pdf, struct pdf_obj *obj)
 {

     char fullname[NAME_MAX + 1];
     int fout;
     off_t sum = 0;

     int rc = CL_SUCCESS;

     char *ascii_decoded = NULL;

     int dump = 1;

     /* TODO: call bytecode hook here, allow override dumpability */

     if ((!(obj->flags & (1 << OBJ_STREAM)) ||
 	(obj->flags & (1 << OBJ_HASFILTERS)))
 	&& !(obj->flags & DUMP_MASK)) {

 	/* don't dump all streams */

 	dump = 0;

     }

     if ((obj->flags & (1 << OBJ_IMAGE)) &&
 	!(obj->flags & (1 << OBJ_FILTER_DCT))) {
 	/* don't dump / scan non-JPG images */

 	dump = 0;

     }

     if (obj->flags & (1 << OBJ_FORCEDUMP)) {
 	/* bytecode can force dump by setting this flag */
 	dump = 1;
     }
     if (!dump)
 	return CL_CLEAN;
     cli_dbgmsg("cli_pdf: dumping obj %u %u\n", obj->id>>8, obj->id);

     snprintf(fullname, sizeof(fullname), "%s"PATHSEP"pdf%02u", pdf->dir, pdf->files++);
     fout = open(fullname,O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_BINARY, 0600);
     if (fout < 0) {
 	char err[128];
 	cli_errmsg("cli_pdf: can't create temporary file %s: %s\n", fullname, cli_strerror(errno, err, sizeof(err)));
 	free(ascii_decoded);
 	return CL_ETMPFILE;
     }
 
     do {
     if (obj->flags & (1 << OBJ_STREAM)) {

 	const char *start = pdf->map + obj->start;
 	off_t p_stream = 0, p_endstream = 0;
 	off_t length;
 	find_stream_bounds(start, pdf->size - obj->start,

 			   pdf->size - obj->start,

 			   &p_stream, &p_endstream);
 	if (p_stream && p_endstream) {
 	    const char *flate_in;
 	    long ascii_decoded_size = 0;
 	    size_t size = p_endstream - p_stream;

 	    off_t orig_length;

 	    length = find_length(pdf, obj, start, p_stream);
 	    if (length < 0)
 		length = 0;
 	    orig_length = length;

 	    if (length > pdf->size || obj->start + p_stream + length > pdf->size) {
 		cli_dbgmsg("cli_pdf: length out of file: %ld + %ld > %ld\n",
 			   p_stream, length, pdf->size);
 		length = pdf->size - (obj->start + p_stream);
 	    }

 	    if (!(obj->flags & (1 << OBJ_FILTER_FLATE)) && length <= 0) {

 		const char *q = start + p_endstream;
 		length = size;
 		q--;
 		if (*q == '\n') {
 		    q--;
 		    length--;
 		    if (*q == '\r')
 			length--;
 		} else if (*q == '\r') {
 		    length--;
 		}

 		if (length < 0)
 		    length = 0;

 		cli_dbgmsg("cli_pdf: calculated length %ld\n", length);

 	    } else {
 		if (size > length+2) {
 		    cli_dbgmsg("cli_pdf: calculated length %ld < %ld\n",
 			       length, size);
 		    length = size;
 		}

 	    }

 	    if (orig_length && size > orig_length + 20) {
 		cli_dbgmsg("cli_pdf: orig length: %ld, length: %ld, size: %ld\n",
 			   orig_length, length, size);

 		pdfobj_flag(pdf, obj, BAD_STREAMLEN);

 	    }

 	    if (!length)
 		length = size;
 
 	    if (obj->flags & (1 << OBJ_FILTER_AH)) {

 		ascii_decoded = cli_malloc(length/2 + 1);

 		if (!ascii_decoded) {
 		    cli_errmsg("Cannot allocate memory for asciidecode\n");

 		    rc = CL_EMEM;
 		    break;

 		}
 		ascii_decoded_size = asciihexdecode(start + p_stream,
 						    length,
 						    ascii_decoded);
 	    } else if (obj->flags & (1 << OBJ_FILTER_A85)) {

 		ascii_decoded = cli_malloc(length*5);

 		if (!ascii_decoded) {
 		    cli_errmsg("Cannot allocate memory for asciidecode\n");

 		    rc = CL_EMEM;
 		    break;

 		}
 		ascii_decoded_size = ascii85decode(start+p_stream,
 						   length,

 						   (unsigned char*)ascii_decoded);

 	    }
 	    if (ascii_decoded_size < 0) {

 		/* don't flag for images or truncated objs*/
 		if (!(obj->flags &
 		      ((1 << OBJ_IMAGE) | (1 << OBJ_TRUNCATED))))
 		    pdfobj_flag(pdf, obj, BAD_ASCIIDECODE);

 		cli_dbgmsg("cli_pdf: failed to asciidecode in %u %u obj\n", obj->id>>8,obj->id&0xff);

 		free(ascii_decoded);
 		ascii_decoded = NULL;
 		/* attempt to directly flatedecode it */

 	    }
 	    /* either direct or ascii-decoded input */
 	    if (!ascii_decoded)
 		ascii_decoded_size = length;
 	    flate_in = ascii_decoded ? ascii_decoded : start+p_stream;
 
 	    if (obj->flags & (1 << OBJ_FILTER_FLATE)) {

 		cli_dbgmsg("cli_pdf: deflate len %ld (orig %ld)\n", ascii_decoded_size, (long)orig_length);

 		rc = filter_flatedecode(pdf, obj, flate_in, ascii_decoded_size, fout, &sum);
 	    } else {

 		if (filter_writen(pdf, obj, fout, flate_in, ascii_decoded_size, &sum) != ascii_decoded_size)
 		    rc = CL_EWRITE;

 	    }

 	}
     } else if (obj->flags & (1 << OBJ_JAVASCRIPT)) {
 	const char *q2;
 	const char *q = pdf->map+obj->start;
 	/* TODO: get obj-endobj size */

 	off_t bytesleft = obj_size(pdf, obj, 0);

 	if (bytesleft < 0)
 	    break;

 
 	q2 = cli_memstr(q, bytesleft, "/JavaScript", 11);
 	if (!q2)
 	    break;
 	bytesleft -= q2 - q;

 	do {
 	q2++;
 	bytesleft--;

 	q = pdf_nextobject(q2, bytesleft);
 	if (!q)
 	    break;
 	bytesleft -= q - q2;

 	q2 = q;
 	} while (*q == '/');
 	if (!q)
 	    break;

 	if (*q == '(') {
 	    if (filter_writen(pdf, obj, fout, q+1, bytesleft-1, &sum) != (bytesleft-1)) {
 		rc = CL_EWRITE;
 		break;
 	    }
 	} else if (*q == '<') {
 	    char *decoded;
 	    q2 = memchr(q+1, '>', bytesleft);
 	    if (!q2) q2 = q + bytesleft;
 	    decoded = cli_malloc(q2 - q);
 	    if (!decoded) {
 		rc = CL_EMEM;
 		break;
 	    }
 	    cli_hex2str_to(q2, decoded, q2-q-1);
 	    decoded[q2-q-1] = '\0';
 	    cli_dbgmsg("cli_pdf: found hexadecimal encoded javascript in %u %u obj\n",
 		       obj->id>>8, obj->id&0xff);

 	    pdfobj_flag(pdf, obj, HEX_JAVASCRIPT);

 	    filter_writen(pdf, obj, fout, decoded, q2-q-1, &sum);
 	    free(decoded);

 	}

     } else {
 	off_t bytesleft = obj_size(pdf, obj, 0);
 	if (filter_writen(pdf, obj, fout , pdf->map + obj->start, bytesleft,&sum) != bytesleft)
 	    rc = CL_EWRITE;

     }

     } while (0);

     cli_dbgmsg("cli_pdf: extracted %ld bytes %u %u obj to %s\n", sum, obj->id>>8, obj->id&0xff, fullname);

     if (sum) {
 	int rc2;
 	cli_updatelimits(pdf->ctx, sum);
 	/* TODO: invoke bytecode on this pdf obj with metainformation associated
 	 * */
 	lseek(fout, 0, SEEK_SET);
 	rc2 = cli_magic_scandesc(fout, pdf->ctx);
 	if (rc2 == CL_VIRUS || rc == CL_SUCCESS)
 	    rc = rc2;
 	if (rc == CL_CLEAN) {
 	    rc2 = run_pdf_hooks(pdf, PDF_PHASE_POSTDUMP, fout, obj - pdf->objs);
 	    if (rc2 == CL_VIRUS)
 		rc = rc2;
 	}
     }

     close(fout);
     free(ascii_decoded);
     if (!pdf->ctx->engine->keeptmp)
 	if (cli_unlink(fullname) && rc != CL_VIRUS)
 	    rc = CL_EUNLINK;

     return rc;
 }
 

 enum objstate {
     STATE_NONE,
     STATE_S,
     STATE_FILTER,

     STATE_JAVASCRIPT,

     STATE_OPENACTION,

     STATE_LINEARIZED,

     STATE_ANY /* for actions table below */
 };
 
 struct pdfname_action {
     const char *pdfname;

     enum pdf_objflags set_objflag;/* OBJ_DICT is noop */

     enum objstate from_state;/* STATE_NONE is noop */
     enum objstate to_state;
 };
 
 static struct pdfname_action pdfname_actions[] = {
     {"ASCIIHexDecode", OBJ_FILTER_AH, STATE_FILTER, STATE_FILTER},
     {"ASCII85Decode", OBJ_FILTER_A85, STATE_FILTER, STATE_FILTER},

     {"A85", OBJ_FILTER_A85, STATE_FILTER, STATE_FILTER},

     {"AHx", OBJ_FILTER_AH, STATE_FILTER, STATE_FILTER},

     {"EmbeddedFile", OBJ_EMBEDDED_FILE, STATE_NONE, STATE_NONE},

     {"FlateDecode", OBJ_FILTER_FLATE, STATE_FILTER, STATE_FILTER},

     {"Fl", OBJ_FILTER_FLATE, STATE_FILTER, STATE_FILTER},

     {"Image", OBJ_IMAGE, STATE_NONE, STATE_NONE},

     {"LZWDecode", OBJ_FILTER_LZW, STATE_FILTER, STATE_FILTER},

     {"LZW", OBJ_FILTER_LZW, STATE_FILTER, STATE_FILTER},

     {"RunLengthDecode", OBJ_FILTER_RL, STATE_FILTER, STATE_FILTER},

     {"RL", OBJ_FILTER_RL, STATE_FILTER, STATE_FILTER},

     {"CCITTFaxDecode", OBJ_FILTER_FAX, STATE_FILTER, STATE_FILTER},

     {"CCF", OBJ_FILTER_FAX, STATE_FILTER, STATE_FILTER},

     {"JBIG2Decode", OBJ_FILTER_DCT, STATE_FILTER, STATE_FILTER},
     {"DCTDecode", OBJ_FILTER_DCT, STATE_FILTER, STATE_FILTER},

     {"DCT", OBJ_FILTER_DCT, STATE_FILTER, STATE_FILTER},

     {"JPXDecode", OBJ_FILTER_JPX, STATE_FILTER, STATE_FILTER},
     {"Crypt",  OBJ_FILTER_CRYPT, STATE_FILTER, STATE_NONE},

     {"Standard", OBJ_FILTER_CRYPT, STATE_FILTER, STATE_FILTER},

     {"Sig",    OBJ_SIGNED, STATE_ANY, STATE_NONE},
     {"V",     OBJ_SIGNED, STATE_ANY, STATE_NONE},

     {"R",     OBJ_SIGNED, STATE_ANY, STATE_NONE},

     {"Linearized", OBJ_DICT, STATE_NONE, STATE_LINEARIZED},

     {"Filter", OBJ_HASFILTERS, STATE_ANY, STATE_FILTER},

     {"JavaScript", OBJ_JAVASCRIPT, STATE_S, STATE_JAVASCRIPT},

     {"Length", OBJ_DICT, STATE_FILTER, STATE_NONE},
     {"S", OBJ_DICT, STATE_NONE, STATE_S},

     {"Type", OBJ_DICT, STATE_NONE, STATE_NONE},
     {"OpenAction", OBJ_OPENACTION, STATE_ANY, STATE_OPENACTION}

 };
 

 #define KNOWN_FILTERS ((1 << OBJ_FILTER_AH) | (1 << OBJ_FILTER_RL) | (1 << OBJ_FILTER_A85) | (1 << OBJ_FILTER_FLATE) | (1 << OBJ_FILTER_LZW) | (1 << OBJ_FILTER_FAX) | (1 << OBJ_FILTER_DCT) | (1 << OBJ_FILTER_JPX) | (1 << OBJ_FILTER_CRYPT))

 static void handle_pdfname(struct pdf_struct *pdf, struct pdf_obj *obj,
 			   const char *pdfname, int escapes,

 			   enum objstate *state)

 {
     struct pdfname_action *act = NULL;
     unsigned j;
     for (j=0;j<sizeof(pdfname_actions)/sizeof(pdfname_actions[0]);j++) {

 	if (!strcmp(pdfname, pdfname_actions[j].pdfname)) {

 	    act = &pdfname_actions[j];
 	    break;
 	}
     }

     if (!act) {
 	if (*state == STATE_FILTER &&

 	    !(obj->flags & (1 << OBJ_SIGNED)) &&
 	    /* these are digital signature objects, filter doesn't matter,
 	     * we don't need them anyway */

 	    !(obj->flags & KNOWN_FILTERS)) {
 	    cli_dbgmsg("cli_pdf: unknown filter %s\n", pdfname);

 	    obj->flags |= 1 << OBJ_FILTER_UNKNOWN;

 	}

 	return;

     }

     if (escapes) {
 	/* if a commonly used PDF name is escaped that is certainly
 	   suspicious. */
 	cli_dbgmsg("cli_pdf: pdfname %s is escaped\n", pdfname);
 	pdfobj_flag(pdf, obj, ESCAPED_COMMON_PDFNAME);
     }
     if (act->from_state == *state ||
 	act->from_state == STATE_ANY) {
 	*state = act->to_state;
 
 	if (*state == STATE_FILTER &&
 	    act->set_objflag !=OBJ_DICT &&
 	    (obj->flags & (1 << act->set_objflag))) {

 	    cli_dbgmsg("cli_pdf: duplicate stream filter %s\n", pdfname);

 	    pdfobj_flag(pdf, obj, BAD_STREAM_FILTERS);
 	}
 	obj->flags |= 1 << act->set_objflag;
     } else {

 	/* auto-reset states */

 	switch (*state) {
 	    case STATE_S:
 		*state = STATE_NONE;
 		break;

 	    default:
 		break;

 	}
     }
 }
 
 static void pdf_parseobj(struct pdf_struct *pdf, struct pdf_obj *obj)
 {
     /* enough to hold common pdf names, we don't need all the names */
     char pdfname[64];
     const char *q2, *q3;
     const char *q = obj->start + pdf->map;
     const char *dict, *start;
     off_t dict_length;

     off_t bytesleft = obj_size(pdf, obj, 1);
     unsigned i, filters=0;

     enum objstate objstate = STATE_NONE;
 
     if (bytesleft < 0)
 	return;
     start = q;
     /* find start of dictionary */
     do {
 	q2 = pdf_nextobject(q, bytesleft);
 	bytesleft -= q2 -q;
 	if (!q2 || bytesleft < 0) {
 	    return;
 	}
 	q3 = memchr(q-1, '<', q2-q+1);
 	q2++;
 	bytesleft--;
 	q = q2;
     } while (!q3 || q3[1] != '<');
     dict = q3+2;
     q = dict;

     bytesleft = obj_size(pdf, obj, 1) - (q - start);

     /* find end of dictionary */
     do {
 	q2 = pdf_nextobject(q, bytesleft);
 	bytesleft -= q2 -q;
 	if (!q2 || bytesleft < 0) {
 	    return;
 	}
 	q3 = memchr(q-1, '>', q2-q+1);
 	q2++;
 	bytesleft--;
 	q = q2;
     } while (!q3 || q3[1] != '>');
     obj->flags |= 1 << OBJ_DICT;
     dict_length = q3 - dict;
 

     /*  process pdf names */

     for (q = dict;dict_length;) {
 	int escapes = 0;
 	q2 = memchr(q, '/', dict_length);
 	if (!q2)
 	    break;
 	dict_length -= q2 - q;

 	q = q2;

 	/* normalize PDF names */

 	for (i = 0;dict_length && (i < sizeof(pdfname)-1); i++) {
 	    q++;
 	    dict_length--;
 	    if (*q == '#') {
 		cli_hex2str_to(q+1, pdfname+i, 2);
 		q += 2;
 		dict_length -= 2;
 		escapes = 1;
 		continue;
 	    }

 	    if (*q == ' ' || *q == '\t' || *q == '\r' || *q == '\n' ||

 		*q == '/' || *q == '>' || *q == ']' || *q == '[' || *q == '<')

 		break;
 	    pdfname[i] = *q;
 	}
 	pdfname[i] = '\0';
 

 	handle_pdfname(pdf, obj, pdfname, escapes, &objstate);

 	if (objstate == STATE_LINEARIZED) {
 	    pdfobj_flag(pdf, obj, LINEARIZED_PDF);
 	    objstate = STATE_NONE;
 	}

 	if (objstate == STATE_JAVASCRIPT ||
 	    objstate == STATE_OPENACTION) {
 	    if (objstate == STATE_OPENACTION)
 		pdfobj_flag(pdf, obj, HAS_OPENACTION);

 	    q2 = pdf_nextobject(q, dict_length);
 	    if (q2 && isdigit(*q2)) {
 		uint32_t objid = atoi(q2) << 8;
 		while (isdigit(*q2)) q2++;
 		q2 = pdf_nextobject(q2, dict_length);
 		if (q2 && isdigit(*q2)) {
 		    objid |= atoi(q2) & 0xff;
 		    q2 = pdf_nextobject(q2, dict_length);
 		    if (*q2 == 'R') {
 			struct pdf_obj *obj2;

 			cli_dbgmsg("cli_pdf: found %s stored in indirect object %u %u\n",
 				   pdfname,

 				   objid >> 8, objid&0xff);
 			obj2 = find_obj(pdf, obj, objid);

 			if (obj2) {

 			    enum pdf_objflags flag = objstate == STATE_JAVASCRIPT ?

 				OBJ_JAVASCRIPT : OBJ_OPENACTION;
 			    obj2->flags |= 1 << flag;
 			    obj->flags &= ~(1 << flag);
 			} else {
 			    pdfobj_flag(pdf, obj, BAD_INDOBJ);
 			}

 		    }
 		}
 	    }
 	    objstate = STATE_NONE;
 	}

     }

     for (i=0;i<sizeof(pdfname_actions)/sizeof(pdfname_actions[0]);i++) {
 	const struct pdfname_action *act = &pdfname_actions[i];
 	if ((obj->flags & (1 << act->set_objflag)) &&
 	    act->from_state == STATE_FILTER &&
 	    act->to_state == STATE_FILTER &&
 	    act->set_objflag != OBJ_FILTER_CRYPT) {
 	    filters++;
 	}
     }
     if (filters > 2) { /* more than 2 non-crypt filters */
 	pdfobj_flag(pdf, obj, MANY_FILTERS);
     }

     if (obj->flags & ((1 << OBJ_SIGNED) | KNOWN_FILTERS))
 	obj->flags &= ~(1 << OBJ_FILTER_UNKNOWN);
     if (obj->flags & (1 << OBJ_FILTER_UNKNOWN))
 	pdfobj_flag(pdf, obj, UNKNOWN_FILTER);

     cli_dbgmsg("cli_pdf: %u %u obj flags: %02x\n", obj->id>>8, obj->id&0xff, obj->flags);
 }
 

 int cli_pdf(const char *dir, cli_ctx *ctx, off_t offset)
 {
     struct pdf_struct pdf;
     fmap_t *map = *ctx->fmap;
     size_t size = map->len - offset;
     off_t versize = size > 1032 ? 1032 : size;
     off_t map_off, bytesleft;
     long xref;
     const char *pdfver, *start, *eofmap, *q, *eof;
     int rc;

     unsigned i;

 
     cli_dbgmsg("in cli_pdf(%s)\n", dir);
     memset(&pdf, 0, sizeof(pdf));

     pdf.ctx = ctx;
     pdf.dir = dir;

 
     pdfver = start = fmap_need_off_once(map, offset, versize);
 
     /* Check PDF version */
     if (!pdfver) {

 	cli_errmsg("cli_pdf: mmap() failed (1)\n");

 	return CL_EMAP;
     }
     /* offset is 0 when coming from filetype2 */
     pdfver = cli_memstr(pdfver, versize, "%PDF-", 5);
     if (!pdfver) {
 	cli_dbgmsg("cli_pdf: no PDF- header found\n");
 	return CL_SUCCESS;
     }
     /* Check for PDF-1.[0-9]. Although 1.7 is highest now, allow for future
      * versions */
     if (pdfver[5] != '1' || pdfver[6] != '.' ||
 	pdfver[7] < '1' || pdfver[7] > '9') {

 	pdf.flags |= 1 << BAD_PDF_VERSION;

 	cli_dbgmsg("cli_pdf: bad pdf version: %.8s\n", pdfver);
     }
     if (pdfver != start || offset) {

 	pdf.flags |= 1 << BAD_PDF_HEADERPOS;

 	cli_dbgmsg("cli_pdf: PDF header is not at position 0: %ld\n",pdfver-start+offset);

     }
     offset += pdfver - start;
 
     /* find trailer and xref, don't fail if not found */
     map_off = map->len - 2048;
     if (map_off < 0)
 	map_off = 0;
     bytesleft = map->len - map_off;
     eofmap = fmap_need_off_once(map, map_off, bytesleft);
     if (!eofmap) {

 	cli_errmsg("cli_pdf: mmap() failed (2)\n");

 	return CL_EMAP;
     }
     eof = eofmap + bytesleft;
     for (q=&eofmap[bytesleft-5]; q > eofmap; q--) {
 	if (memcmp(q, "%%EOF", 5) == 0)
 	    break;
     }
     if (q <= eofmap) {

 	pdf.flags |= 1 << BAD_PDF_TRAILER;

 	cli_dbgmsg("cli_pdf: %%%%EOF not found\n");
     } else {

 	const char *t;

 	size = q - eofmap + map_off;
 	for (;q > eofmap;q--) {
 	    if (memcmp(q, "startxref", 9) == 0)
 		break;
 	}
 	if (q <= eofmap) {

 	    pdf.flags |= 1 << BAD_PDF_TRAILER;
 	    cli_dbgmsg("cli_pdf: startxref not found\n");

 	} else {
 	    for (t=q;t > eofmap; t--) {
 		if (memcmp(t,"trailer",7) == 0)
 		    break;
 	    }
 	    if (t > eofmap) {
 		if (cli_memstr(t, q-t, "/Encrypt", 8)) {
 		    pdf.flags |= 1 << ENCRYPTED_PDF;
 		    cli_dbgmsg("cli_pdf: encrypted pdf found, stream will probably fail to decompress!\n");
 		}
 	    }
 	    q += 9;
 	    while (q < eof && (*q == ' ' || *q == '\n' || *q == '\r')) { q++; }
 	    xref = atol(q);
 	    bytesleft = map->len - offset - xref;
 	    if (bytesleft > 4096)
 		bytesleft = 4096;
 	    q = fmap_need_off_once(map, offset + xref, bytesleft);
 	    if (!q || xrefCheck(q, q+bytesleft) == -1) {
 		cli_dbgmsg("cli_pdf: did not find valid xref\n");
 		pdf.flags |= 1 << BAD_PDF_TRAILER;
 	    }

 	}
     }

     size -= offset;

 
     pdf.size = size;

     pdf.map = fmap_need_off(map, offset, size);
     pdf.startoff = offset;

     if (!pdf.map) {

 	cli_errmsg("cli_pdf: mmap() failed (3)\n");

 	return CL_EMAP;
     }

     /* parse PDF and find obj offsets */

     while ((rc = pdf_findobj(&pdf)) > 0) {

 	struct pdf_obj *obj = &pdf.objs[pdf.nobjs-1];
 	cli_dbgmsg("found %d %d obj @%ld\n", obj->id >> 8, obj->id&0xff, obj->start + offset);
     }

     if (pdf.nobjs)
 	pdf.nobjs--;

     if (rc == -1)

 	pdf.flags |= 1 << BAD_PDF_TOOMANYOBJS;

     /* must parse after finding all objs, so we can flag indirect objects */
     for (i=0;i<pdf.nobjs;i++) {
 	struct pdf_obj *obj = &pdf.objs[i];
 	pdf_parseobj(&pdf, obj);
     }
 

     rc = run_pdf_hooks(&pdf, PDF_PHASE_PARSED, -1, -1);

     /* extract PDF objs */

     for (i=0;!rc && i<pdf.nobjs;i++) {

 	struct pdf_obj *obj = &pdf.objs[i];
 	rc = pdf_extract_obj(&pdf, obj);
     }
 

     if (pdf.flags & (1 << ENCRYPTED_PDF))

 	pdf.flags &= ~ ((1 << BAD_FLATESTART) | (1 << BAD_STREAMSTART) |
 	    (1 << BAD_ASCIIDECODE));

    if (pdf.flags && !rc) {

 	cli_dbgmsg("cli_pdf: flags 0x%02x\n", pdf.flags);

 	rc = run_pdf_hooks(&pdf, PDF_PHASE_END, -1, -1);
 	if (!rc && (ctx->options & CL_SCAN_ALGORITHMIC)) {
 	    if (pdf.flags & (1 << ESCAPED_COMMON_PDFNAME)) {
 		/* for example /Fl#61te#44#65#63#6f#64#65 instead of /FlateDecode */
 		*ctx->virname = "Heuristics.PDF.ObfuscatedNameObject";

 		rc = cli_found_possibly_unwanted(ctx);

 	    }
 	}

 #if 0

 	/* TODO: find both trailers, and /Encrypt settings */
 	if (pdf.flags & (1 << LINEARIZED_PDF))
 	    pdf.flags &= ~ (1 << BAD_ASCIIDECODE);

 	if (pdf.flags & (1 << MANY_FILTERS))
 	    pdf.flags &= ~ (1 << BAD_ASCIIDECODE);

 	if (!rc && (pdf.flags &

 	    ((1 << BAD_PDF_TOOMANYOBJS) | (1 << BAD_STREAM_FILTERS) |

 	     (1<<BAD_FLATE) | (1<<BAD_ASCIIDECODE)|
     	     (1<<UNTERMINATED_OBJ_DICT) | (1<<UNKNOWN_FILTER)))) {

 	    rc = CL_EUNPACK;
 	}
 #endif

     }

     cli_dbgmsg("cli_pdf: returning %d\n", rc);
     free(pdf.objs);
     return rc;

 }
 

 #else

 static	int	try_flatedecode(unsigned char *buf, off_t real_len, off_t calculated_len, int fout, cli_ctx *ctx);
 static	int	flatedecode(unsigned char *buf, off_t len, int fout, cli_ctx *ctx);

 int

 cli_pdf(const char *dir, cli_ctx *ctx, off_t offset)

 {

 	off_t size;	/* total number of bytes in the file */

 	off_t bytesleft, trailerlength;

 	char *buf;	/* start of memory mapped area */

 	const char *p, *q, *trailerstart;

 	const char *xrefstart;	/* cross reference table */

 	/*size_t xreflength;*/

 	int printed_predictor_message, printed_embedded_font_message, rc;

 	unsigned int files;

 	fmap_t *map = *ctx->fmap;

 	int opt_failed = 0;

 	cli_dbgmsg("in cli_pdf(%s)\n", dir);

 	size = map->len - offset;

 	if(size <= 7)	/* doesn't even include the file header */

 		return CL_CLEAN;

 	p = buf = fmap_need_off_once(map, 0, size); /* FIXME: really port to fmap */

 	if(!buf) {

 		cli_errmsg("cli_pdf: mmap() failed\n");

 		return CL_EMAP;

 	}
 

 	cli_dbgmsg("cli_pdf: scanning %lu bytes\n", (unsigned long)size);

 	/* Lines are terminated by \r, \n or both */
 
 	/* File Header */

 	bytesleft = size - 5;
 	for(q = p; bytesleft; bytesleft--, q++) {
 	    if(!strncasecmp(q, "%PDF-", 5)) {
 		bytesleft = size - (off_t) (q - p);
 		p = q;
 		break;
 	    }

 	}
 

 	if(!bytesleft) {
 	    cli_dbgmsg("cli_pdf: file header not found\n");
 	    return CL_CLEAN;

 	}
 
 	/* Find the file trailer */

 	for(q = &p[bytesleft - 5]; q > p; --q)
 		if(strncasecmp(q, "%%EOF", 5) == 0)

 			break;
 

 	if(q <= p) {

 		cli_dbgmsg("cli_pdf: trailer not found\n");
 		return CL_CLEAN;

 	}
 

 	for(trailerstart = &q[-7]; trailerstart > p; --trailerstart)

 		if(memcmp(trailerstart, "trailer", 7) == 0)

 			break;
 
 	/*

 	 * q points to the end of the trailer section

 	 */

 	trailerlength = (long)(q - trailerstart);

 	if(cli_memstr(trailerstart, trailerlength, "Encrypt", 7)) {

 		/*
 		 * This tends to mean that the file is, in effect, read-only

 		 * http://www.cs.cmu.edu/~dst/Adobe/Gallery/anon21jul01-pdf-encryption.txt
 		 * http://www.adobe.com/devnet/pdf/

 		 */

 		cli_dbgmsg("cli_pdf: Encrypted PDF files not yet supported\n");
 		return CL_CLEAN;

 	}
 

 	/*
 	 * not true, since edits may put data after the trailer

 	bytesleft -= trailerlength;

 	 */

 	/*
 	 * FIXME: Handle more than one xref section in the xref table
 	 */

 	for(xrefstart = trailerstart; xrefstart > p; --xrefstart)
 		if(memcmp(xrefstart, "xref", 4) == 0)

 			/*
 			 * Make sure it's the start of the line, not a startxref
 			 * token
 			 */
 			if((xrefstart[-1] == '\n') || (xrefstart[-1] == '\r'))
 				break;

 
 	if(xrefstart == p) {

 		cli_dbgmsg("cli_pdf: xref not found\n");
 		return CL_CLEAN;

 	}
 

 	printed_predictor_message = printed_embedded_font_message = 0;
 

 	/*
 	 * not true, since edits may put data after the trailer

 	xreflength = (size_t)(trailerstart - xrefstart);

 	bytesleft -= xreflength;

 	 */

 	files = 0;
 

 	rc = CL_CLEAN;
 

 	/*

 	 * The body section consists of a sequence of indirect objects

 	 */

 	while((p < xrefstart) && (cli_checklimits("cli_pdf", ctx, 0, 0, 0)==CL_CLEAN) &&

 	      ((q = pdf_nextobject(p, bytesleft)) != NULL)) {

 		int is_ascii85decode, is_flatedecode, fout, len, has_cr;

 		/*int object_number, generation_number;*/

 		const char *objstart, *objend, *streamstart, *streamend;

 		unsigned long length, objlen, real_streamlen, calculated_streamlen;

 		int is_embedded_font, predictor;

 		char fullname[NAME_MAX + 1];

 		rc = CL_CLEAN;

 		if(q == xrefstart)
 			break;
 		if(memcmp(q, "xref", 4) == 0)
 			break;

 
 		/*object_number = atoi(q);*/

 		bytesleft -= (off_t)(q - p);

 		p = q;
 
 		if(memcmp(q, "endobj", 6) == 0)
 			continue;

 		if(!isdigit(*q)) {

 			cli_dbgmsg("cli_pdf: Object number missing\n");

 			break;
 		}
 		q = pdf_nextobject(p, bytesleft);
 		if((q == NULL) || !isdigit(*q)) {

 			cli_dbgmsg("cli_pdf: Generation number missing\n");

 			break;
 		}

 		/*generation_number = atoi(q);*/

 		bytesleft -= (off_t)(q - p);

 		p = q;
 
 		q = pdf_nextobject(p, bytesleft);
 		if((q == NULL) || (memcmp(q, "obj", 3) != 0)) {

 			cli_dbgmsg("cli_pdf: Indirect object missing \"obj\"\n");

 			break;
 		}
 

 		bytesleft -= (off_t)((q - p) + 3);

 		objstart = p = &q[3];

 		objend = cli_memstr(p, bytesleft, "endobj", 6);

 		if(objend == NULL) {

 			cli_dbgmsg("cli_pdf: No matching endobj\n");

 			break;
 		}

 		bytesleft -= (off_t)((objend - p) + 6);

 		p = &objend[6];

 		objlen = (unsigned long)(objend - objstart);

 		/* Is this object a stream? */

 		streamstart = cli_memstr(objstart, objlen, "stream", 6);

 		if(streamstart == NULL)
 			continue;

 		is_embedded_font = length = is_ascii85decode =
 			is_flatedecode = 0;
 		predictor = 1;
 

 		/*
 		 * TODO: handle F and FFilter?
 		 */

 		q = objstart;
 		while(q < streamstart) {

 			if(*q == '/') {	/* name object */

 				/*cli_dbgmsg("Name object %8.8s\n", q+1, q+1);*/

 				if(strncmp(++q, "Length ", 7) == 0) {
 					q += 7;
 					length = atoi(q);
 					while(isdigit(*q))
 						q++;

 					/*
 					 * Note: incremental updates are not
 					 *	supported
 					 */
 					if((bytesleft > 11) && strncmp(q, " 0 R", 4) == 0) {

 						const char *r, *nq;

 						char b[14];

 
 						q += 4;

 						cli_dbgmsg("cli_pdf: Length is in indirect obj %lu\n",

 							length);
 						snprintf(b, sizeof(b),

 							"%lu 0 obj", length);

 						length = (unsigned long)strlen(b);

 						/* optimization: assume objects
 						 * are sequential */

 						if(!opt_failed) {
 						    nq = q;
 						    len = buf + size - q;
 						} else {
 						    nq = buf;
 						    len = q - buf;
 						}

 						do {

 							r = cli_memstr(nq, len, b, length);

 							if (r > nq) {
 								const char x = *(r-1);
 								if (x == '\n' || x=='\r') {
 									--r;
 									break;
 								}
 							}
 							if (r) {

 								len -= r + length - nq;
 								nq = r + length;

 							} else if (!opt_failed) {
 								/* we failed optimized match,
 								 * try matching from the beginning
 								 */
 								len = q - buf;
 								r = nq = buf;
 								/* prevent
 								 * infloop */
 								opt_failed = 1;
 							}
 						} while (r);

 						if(r) {
 							r += length - 1;
 							r = pdf_nextobject(r, bytesleft - (r - q));
 							if(r) {
 								length = atoi(r);
 								while(isdigit(*r))
 									r++;

 								cli_dbgmsg("cli_pdf: length in '%s' %lu\n",

 									&b[1],
 									length);

 							}
 						} else

 							cli_dbgmsg("cli_pdf: Couldn't find '%s'\n",

 								&b[1]);

 					}

 					q--;

 				} else if(strncmp(q, "Length2 ", 8) == 0)
 					is_embedded_font = 1;
 				else if(strncmp(q, "Predictor ", 10) == 0) {
 					q += 10;
 					predictor = atoi(q);
 					while(isdigit(*q))
 						q++;
 					q--;

 				} else if(strncmp(q, "FlateDecode", 11) == 0) {

 					is_flatedecode = 1;

 					q += 11;
 				} else if(strncmp(q, "ASCII85Decode", 13) == 0) {

 					is_ascii85decode = 1;

 					q += 13;

 				}
 			}

 			q = pdf_nextobject(q, (size_t)(streamstart - q));

 			if(q == NULL)
 				break;
 		}

 		if(is_embedded_font) {
 			/*
 			 * Need some documentation, the only I can find a

 			 * reference to is not free, if some kind soul wishes

 			 * to donate a copy, please contact me!
 			 * (http://safari.adobepress.com/0321304748)
 			 */
 			if(!printed_embedded_font_message) {

 				cli_dbgmsg("cli_pdf: Embedded fonts not yet supported\n");

 				printed_embedded_font_message = 1;
 			}
 			continue;
 		}
 		if(predictor > 1) {
 			/*
 			 * Needs some thought
 			 */
 			if(!printed_predictor_message) {

 				cli_dbgmsg("cli_pdf: Predictor %d not honoured for embedded image\n",

 					predictor);
 				printed_predictor_message = 1;
 			}
 			continue;
 		}
 

 		/* objend points to the end of the object (start of "endobj") */
 		streamstart += 6;	/* go past the word "stream" */
 		len = (int)(objend - streamstart);
 		q = pdf_nextlinestart(streamstart, len);
 		if(q == NULL)

 			break;

 		len -= (int)(q - streamstart);
 		streamstart = q;

 		streamend = cli_memstr(streamstart, len, "endstream\n", 10);

 		if(streamend == NULL) {

 			streamend = cli_memstr(streamstart, len, "endstream\r", 10);

 			if(streamend == NULL) {

 				cli_dbgmsg("cli_pdf: No endstream\n");

 				break;
 			}

 			has_cr = 1;

 		} else
 			has_cr = 0;

 		snprintf(fullname, sizeof(fullname), "%s"PATHSEP"pdf%02u", dir, files);

 		fout = open(fullname, O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_BINARY, 0600);

 		if(fout < 0) {

 			char err[128];
 			cli_errmsg("cli_pdf: can't create temporary file %s: %s\n", fullname, cli_strerror(errno, err, sizeof(err)));

 			rc = CL_ETMPFILE;
 			break;

 		}
 

 		/*
 		 * Calculate the length ourself, the Length parameter is often
 		 * wrong
 		 */

 		if((*--streamend != '\n') && (*streamend != '\r'))

 			streamend++;

 		else if(has_cr && (*--streamend != '\r'))

 			streamend++;

 
 		if(streamend <= streamstart) {

 			close(fout);

 			cli_dbgmsg("cli_pdf: Empty stream\n");

 			if (cli_unlink(fullname)) {

 				rc = CL_EUNLINK;

 				break;
 			}

 			continue;
 		}

 		calculated_streamlen = (int)(streamend - streamstart);

 		real_streamlen = length;
 

 		cli_dbgmsg("cli_pdf: length %lu, calculated_streamlen %lu isFlate %d isASCII85 %d\n",

 			length, calculated_streamlen,
 			is_flatedecode, is_ascii85decode);

 		if(calculated_streamlen != real_streamlen) {
 			cli_dbgmsg("cli_pdf: Incorrect Length field in file attempting to recover\n");
 			if(real_streamlen > calculated_streamlen)
 				real_streamlen = calculated_streamlen;
 		}

 #if	0
 		/* FIXME: this isn't right... */
 		if(length)
 			/*streamlen = (is_flatedecode) ? length : MIN(length, streamlen);*/
 			streamlen = MIN(length, streamlen);
 #endif
 

 		if(is_ascii85decode) {

 			unsigned char *tmpbuf;

 			int ret = cli_checklimits("cli_pdf", ctx, calculated_streamlen * 5, calculated_streamlen, real_streamlen);

 
 			if(ret != CL_CLEAN) {
 				close(fout);

 				if (cli_unlink(fullname)) {

 					rc = CL_EUNLINK;

 					break;
 				}

 				continue;
 			}
 
 			tmpbuf = cli_malloc(calculated_streamlen * 5);

 			if(tmpbuf == NULL) {

 				close(fout);

 				if (cli_unlink(fullname)) {

 					rc = CL_EUNLINK;

 					break;
 				}

 				continue;
 			}
 

 			ret = ascii85decode(streamstart, calculated_streamlen, tmpbuf);

 			if(ret == -1) {

 				free(tmpbuf);

 				close(fout);

 				if (cli_unlink(fullname)) {

 					rc = CL_EUNLINK;

 					break;
 				}

 				continue;
 			}

 			if(ret) {

 				unsigned char *t;

 				unsigned size;

 
 				real_streamlen = ret;

 				/* free unused trailing bytes */

 				size = real_streamlen > calculated_streamlen ? real_streamlen : calculated_streamlen;
 				t = (unsigned char *)cli_realloc(tmpbuf,size);

 				if(t == NULL) {
 					free(tmpbuf);
 					close(fout);

 					if (cli_unlink(fullname)) {

 						rc = CL_EUNLINK;

 						break;
 					}

 					continue;
 				}
 				tmpbuf = t;

 				/*
 				 * Note that it will probably be both
 				 * ascii85encoded and flateencoded
 				 */

 				if(is_flatedecode)
 					rc = try_flatedecode((unsigned char *)tmpbuf, real_streamlen, real_streamlen, fout, ctx);
 				else

 				  rc = (unsigned long)cli_writen(fout, (const char *)streamstart, real_streamlen)==real_streamlen ? CL_CLEAN : CL_EWRITE;

 			}

 			free(tmpbuf);

 		} else if(is_flatedecode) {

 			rc = try_flatedecode((unsigned char *)streamstart, real_streamlen, calculated_streamlen, fout, ctx);
 

 		} else {

 			cli_dbgmsg("cli_pdf: writing %lu bytes from the stream\n",

 				(unsigned long)real_streamlen);

 			if((rc = cli_checklimits("cli_pdf", ctx, real_streamlen, 0, 0))==CL_CLEAN)

 				rc = (unsigned long)cli_writen(fout, (const char *)streamstart, real_streamlen) == real_streamlen ? CL_CLEAN : CL_EWRITE;

 		}

 		if (rc == CL_CLEAN) {

 			cli_dbgmsg("cli_pdf: extracted file %u to %s\n", files, fullname);
 			files++;

 	
 			lseek(fout, 0, SEEK_SET);
 			rc = cli_magic_scandesc(fout, ctx);
 		}

 		close(fout);

 		if(!ctx->engine->keeptmp)

 			if (cli_unlink(fullname)) rc = CL_EUNLINK;

 		if(rc != CL_CLEAN) break;

 	}
 

 	cli_dbgmsg("cli_pdf: returning %d\n", rc);

 	return rc;

 }

 /*

  * flate inflation

  */

 static int

 try_flatedecode(unsigned char *buf, off_t real_len, off_t calculated_len, int fout, cli_ctx *ctx)

 {

 	int ret = cli_checklimits("cli_pdf", ctx, real_len, 0, 0);

 	if (ret==CL_CLEAN && flatedecode(buf, real_len, fout, ctx) == CL_SUCCESS)

 		return CL_CLEAN;

 	if(real_len == calculated_len) {
 		/*
 		 * Nothing more we can do to inflate
 		 */

 		cli_dbgmsg("cli_pdf: Bad compression in flate stream\n");
 		return CL_CLEAN;

 	}

 	if(cli_checklimits("cli_pdf", ctx, calculated_len, 0, 0)!=CL_CLEAN)
 		return CL_CLEAN;
 

 	ret = flatedecode(buf, calculated_len, fout, ctx);

 	if(ret == CL_CLEAN)
 		return CL_CLEAN;

 
 	/* i.e. the PDF file is broken :-( */

 	cli_dbgmsg("cli_pdf: Bad compressed block length in flate stream\n");

 
 	return ret;

 }
 
 static int

 flatedecode(unsigned char *buf, off_t len, int fout, cli_ctx *ctx)

 {

 	int zstat, ret;

 	off_t nbytes;

 	z_stream stream;
 	unsigned char output[BUFSIZ];

 #ifdef	SAVE_TMP
 	char tmpfilename[16];
 	int tmpfd;
 #endif

 	cli_dbgmsg("cli_pdf: flatedecode %lu bytes\n", (unsigned long)len);

 	if(len == 0) {

 		cli_dbgmsg("cli_pdf: flatedecode len == 0\n");

 		return CL_CLEAN;

 	}
 

 #ifdef	SAVE_TMP
 	/*
 	 * Copy the embedded area for debugging, so that if it falls over
 	 * we have a copy of the offending data. This is debugging code
 	 * that you shouldn't of course install in a live environment. I am
 	 * not interested in hearing about security issues with this section
 	 * of the parser.
 	 */
 	strcpy(tmpfilename, "/tmp/pdfXXXXXX");
 	tmpfd = mkstemp(tmpfilename);
 	if(tmpfd < 0) {
 		perror(tmpfilename);

 		cli_errmsg("cli_pdf: Can't make debugging file\n");

 	} else {
 		FILE *tmpfp = fdopen(tmpfd, "w");
 
 		if(tmpfp) {
 			fwrite(buf, sizeof(char), len, tmpfp);
 			fclose(tmpfp);

 			cli_dbgmsg("cli_pdf: flatedecode: debugging file is %s\n",
 				tmpfilename);

 		} else
 			cli_errmsg("cli_pdf: can't fdopen debugging file\n");
 	}
 #endif

 	stream.zalloc = (alloc_func)Z_NULL;
 	stream.zfree = (free_func)Z_NULL;
 	stream.opaque = (void *)NULL;

 	stream.next_in = (Bytef *)buf;

 	stream.avail_in = len;

 	stream.next_out = output;
 	stream.avail_out = sizeof(output);

 
 	zstat = inflateInit(&stream);
 	if(zstat != Z_OK) {

 		cli_warnmsg("cli_pdf: inflateInit failed\n");

 		return CL_EMEM;

 	}

 	nbytes = 0;

 	while(stream.avail_in) {

 		zstat = inflate(&stream, Z_NO_FLUSH);	/* zlib */

 		switch(zstat) {
 			case Z_OK:

 				if(stream.avail_out == 0) {

 				  	int written;
 					if ((written=cli_writen(fout, output, sizeof(output)))!=sizeof(output)) {
 						cli_errmsg("cli_pdf: failed to write output file\n");
 						inflateEnd(&stream);

 						return CL_EWRITE;

 					}
 					nbytes += written;

 					if((ret=cli_checklimits("cli_pdf", ctx, nbytes, 0, 0))!=CL_CLEAN) {

 						inflateEnd(&stream);

 						return ret;

 					}

 					stream.next_out = output;

 					stream.avail_out = sizeof(output);

 				}

 				continue;
 			case Z_STREAM_END:
 				break;
 			default:

 				if(stream.msg)

 					cli_dbgmsg("cli_pdf: after writing %lu bytes, got error \"%s\" inflating PDF attachment\n",

 						(unsigned long)nbytes,
 						stream.msg);

 				else

 					cli_dbgmsg("cli_pdf: after writing %lu bytes, got error %d inflating PDF attachment\n",

 						(unsigned long)nbytes, zstat);

 				inflateEnd(&stream);

 				return CL_CLEAN;

 		}
 		break;
 	}
 

 	if(stream.avail_out != sizeof(output)) {
 		if(cli_writen(fout, output, sizeof(output) - stream.avail_out) < 0) {
 			cli_errmsg("cli_pdf: failed to write output file\n");
 			inflateEnd(&stream);

 			return CL_EWRITE;

 		}
 	}
 			

 #ifdef	SAVE_TMP

 	if (cli_unlink(tmpfilename)) {
 		inflateEnd(&stream);

 		return CL_EUNLINK;

 	}

 #endif

 	inflateEnd(&stream);
 	return CL_CLEAN;

 }

 #endif

 static int asciihexdecode(const char *buf, off_t len, char *output)

 {
     unsigned i,j;

     for (i=0,j=0;i+1<len;i++) {

 	if (buf[i] == ' ')
 	    continue;
 	if (buf[i] == '>')
 	    break;

 	if (cli_hex2str_to(buf+i, output+j++, 2) == -1) {
 	    if (len - i < 4)
 		continue;
 	    return -1;
 	}

 	i++;

     }
     return j;
 }

 /*
  * ascii85 inflation, returns number of bytes in output, -1 for error
  *
  * See http://www.piclist.com/techref/method/encode.htm (look for base85)
  */

 static int

 ascii85decode(const char *buf, off_t len, unsigned char *output)

 {

 	const char *ptr;

 	uint32_t sum = 0;
 	int quintet = 0;
 	int ret = 0;
 

 	if(cli_memstr(buf, len, "~>", 2) == NULL)

 		cli_dbgmsg("cli_pdf: ascii85decode: no EOF marker found\n");

 
 	ptr = buf;
 

 	cli_dbgmsg("cli_pdf: ascii85decode %lu bytes\n", (unsigned long)len);

 	while(len > 0) {
 		int byte = (len--) ? (int)*ptr++ : EOF;

 
 		if((byte == '~') && (*ptr == '>'))
 			byte = EOF;
 
 		if(byte >= '!' && byte <= 'u') {

 			sum = (sum * 85) + ((uint32_t)byte - '!');

 			if(++quintet == 5) {

 				*output++ = (unsigned char)(sum >> 24);
 				*output++ = (unsigned char)((sum >> 16) & 0xFF);
 				*output++ = (unsigned char)((sum >> 8) & 0xFF);
 				*output++ = (unsigned char)(sum & 0xFF);

 				ret += 4;
 				quintet = 0;
 				sum = 0;
 			}
 		} else if(byte == 'z') {
 			if(quintet) {

 				cli_dbgmsg("ascii85decode: unexpected 'z'\n");

 				return -1;
 			}
 			*output++ = '\0';
 			*output++ = '\0';
 			*output++ = '\0';
 			*output++ = '\0';
 			ret += 4;
 		} else if(byte == EOF) {

 			cli_dbgmsg("ascii85decode: quintet %d\n", quintet);

 			if(quintet) {
 				int i;
 
 				if(quintet == 1) {

 					cli_dbgmsg("ascii85Decode: only 1 byte in last quintet\n");

 					return -1;
 				}

 				for(i = quintet; i < 5; i++)
 					sum *= 85;
 

 				if(quintet > 1)
 					sum += (0xFFFFFF >> ((quintet - 2) * 8));
 				ret += quintet;
 				for(i = 0; i < quintet - 1; i++)

 					*output++ = (unsigned char)((sum >> (24 - 8 * i)) & 0xFF);

 			}
 			break;
 		} else if(!isspace(byte)) {

 			cli_dbgmsg("ascii85Decode: invalid character 0x%x, len %lu\n",

 				byte & 0xFF, (unsigned long)len);

 			return -1;
 		}
 	}
 	return ret;
 }

 
 /*
  * Find the start of the next line
  */
 static const char *
 pdf_nextlinestart(const char *ptr, size_t len)
 {
 	while(strchr("\r\n", *ptr) == NULL) {
 		if(--len == 0L)
 			return NULL;
 		ptr++;
 	}
 	while(strchr("\r\n", *ptr) != NULL) {
 		if(--len == 0L)
 			return NULL;
 		ptr++;
 	}
 	return ptr;
 }

 /*
  * Return the start of the next PDF object.
  * This assumes that we're not in a stream.
  */
 static const char *
 pdf_nextobject(const char *ptr, size_t len)
 {
 	const char *p;
 	int inobject = 1;
 
 	while(len) {
 		switch(*ptr) {
 			case '\n':
 			case '\r':
 			case '%':	/* comment */
 				p = pdf_nextlinestart(ptr, len);
 				if(p == NULL)
 					return NULL;
 				len -= (size_t)(p - ptr);
 				ptr = p;
 				inobject = 0;
 				break;
 

 			case ' ':
 			case '\t':

 			case '[':	/* Start of an array object */

 			case '\v':
 			case '\f':

 			case '<':	/* Start of a dictionary object */

 				inobject = 0;

 				ptr++;
 				len--;
 				break;

 			case '/':	/* Start of a name object */
 				return ptr;

 			case '(': /* start of JS */
 				return ptr;

 			default:

 				if(!inobject)
 					/* TODO: parse and return object type */

 					return ptr;
 				ptr++;
 				len--;
 		}
 	}
 	return NULL;
 }