... | ... |
@@ -521,9 +521,10 @@ struct pdf_dict *pdf_parse_dict(struct pdf_struct *pdf, struct pdf_obj *obj, siz |
521 | 521 |
/* Loop through each element of the dictionary */ |
522 | 522 |
begin += 2; |
523 | 523 |
while (begin < end) { |
524 |
- char *val=NULL, *key=NULL, *p1; |
|
524 |
+ char *val=NULL, *key=NULL, *p1, *p2; |
|
525 | 525 |
struct pdf_dict *dict=NULL; |
526 | 526 |
struct pdf_array *arr=NULL; |
527 |
+ unsigned int nhex=0, i; |
|
527 | 528 |
|
528 | 529 |
/* Skip any whitespaces */ |
529 | 530 |
while (begin < end && isspace(begin[0])) |
... | ... |
@@ -541,9 +542,21 @@ struct pdf_dict *pdf_parse_dict(struct pdf_struct *pdf, struct pdf_obj *obj, siz |
541 | 541 |
case '<': |
542 | 542 |
case '[': |
543 | 543 |
case '(': |
544 |
- case '\\': |
|
544 |
+ case '/': |
|
545 |
+ case '\r': |
|
546 |
+ case '\n': |
|
547 |
+ case ' ': |
|
548 |
+ case '\t': |
|
545 | 549 |
breakout=1; |
546 | 550 |
break; |
551 |
+ case '#': |
|
552 |
+ /* Key name obfuscated with hex characters */ |
|
553 |
+ nhex++; |
|
554 |
+ if (p1 > end-3) { |
|
555 |
+ return res; |
|
556 |
+ } |
|
557 |
+ |
|
558 |
+ break; |
|
547 | 559 |
} |
548 | 560 |
|
549 | 561 |
if (breakout) |
... | ... |
@@ -559,8 +572,20 @@ struct pdf_dict *pdf_parse_dict(struct pdf_struct *pdf, struct pdf_obj *obj, siz |
559 | 559 |
if (!(key)) |
560 | 560 |
break; |
561 | 561 |
|
562 |
- strncpy(key, begin, p1 - begin); |
|
563 |
- key[p1 - begin] = '\0'; |
|
562 |
+ if (nhex == 0) { |
|
563 |
+ /* Key isn't obfuscated with hex. Just copy the string */ |
|
564 |
+ strncpy(key, begin, p1 - begin); |
|
565 |
+ key[p1 - begin] = '\0'; |
|
566 |
+ } else { |
|
567 |
+ for (i=0, p2 = begin; p2 < p1; p2++, i++) { |
|
568 |
+ if (*p2 == '#') { |
|
569 |
+ cli_hex2str_to(p2+1, key+i, 2); |
|
570 |
+ p2 += 2; |
|
571 |
+ } else { |
|
572 |
+ key[i] = *p2; |
|
573 |
+ } |
|
574 |
+ } |
|
575 |
+ } |
|
564 | 576 |
|
565 | 577 |
/* Now for the value */ |
566 | 578 |
begin = p1; |