@@ -1294,11 +1294,15 @@ enum objstate {

     STATE_ANY /* for actions table below */

 };

+#define NAMEFLAG_NONE       0x0

+#define NAMEFLAG_HEURISTIC  0x1

+

 struct pdfname_action {

     const char *pdfname;

     enum pdf_objflags set_objflag;/* OBJ_DICT is noop */

     enum objstate from_state;/* STATE_NONE is noop */

     enum objstate to_state;

+    uint32_t nameflags;

 #if HAVE_JSON

     void (*pdf_stats_cb)(struct pdf_struct *pdf, struct pdf_obj *obj, struct pdfname_action *act);

 #endif

@@ -1306,88 +1310,88 @@ struct pdfname_action {

 #if HAVE_JSON

 static struct pdfname_action pdfname_actions[] = {

-    {"ASCIIHexDecode", OBJ_FILTER_AH, STATE_FILTER, STATE_FILTER, ASCIIHexDecode_cb},

-    {"ASCII85Decode", OBJ_FILTER_A85, STATE_FILTER, STATE_FILTER, ASCII85Decode_cb},

-    {"A85", OBJ_FILTER_A85, STATE_FILTER, STATE_FILTER, ASCII85Decode_cb},

-    {"AHx", OBJ_FILTER_AH, STATE_FILTER, STATE_FILTER, ASCIIHexDecode_cb},

-    {"EmbeddedFile", OBJ_EMBEDDED_FILE, STATE_NONE, STATE_NONE, EmbeddedFile_cb},

-    {"FlateDecode", OBJ_FILTER_FLATE, STATE_FILTER, STATE_FILTER, FlateDecode_cb},

-    {"Fl", OBJ_FILTER_FLATE, STATE_FILTER, STATE_FILTER, FlateDecode_cb},

-    {"Image", OBJ_IMAGE, STATE_NONE, STATE_NONE, Image_cb},

-    {"LZWDecode", OBJ_FILTER_LZW, STATE_FILTER, STATE_FILTER, LZWDecode_cb},

-    {"LZW", OBJ_FILTER_LZW, STATE_FILTER, STATE_FILTER, LZWDecode_cb},

-    {"RunLengthDecode", OBJ_FILTER_RL, STATE_FILTER, STATE_FILTER, RunLengthDecode_cb},

-    {"RL", OBJ_FILTER_RL, STATE_FILTER, STATE_FILTER, RunLengthDecode_cb},

-    {"CCITTFaxDecode", OBJ_FILTER_FAX, STATE_FILTER, STATE_FILTER, CCITTFaxDecode_cb},

-    {"CCF", OBJ_FILTER_FAX, STATE_FILTER, STATE_FILTER, CCITTFaxDecode_cb},

-    {"JBIG2Decode", OBJ_FILTER_DCT, STATE_FILTER, STATE_FILTER, JBIG2Decode_cb},

-    {"DCTDecode", OBJ_FILTER_DCT, STATE_FILTER, STATE_FILTER, DCTDecode_cb},

-    {"DCT", OBJ_FILTER_DCT, STATE_FILTER, STATE_FILTER, DCTDecode_cb},

-    {"JPXDecode", OBJ_FILTER_JPX, STATE_FILTER, STATE_FILTER, JPXDecode_cb},

-    {"Crypt",  OBJ_FILTER_CRYPT, STATE_FILTER, STATE_NONE, Crypt_cb},

-    {"Standard", OBJ_FILTER_STANDARD, STATE_FILTER, STATE_FILTER, Standard_cb},

-    {"Sig",    OBJ_SIGNED, STATE_ANY, STATE_NONE, Sig_cb},

-    {"V",     OBJ_SIGNED, STATE_ANY, STATE_NONE, NULL},

-    {"R",     OBJ_SIGNED, STATE_ANY, STATE_NONE, NULL},

-    {"Linearized", OBJ_DICT, STATE_NONE, STATE_LINEARIZED, NULL},

-    {"Filter", OBJ_HASFILTERS, STATE_ANY, STATE_FILTER, NULL},

-    {"JavaScript", OBJ_JAVASCRIPT, STATE_S, STATE_JAVASCRIPT, JavaScript_cb},

-    {"Length", OBJ_DICT, STATE_FILTER, STATE_NONE, NULL},

-    {"S", OBJ_DICT, STATE_NONE, STATE_S, NULL},

-    {"Type", OBJ_DICT, STATE_NONE, STATE_NONE, NULL},

-    {"OpenAction", OBJ_OPENACTION, STATE_ANY, STATE_OPENACTION, OpenAction_cb},

-    {"Launch", OBJ_LAUNCHACTION, STATE_ANY, STATE_LAUNCHACTION, Launch_cb},

-    {"Page", OBJ_PAGE, STATE_NONE, STATE_NONE, Page_cb},

-    {"Contents", OBJ_CONTENTS, STATE_NONE, STATE_CONTENTS, NULL},

-    {"Author", OBJ_DICT, STATE_NONE, STATE_NONE, Author_cb},

-    {"Producer", OBJ_DICT, STATE_NONE, STATE_NONE, Producer_cb},

-    {"CreationDate", OBJ_DICT, STATE_NONE, STATE_NONE, CreationDate_cb},

-    {"ModDate", OBJ_DICT, STATE_NONE, STATE_NONE, ModificationDate_cb},

-    {"Creator", OBJ_DICT, STATE_NONE, STATE_NONE, Creator_cb},

-    {"Title", OBJ_DICT, STATE_NONE, STATE_NONE, Title_cb},

-    {"Keywords", OBJ_DICT, STATE_NONE, STATE_NONE, Keywords_cb},

-    {"Subject", OBJ_DICT, STATE_NONE, STATE_NONE, Subject_cb},

-    {"Pages", OBJ_DICT, STATE_NONE, STATE_NONE, Pages_cb},

-    {"Colors", OBJ_DICT, STATE_NONE, STATE_NONE, Colors_cb},

-    {"RichMedia", OBJ_DICT, STATE_NONE, STATE_NONE, RichMedia_cb},

-    {"AcroForm", OBJ_DICT, STATE_NONE, STATE_NONE, AcroForm_cb},

-    {"XFA", OBJ_DICT, STATE_NONE, STATE_NONE, XFA_cb}

+    {"ASCIIHexDecode", OBJ_FILTER_AH, STATE_FILTER, STATE_FILTER, NAMEFLAG_HEURISTIC, ASCIIHexDecode_cb},

+    {"ASCII85Decode", OBJ_FILTER_A85, STATE_FILTER, STATE_FILTER, NAMEFLAG_HEURISTIC, ASCII85Decode_cb},

+    {"A85", OBJ_FILTER_A85, STATE_FILTER, STATE_FILTER, NAMEFLAG_HEURISTIC, ASCII85Decode_cb},

+    {"AHx", OBJ_FILTER_AH, STATE_FILTER, STATE_FILTER, NAMEFLAG_HEURISTIC, ASCIIHexDecode_cb},

+    {"EmbeddedFile", OBJ_EMBEDDED_FILE, STATE_NONE, STATE_NONE, NAMEFLAG_HEURISTIC, EmbeddedFile_cb},

+    {"FlateDecode", OBJ_FILTER_FLATE, STATE_FILTER, STATE_FILTER, NAMEFLAG_HEURISTIC, FlateDecode_cb},

+    {"Fl", OBJ_FILTER_FLATE, STATE_FILTER, STATE_FILTER, NAMEFLAG_HEURISTIC, FlateDecode_cb},

+    {"Image", OBJ_IMAGE, STATE_NONE, STATE_NONE, NAMEFLAG_HEURISTIC, Image_cb},

+    {"LZWDecode", OBJ_FILTER_LZW, STATE_FILTER, STATE_FILTER, NAMEFLAG_HEURISTIC, LZWDecode_cb},

+    {"LZW", OBJ_FILTER_LZW, STATE_FILTER, STATE_FILTER, NAMEFLAG_HEURISTIC, LZWDecode_cb},

+    {"RunLengthDecode", OBJ_FILTER_RL, STATE_FILTER, STATE_FILTER, NAMEFLAG_HEURISTIC, RunLengthDecode_cb},

+    {"RL", OBJ_FILTER_RL, STATE_FILTER, STATE_FILTER, NAMEFLAG_HEURISTIC, RunLengthDecode_cb},

+    {"CCITTFaxDecode", OBJ_FILTER_FAX, STATE_FILTER, STATE_FILTER, NAMEFLAG_HEURISTIC, CCITTFaxDecode_cb},

+    {"CCF", OBJ_FILTER_FAX, STATE_FILTER, STATE_FILTER, NAMEFLAG_HEURISTIC, CCITTFaxDecode_cb},

+    {"JBIG2Decode", OBJ_FILTER_DCT, STATE_FILTER, STATE_FILTER, NAMEFLAG_HEURISTIC, JBIG2Decode_cb},

+    {"DCTDecode", OBJ_FILTER_DCT, STATE_FILTER, STATE_FILTER, NAMEFLAG_HEURISTIC, DCTDecode_cb},

+    {"DCT", OBJ_FILTER_DCT, STATE_FILTER, STATE_FILTER, NAMEFLAG_HEURISTIC, DCTDecode_cb},

+    {"JPXDecode", OBJ_FILTER_JPX, STATE_FILTER, STATE_FILTER, NAMEFLAG_HEURISTIC, JPXDecode_cb},

+    {"Crypt",  OBJ_FILTER_CRYPT, STATE_FILTER, STATE_NONE, NAMEFLAG_HEURISTIC, Crypt_cb},

+    {"Standard", OBJ_FILTER_STANDARD, STATE_FILTER, STATE_FILTER, NAMEFLAG_HEURISTIC, Standard_cb},

+    {"Sig",    OBJ_SIGNED, STATE_ANY, STATE_NONE, NAMEFLAG_HEURISTIC, Sig_cb},

+    {"V",     OBJ_SIGNED, STATE_ANY, STATE_NONE, NAMEFLAG_HEURISTIC, NULL},

+    {"R",     OBJ_SIGNED, STATE_ANY, STATE_NONE, NAMEFLAG_HEURISTIC, NULL},

+    {"Linearized", OBJ_DICT, STATE_NONE, STATE_LINEARIZED, NAMEFLAG_HEURISTIC, NULL},

+    {"Filter", OBJ_HASFILTERS, STATE_ANY, STATE_FILTER, NAMEFLAG_HEURISTIC, NULL},

+    {"JavaScript", OBJ_JAVASCRIPT, STATE_S, STATE_JAVASCRIPT, NAMEFLAG_HEURISTIC, JavaScript_cb},

+    {"Length", OBJ_DICT, STATE_FILTER, STATE_NONE, NAMEFLAG_HEURISTIC, NULL},

+    {"S", OBJ_DICT, STATE_NONE, STATE_S, NAMEFLAG_HEURISTIC, NULL},

+    {"Type", OBJ_DICT, STATE_NONE, STATE_NONE, NAMEFLAG_HEURISTIC, NULL},

+    {"OpenAction", OBJ_OPENACTION, STATE_ANY, STATE_OPENACTION, NAMEFLAG_HEURISTIC, OpenAction_cb},

+    {"Launch", OBJ_LAUNCHACTION, STATE_ANY, STATE_LAUNCHACTION, NAMEFLAG_HEURISTIC, Launch_cb},

+    {"Page", OBJ_PAGE, STATE_NONE, STATE_NONE, NAMEFLAG_HEURISTIC, Page_cb},

+    {"Contents", OBJ_CONTENTS, STATE_NONE, STATE_CONTENTS, NAMEFLAG_HEURISTIC, NULL},

+    {"Author", OBJ_DICT, STATE_NONE, STATE_NONE, NAMEFLAG_NONE, Author_cb},

+    {"Producer", OBJ_DICT, STATE_NONE, STATE_NONE, NAMEFLAG_NONE, Producer_cb},

+    {"CreationDate", OBJ_DICT, STATE_NONE, STATE_NONE, NAMEFLAG_NONE, CreationDate_cb},

+    {"ModDate", OBJ_DICT, STATE_NONE, STATE_NONE, NAMEFLAG_NONE, ModificationDate_cb},

+    {"Creator", OBJ_DICT, STATE_NONE, STATE_NONE, NAMEFLAG_NONE, Creator_cb},

+    {"Title", OBJ_DICT, STATE_NONE, STATE_NONE, NAMEFLAG_NONE, Title_cb},

+    {"Keywords", OBJ_DICT, STATE_NONE, STATE_NONE, NAMEFLAG_NONE, Keywords_cb},

+    {"Subject", OBJ_DICT, STATE_NONE, STATE_NONE, NAMEFLAG_NONE, Subject_cb},

+    {"Pages", OBJ_DICT, STATE_NONE, STATE_NONE, NAMEFLAG_NONE, Pages_cb},

+    {"Colors", OBJ_DICT, STATE_NONE, STATE_NONE, NAMEFLAG_NONE, Colors_cb},

+    {"RichMedia", OBJ_DICT, STATE_NONE, STATE_NONE, NAMEFLAG_NONE, RichMedia_cb},

+    {"AcroForm", OBJ_DICT, STATE_NONE, STATE_NONE, NAMEFLAG_NONE, AcroForm_cb},

+    {"XFA", OBJ_DICT, STATE_NONE, STATE_NONE, NAMEFLAG_NONE, XFA_cb}

 };

 #else

 static struct pdfname_action pdfname_actions[] = {

-    {"ASCIIHexDecode", OBJ_FILTER_AH, STATE_FILTER, STATE_FILTER},

-    {"ASCII85Decode", OBJ_FILTER_A85, STATE_FILTER, STATE_FILTER},

-    {"A85", OBJ_FILTER_A85, STATE_FILTER, STATE_FILTER},

-    {"AHx", OBJ_FILTER_AH, STATE_FILTER, STATE_FILTER},

-    {"EmbeddedFile", OBJ_EMBEDDED_FILE, STATE_NONE, STATE_NONE},

-    {"FlateDecode", OBJ_FILTER_FLATE, STATE_FILTER, STATE_FILTER},

-    {"Fl", OBJ_FILTER_FLATE, STATE_FILTER, STATE_FILTER},

-    {"Image", OBJ_IMAGE, STATE_NONE, STATE_NONE},

-    {"LZWDecode", OBJ_FILTER_LZW, STATE_FILTER, STATE_FILTER},

-    {"LZW", OBJ_FILTER_LZW, STATE_FILTER, STATE_FILTER},

-    {"RunLengthDecode", OBJ_FILTER_RL, STATE_FILTER, STATE_FILTER},

-    {"RL", OBJ_FILTER_RL, STATE_FILTER, STATE_FILTER},

-    {"CCITTFaxDecode", OBJ_FILTER_FAX, STATE_FILTER, STATE_FILTER},

-    {"CCF", OBJ_FILTER_FAX, STATE_FILTER, STATE_FILTER},

-    {"JBIG2Decode", OBJ_FILTER_DCT, STATE_FILTER, STATE_FILTER},

-    {"DCTDecode", OBJ_FILTER_DCT, STATE_FILTER, STATE_FILTER},

-    {"DCT", OBJ_FILTER_DCT, STATE_FILTER, STATE_FILTER},

-    {"JPXDecode", OBJ_FILTER_JPX, STATE_FILTER, STATE_FILTER},

-    {"Crypt",  OBJ_FILTER_CRYPT, STATE_FILTER, STATE_NONE},

-    {"Standard", OBJ_FILTER_STANDARD, STATE_FILTER, STATE_FILTER},

-    {"Sig",    OBJ_SIGNED, STATE_ANY, STATE_NONE},

-    {"V",     OBJ_SIGNED, STATE_ANY, STATE_NONE},

-    {"R",     OBJ_SIGNED, STATE_ANY, STATE_NONE},

-    {"Linearized", OBJ_DICT, STATE_NONE, STATE_LINEARIZED},

-    {"Filter", OBJ_HASFILTERS, STATE_ANY, STATE_FILTER},

-    {"JavaScript", OBJ_JAVASCRIPT, STATE_S, STATE_JAVASCRIPT},

-    {"Length", OBJ_DICT, STATE_FILTER, STATE_NONE},

-    {"S", OBJ_DICT, STATE_NONE, STATE_S},

-    {"Type", OBJ_DICT, STATE_NONE, STATE_NONE},

-    {"OpenAction", OBJ_OPENACTION, STATE_ANY, STATE_OPENACTION},

-    {"Launch", OBJ_LAUNCHACTION, STATE_ANY, STATE_LAUNCHACTION},

-    {"Page", OBJ_PAGE, STATE_NONE, STATE_NONE},

-    {"Contents", OBJ_CONTENTS, STATE_NONE, STATE_CONTENTS}

+    {"ASCIIHexDecode", OBJ_FILTER_AH, STATE_FILTER, STATE_FILTER, NAMEFLAG_HEURISTIC},

+    {"ASCII85Decode", OBJ_FILTER_A85, STATE_FILTER, STATE_FILTER, NAMEFLAG_HEURISTIC},

+    {"A85", OBJ_FILTER_A85, STATE_FILTER, STATE_FILTER, NAMEFLAG_HEURISTIC},

+    {"AHx", OBJ_FILTER_AH, STATE_FILTER, STATE_FILTER, NAMEFLAG_HEURISTIC},

+    {"EmbeddedFile", OBJ_EMBEDDED_FILE, STATE_NONE, STATE_NONE, NAMEFLAG_HEURISTIC},

+    {"FlateDecode", OBJ_FILTER_FLATE, STATE_FILTER, STATE_FILTER, NAMEFLAG_HEURISTIC},

+    {"Fl", OBJ_FILTER_FLATE, STATE_FILTER, STATE_FILTER, NAMEFLAG_HEURISTIC},

+    {"Image", OBJ_IMAGE, STATE_NONE, STATE_NONE, NAMEFLAG_HEURISTIC},

+    {"LZWDecode", OBJ_FILTER_LZW, STATE_FILTER, STATE_FILTER, NAMEFLAG_HEURISTIC},

+    {"LZW", OBJ_FILTER_LZW, STATE_FILTER, STATE_FILTER, NAMEFLAG_HEURISTIC},

+    {"RunLengthDecode", OBJ_FILTER_RL, STATE_FILTER, STATE_FILTER, NAMEFLAG_HEURISTIC},

+    {"RL", OBJ_FILTER_RL, STATE_FILTER, STATE_FILTER, NAMEFLAG_HEURISTIC},

+    {"CCITTFaxDecode", OBJ_FILTER_FAX, STATE_FILTER, STATE_FILTER, NAMEFLAG_HEURISTIC},

+    {"CCF", OBJ_FILTER_FAX, STATE_FILTER, STATE_FILTER, NAMEFLAG_HEURISTIC},

+    {"JBIG2Decode", OBJ_FILTER_DCT, STATE_FILTER, STATE_FILTER, NAMEFLAG_HEURISTIC},

+    {"DCTDecode", OBJ_FILTER_DCT, STATE_FILTER, STATE_FILTER, NAMEFLAG_HEURISTIC},

+    {"DCT", OBJ_FILTER_DCT, STATE_FILTER, STATE_FILTER, NAMEFLAG_HEURISTIC},

+    {"JPXDecode", OBJ_FILTER_JPX, STATE_FILTER, STATE_FILTER, NAMEFLAG_HEURISTIC},

+    {"Crypt",  OBJ_FILTER_CRYPT, STATE_FILTER, STATE_NONE, NAMEFLAG_HEURISTIC},

+    {"Standard", OBJ_FILTER_STANDARD, STATE_FILTER, STATE_FILTER, NAMEFLAG_HEURISTIC},

+    {"Sig",    OBJ_SIGNED, STATE_ANY, STATE_NONE, NAMEFLAG_HEURISTIC},

+    {"V",     OBJ_SIGNED, STATE_ANY, STATE_NONE, NAMEFLAG_HEURISTIC},

+    {"R",     OBJ_SIGNED, STATE_ANY, STATE_NONE, NAMEFLAG_HEURISTIC},

+    {"Linearized", OBJ_DICT, STATE_NONE, STATE_LINEARIZED, NAMEFLAG_HEURISTIC},

+    {"Filter", OBJ_HASFILTERS, STATE_ANY, STATE_FILTER, NAMEFLAG_HEURISTIC},

+    {"JavaScript", OBJ_JAVASCRIPT, STATE_S, STATE_JAVASCRIPT, NAMEFLAG_HEURISTIC},

+    {"Length", OBJ_DICT, STATE_FILTER, STATE_NONE, NAMEFLAG_HEURISTIC},

+    {"S", OBJ_DICT, STATE_NONE, STATE_S, NAMEFLAG_HEURISTIC},

+    {"Type", OBJ_DICT, STATE_NONE, STATE_NONE, NAMEFLAG_HEURISTIC},

+    {"OpenAction", OBJ_OPENACTION, STATE_ANY, STATE_OPENACTION, NAMEFLAG_HEURISTIC},

+    {"Launch", OBJ_LAUNCHACTION, STATE_ANY, STATE_LAUNCHACTION, NAMEFLAG_HEURISTIC},

+    {"Page", OBJ_PAGE, STATE_NONE, STATE_NONE, NAMEFLAG_HEURISTIC},

+    {"Contents", OBJ_CONTENTS, STATE_NONE, STATE_CONTENTS, NAMEFLAG_HEURISTIC}

 };

 #endif

@@ -1407,13 +1411,6 @@ static void handle_pdfname(struct pdf_struct *pdf, struct pdf_obj *obj, const ch

         }

     }

-    if (escapes) {

-        /* if a commonly used PDF name is escaped that is certainly

-           suspicious. */

-        cli_dbgmsg("cli_pdf: pdfname %s is escaped\n", pdfname);

-        pdfobj_flag(pdf, obj, ESCAPED_COMMON_PDFNAME);

-    }

-

     if (!act) {

         /* these are digital signature objects, filter doesn't matter,

          * we don't need them anyway */

@@ -1425,6 +1422,13 @@ static void handle_pdfname(struct pdf_struct *pdf, struct pdf_obj *obj, const ch

         return;

     }

+    if ((act->nameflags & NAMEFLAG_HEURISTIC) && escapes) {

+        /* if a commonly used PDF name is escaped that is certainly

+           suspicious. */

+        cli_dbgmsg("cli_pdf: pdfname %s is escaped\n", pdfname);

+        pdfobj_flag(pdf, obj, ESCAPED_COMMON_PDFNAME);

+    }

+

 #if HAVE_JSON

     if ((act->pdf_stats_cb))

         act->pdf_stats_cb(pdf, obj, act);