@@ -801,23 +801,23 @@ struct pdf_dict *pdf_parse_dict(struct pdf_struct *pdf, struct pdf_obj *obj, siz

         switch (begin[0]) {

             case '(':

-                val = pdf_parse_string(pdf, obj, begin, objsz, NULL, &p1, NULL);

+                val = pdf_parse_string(pdf, obj, begin, end - objstart, NULL, &p1, NULL);

                 begin = p1+2;

                 break;

             case '[':

-                arr = pdf_parse_array(pdf, obj, objsz, begin, &p1);

+                arr = pdf_parse_array(pdf, obj, end - objstart, begin, &p1);

                 begin = p1+1;

                 break;

             case '<':

                 if ((size_t)(begin - objstart) < objsz - 2) {

                     if (begin[1] == '<') {

-                        dict = pdf_parse_dict(pdf, obj, objsz, begin, &p1);

+                        dict = pdf_parse_dict(pdf, obj, end - objstart, begin, &p1);

                         begin = p1+2;

                         break;

                     }

                 }

-                val = pdf_parse_string(pdf, obj, begin, objsz, NULL, &p1, NULL);

+                val = pdf_parse_string(pdf, obj, begin, end - objstart, NULL, &p1, NULL);

                 begin = p1+2;

                 break;

             default:

@@ -992,19 +992,19 @@ struct pdf_array *pdf_parse_array(struct pdf_struct *pdf, struct pdf_obj *obj, s

         switch (begin[0]) {

             case '<':

                 if ((size_t)(begin - objstart) < objsz - 2 && begin[1] == '<') {

-                    dict = pdf_parse_dict(pdf, obj, objsz, begin, &begin);

+                    dict = pdf_parse_dict(pdf, obj, end - objstart, begin, &begin);

                     begin+=2;

                     break;

                 }

                 /* Not a dictionary. Intentionally fall through. */

             case '(':

-                val = pdf_parse_string(pdf, obj, begin, objsz, NULL, &begin, NULL);

+                val = pdf_parse_string(pdf, obj, begin, end - objstart, NULL, &begin, NULL);

                 begin += 2;

                 break;

             case '[':

                 /* XXX We should have a recursion counter here */

-                arr = pdf_parse_array(pdf, obj, objsz, begin, &begin);

+                arr = pdf_parse_array(pdf, obj, end - objstart, begin, &begin);

                 begin+=1;

                 break;

             default: