@@ -57,6 +57,7 @@ static	char	const	rcsid[] = "$Id: pdf.c,v 1.61 2007/02/12 20:46:09 njh Exp $";

 static	int	try_flatedecode(unsigned char *buf, off_t real_len, off_t calculated_len, int fout, cli_ctx *ctx);

 static	int	flatedecode(unsigned char *buf, off_t len, int fout, cli_ctx *ctx);

 static	int	ascii85decode(const char *buf, off_t len, unsigned char *output);

+static	int	asciihexdecode(const char *buf, off_t len, unsigned char *output);

 static	const	char	*pdf_nextlinestart(const char *ptr, size_t len);

 static	const	char	*pdf_nextobject(const char *ptr, size_t len);

@@ -66,6 +67,8 @@ enum pdf_flag {

     BAD_PDF_TRAILER,

     BAD_PDF_TOOMANYOBJS,

     BAD_STREAM_FILTERS,

+    BAD_FLATE,

+    BAD_ASCIIDECODE,

     UNTERMINATED_OBJ_DICT,

     ESCAPED_COMMON_PDFNAME,

 };

@@ -94,6 +97,7 @@ static int xrefCheck(const char *xref, const char *eof)

 enum objflags {

     OBJ_STREAM=0,

     OBJ_DICT,

+    OBJ_EMBEDDED_FILE,

     OBJ_FILTER_AH,

     OBJ_FILTER_A85,

     OBJ_FILTER_FLATE,

@@ -119,6 +123,9 @@ struct pdf_struct {

     off_t size;

     off_t offset;

     unsigned flags;

+    cli_ctx *ctx;

+    const char *dir;

+    unsigned files;

 };

 static const char *findNextNonWSBack(const char *q, const char *start)

@@ -131,9 +138,30 @@ static const char *findNextNonWSBack(const char *q, const char *start)

     return q;

 }

+static int find_stream_bounds(const char *start, off_t bytesleft, off_t *stream, off_t *endstream)

+{

+    const char *q2, *q;

+    if ((q2 = cli_memstr(start, bytesleft, "stream", 6))) {

+	q2 += 6;

+	if (q2[0] == '\xd' && q2[1] == '\xa')

+	    q2 += 2;

+	if (q2[0] == '\xa')

+	    q2++;

+	*stream = q2 - start;

+	bytesleft -= q2 - start;

+	q = q2;

+	q2 = cli_memstr(q, bytesleft, "endstream", 9);

+	if (!q2)

+	    return;/* no more objs */

+	*endstream = q2 - start;

+	return 1;

+    }

+    return 0;

+}

+

 static int pdf_findobj(struct pdf_struct *pdf)

 {

-    const char *start, *q, *q2, *eof;

+    const char *start, *q, *q2, *q3, *eof;

     struct pdf_obj *obj;

     off_t bytesleft;

     unsigned genid, objid;

@@ -164,21 +192,17 @@ static int pdf_findobj(struct pdf_struct *pdf)

     eof = pdf->map + pdf->size;

     q = pdf->map + obj->start;

     while (q < eof && bytesleft > 0) {

+	off_t p_stream, p_endstream;

 	q2 = pdf_nextobject(q, bytesleft);

 	if (!q2)

 	    return 0;/* no more objs */

 	bytesleft -= q2 - q;

-	if ((q2 = cli_memstr(q-1, q2-q+1, "stream", 6))) {

+	if (find_stream_bounds(q-1, q2-q+1, &p_stream, &p_endstream)) {

 	    obj->flags |= 1 << OBJ_STREAM;

-	    q2 += 6;

-	    bytesleft -= 6;

-	    q2 = cli_memstr(q2, bytesleft, "endstream", 9);

-	    if (!q2)

-		return 0;/* no more objs */

-	    q2 += 6;

-	    bytesleft -= q2 - q;

-	} else if ((q2 = cli_memstr(q-1, q2-q+1, "endobj", 6))) {

-	    q2 += 6;

+	    q2 = q-1 + p_endstream + 6;

+	    bytesleft -= q2 - q + 1;

+	} else if ((q3 = cli_memstr(q-1, q2-q+1, "endobj", 6))) {

+	    q2 = q3 + 6;

 	    pdf->offset = q2 - pdf->map;

 	    return 1; /* obj found and offset positioned */

 	} else {

@@ -189,6 +213,243 @@ static int pdf_findobj(struct pdf_struct *pdf)

     return 0;/* no more objs */

 }

+static int filter_writen(struct pdf_struct *pdf, struct pdf_obj *obj,

+			 int fout, const unsigned char *buf, off_t len, off_t *sum)

+{

+    if (cli_checklimits("pdf", pdf->ctx, *sum, 0, 0))

+	return len; /* pretend it was a successful write to suppress CL_EWRITE */

+    *sum += len;

+    return cli_writen(fout, buf, len);

+}

+

+static int filter_flatedecode(struct pdf_struct *pdf, struct pdf_obj *obj,

+			      const unsigned char *buf, off_t len, int fout, off_t *sum)

+{

+    int zstat, ret;

+    z_stream stream;

+    off_t nbytes;

+    unsigned char output[BUFSIZ];

+

+    if (len == 0)

+	return CL_CLEAN;

+    memset(&stream, 0, sizeof(stream));

+    stream.next_in = (Bytef *)buf;

+    stream.avail_in = len;

+    stream.next_out = output;

+    stream.avail_out = sizeof(output);

+

+    zstat = inflateInit(&stream);

+    if(zstat != Z_OK) {

+	cli_warnmsg("cli_pdf: inflateInit failed\n");

+	return CL_EMEM;

+    }

+

+    nbytes = 0;

+    while(stream.avail_in) {

+	zstat = inflate(&stream, Z_NO_FLUSH);	/* zlib */

+	switch(zstat) {

+	    case Z_OK:

+		if(stream.avail_out == 0) {

+		    int written;

+		    if ((written=filter_writen(pdf, obj, fout, output, sizeof(output), sum))!=sizeof(output)) {

+			cli_errmsg("cli_pdf: failed to write output file\n");

+			inflateEnd(&stream);

+			return CL_EWRITE;

+		    }

+		    nbytes += written;

+		    stream.next_out = output;

+		    stream.avail_out = sizeof(output);

+		}

+		continue;

+	    case Z_STREAM_END:

+		break;

+	    default:

+		if(stream.msg)

+		    cli_dbgmsg("cli_pdf: after writing %lu bytes, got error \"%s\" inflating PDF stream in %u %u obj\n",

+			       (unsigned long)nbytes,

+			       stream.msg, obj->id>>8, obj->id&0xff);

+		else

+		    cli_dbgmsg("cli_pdf: after writing %lu bytes, got error %d inflating PDF stream in %u %u obj\n",

+			       (unsigned long)nbytes, zstat, obj->id>>8, obj->id&0xff);

+		pdf->flags |= 1 << BAD_FLATE;

+		inflateEnd(&stream);

+		return CL_CLEAN;

+	}

+	break;

+    }

+

+    if(stream.avail_out != sizeof(output)) {

+	if(filter_writen(pdf, obj, fout, output, sizeof(output) - stream.avail_out, sum) < 0) {

+	    cli_errmsg("cli_pdf: failed to write output file\n");

+	    inflateEnd(&stream);

+	    return CL_EWRITE;

+	}

+    }

+

+    inflateEnd(&stream);

+    return CL_CLEAN;

+}

+

+static struct pdf_obj *find_obj(struct pdf_struct *pdf,

+				struct pdf_obj *obj, uint32_t objid)

+{

+    int j;

+    int i = obj - pdf->objs;

+    /* search starting at previous obj */

+    if (i > 0)

+	i--;

+    for (j=i;j<pdf->nobjs;j++) {

+	obj = &pdf->objs[j];

+	if (obj->id == objid)

+	    return obj;

+    }

+    /* restart search from beginning if not found */

+    for (j=0;j<i;j++) {

+	obj = &pdf->objs[j];

+	if (obj->id == objid)

+	    return obj;

+    }

+    return NULL;

+}

+

+static int find_length(struct pdf_struct *pdf,

+		       struct pdf_obj *obj,

+		       const char *start, off_t len)

+{

+    int length;

+    const char *q;

+    q = cli_memstr(start, len, "/Length", 7);

+    if (!q)

+	return 0;

+    q++;

+    len -= q - start;

+    start = pdf_nextobject(q, len);

+    if (!start)

+	return 0;

+    len -= start - q;

+    q = start;

+    length = atoi(q);

+    while (isdigit(*q)) q++;

+    if (*q == ' ') {

+	int genid;

+	q++;

+	genid = atoi(q);

+	while(isdigit(*q)) q++;

+	if (q[0] == ' ' && q[1] == 'R') {

+	    cli_dbgmsg("cli_pdf: length is in indirect object %u %u\n", length, genid);

+	    obj = find_obj(pdf, obj, (length << 8) | (genid&0xff));

+	    if (!obj) {

+		cli_dbgmsg("cli_pdf: indirect object not found\n");

+		return 0;

+	    }

+	    q = pdf_nextobject(pdf->map+obj->start, pdf->size - obj->start);

+	    length = atoi(q);

+	}

+    }

+    return length;

+}

+

+static int pdf_extract_obj(struct pdf_struct *pdf, struct pdf_obj *obj)

+{

+    int rc = CL_SUCCESS;

+    if (obj->flags | (1 << OBJ_STREAM)) {

+	const char *start = pdf->map + obj->start;

+	off_t p_stream = 0, p_endstream = 0;

+	off_t length;

+	find_stream_bounds(start, pdf->size - obj->start,

+			   &p_stream, &p_endstream);

+	if (p_stream && p_endstream) {

+	    char fullname[NAME_MAX + 1];

+	    int fout;

+	    off_t sum = 0;

+	    const char *flate_in;

+	    char *ascii_decoded = NULL;

+	    long ascii_decoded_size = 0;

+	    size_t size = p_endstream - p_stream;

+

+	    if (!(obj->flags & (1 << OBJ_FILTER_FLATE)) &&

+		!(obj->flags & (1 << OBJ_EMBEDDED_FILE)) &&

+		!ascii_decoded) {

+		/* only dump encoded streams */

+		return CL_CLEAN;

+	    }

+	    length = find_length(pdf, obj, start, p_stream);

+	    if (!(obj->flags & (1 << OBJ_FILTER_FLATE)) && !length) {

+		const char *q = start + p_endstream;

+		length = size;

+		q--;

+		if (*q == '\n') {

+		    q--;

+		    length--;

+		    if (*q == '\r')

+			length--;

+		} else if (*q == '\r') {

+		    length--;

+		}

+		cli_dbgmsg("cli_pdf: calculated length %d\n", length);

+	    }

+	    if (!length)

+		length = size;

+

+	    if (obj->flags & (1 << OBJ_FILTER_AH)) {

+		ascii_decoded = cli_malloc(size/2 + 1);

+		if (!ascii_decoded) {

+		    cli_errmsg("Cannot allocate memory for asciidecode\n");

+		    return CL_EMEM;

+		}

+		ascii_decoded_size = asciihexdecode(start + p_stream,

+						    length,

+						    ascii_decoded);

+	    } else if (obj->flags & (1 << OBJ_FILTER_A85)) {

+		ascii_decoded = cli_malloc(size*5);

+		if (!ascii_decoded) {

+		    cli_errmsg("Cannot allocate memory for asciidecode\n");

+		    return CL_EMEM;

+		}

+		ascii_decoded_size = ascii85decode(start+p_stream,

+						   length,

+						   ascii_decoded);

+	    }

+	    if (ascii_decoded_size < 0) {

+		pdf->flags |= 1 << BAD_ASCIIDECODE;

+		cli_dbgmsg("cli_pdf: failed to asciidecode in %u %u obj\n", obj->id>>8,obj->id&0xff);

+		free(ascii_decoded);

+		return CL_SUCCESS;

+	    }

+	    /* either direct or ascii-decoded input */

+	    if (!ascii_decoded)

+		ascii_decoded_size = length;

+	    flate_in = ascii_decoded ? ascii_decoded : start+p_stream;

+

+	    snprintf(fullname, sizeof(fullname), "%s"PATHSEP"pdf%02u", pdf->dir, pdf->files++);

+	    fout = open(fullname,O_RDWR|O_CREAT|O_EXCL|O_TRUNC|O_BINARY, 0600);

+	    if (fout < 0) {

+		char err[128];

+		cli_errmsg("cli_pdf: can't create temporary file %s: %s\n", fullname, cli_strerror(errno, err, sizeof(err)));

+		free(ascii_decoded);

+		return CL_ETMPFILE;

+	    }

+	    if (obj->flags & (1 << OBJ_FILTER_FLATE)) {

+		rc = filter_flatedecode(pdf, obj, flate_in, ascii_decoded_size, fout, &sum);

+	    } else {

+		rc = filter_writen(pdf, obj, fout, flate_in, ascii_decoded_size, &sum);

+	    }

+	    cli_updatelimits(pdf->ctx, sum);

+	    /* invoke bytecode on this pdf obj with metainformation associated

+	     * */

+	    cli_dbgmsg("cli_pdf: extracted %ld bytes %u %u obj to %s\n", sum, obj->id>>8, obj->id&0xff, fullname);

+	    lseek(fout, 0, SEEK_SET);

+	    rc = cli_magic_scandesc(fout, pdf->ctx);

+	    close(fout);

+	    free(ascii_decoded);

+	    if (!pdf->ctx->engine->keeptmp)

+		if (cli_unlink(fullname) && rc != CL_VIRUS)

+		    rc = CL_EUNLINK;

+	}

+    }

+    return rc;

+}

+

 static void pdfobj_flag(struct pdf_struct *pdf, struct pdf_obj *obj, enum pdf_flag flag)

 {

     const char *s;

@@ -219,6 +480,7 @@ enum objstate {

     STATE_NONE,

     STATE_S,

     STATE_FILTER,

+    STATE_JAVASCRIPT,

     STATE_ANY /* for actions table below */

 };

@@ -232,6 +494,7 @@ struct pdfname_action {

 static struct pdfname_action pdfname_actions[] = {

     {"ASCIIHexDecode", OBJ_FILTER_AH, STATE_FILTER, STATE_FILTER},

     {"ASCII85Decode", OBJ_FILTER_A85, STATE_FILTER, STATE_FILTER},

+    {"EmbeddedFile", OBJ_EMBEDDED_FILE, STATE_NONE, STATE_NONE},

     {"FlateDecode", OBJ_FILTER_FLATE, STATE_FILTER, STATE_FILTER},

     {"LZWDecode", OBJ_FILTER_LZW, STATE_FILTER, STATE_FILTER},

     {"RunLengthDecode", OBJ_FILTER_RL, STATE_FILTER, STATE_FILTER},

@@ -241,7 +504,7 @@ static struct pdfname_action pdfname_actions[] = {

     {"JPXDecode", OBJ_FILTER_JPX, STATE_FILTER, STATE_FILTER},

     {"Crypt",  OBJ_FILTER_CRYPT, STATE_FILTER, STATE_NONE},

     {"Filter", OBJ_DICT, STATE_ANY, STATE_FILTER},

-    {"JavaScript", OBJ_JAVASCRIPT, STATE_S, STATE_NONE},

+    {"JavaScript", OBJ_JAVASCRIPT, STATE_S, STATE_JAVASCRIPT},

     {"Length", OBJ_DICT, STATE_FILTER, STATE_NONE},

     {"S", OBJ_DICT, STATE_NONE, STATE_S},

     {"Type", OBJ_DICT, STATE_NONE, STATE_NONE}

@@ -339,6 +602,7 @@ static void pdf_parseobj(struct pdf_struct *pdf, struct pdf_obj *obj)

 	if (!q2)

 	    break;

 	dict_length -= q2 - q;

+	q = q2;

 	// normalize PDF names

 	for (i = 0;dict_length && (i < sizeof(pdfname)-1); i++) {

 	    q++;

@@ -371,9 +635,12 @@ int cli_pdf(const char *dir, cli_ctx *ctx, off_t offset)

     long xref;

     const char *pdfver, *start, *eofmap, *q, *eof;

     int rc;

+    unsigned i;

     cli_dbgmsg("in cli_pdf(%s)\n", dir);

     memset(&pdf, 0, sizeof(pdf));

+    pdf.ctx = ctx;

+    pdf.dir = dir;

     pdfver = start = fmap_need_off_once(map, offset, versize);

@@ -448,6 +715,7 @@ int cli_pdf(const char *dir, cli_ctx *ctx, off_t offset)

 	cli_errmsg("cli_pdf: mmap() failed\n");

 	return CL_EMAP;

     }

+    // parse PDF and find obj offsets

     while ((rc = pdf_findobj(&pdf)) > 0) {

 	struct pdf_obj *obj = &pdf.objs[pdf.nobjs-1];

 	cli_dbgmsg("found %d %d obj @%ld\n", obj->id >> 8, obj->id&0xff, obj->start + offset);

@@ -456,9 +724,19 @@ int cli_pdf(const char *dir, cli_ctx *ctx, off_t offset)

     if (rc == -1)

 	pdf.flags |= 1 << BAD_PDF_TOOMANYOBJS;

+    // extract PDF objs

+    for (i=0;i<pdf.nobjs;i++) {

+	struct pdf_obj *obj = &pdf.objs[i];

+	rc = pdf_extract_obj(&pdf, obj);

+	if (rc != CL_SUCCESS)

+	    break;

+    }

+

     if (pdf.flags)

 	cli_dbgmsg("cli_pdf: flags 0x%02x\n", pdf.flags);

-    return CL_SUCCESS;

+    cli_dbgmsg("cli_pdf: returning %d\n", rc);

+    free(pdf.objs);

+    return rc;

 }

 int

@@ -1052,6 +1330,18 @@ flatedecode(unsigned char *buf, off_t len, int fout, cli_ctx *ctx)

 	return CL_CLEAN;

 }

+static int asciihexdecode(const char *buf, off_t len, unsigned char *output)

+{

+    unsigned i,j;

+    for (i=0,j=0;i<len;i++) {

+	if (buf[i] == ' ')

+	    continue;

+	if (buf[i] == '>')

+	    break;

+	cli_hex2str_to(buf+i, output+j++, 2);

+    }

+    return j;

+}

 /*

  * ascii85 inflation, returns number of bytes in output, -1 for error

  *