WriteXRef wrote /W[1 3 1] and three offset bytes whatever the document.
Signing a PDF larger than 16 MB recorded every offset in the appended update
modulo 16777216, so the updated catalog and the signature itself pointed into
the middle of the original body.
The field is as wide as the largest offset needs now. /DecodeParms/Columns
counts the bytes of a row apart from its predictor byte, so it follows the
field rather than staying at 5, and each byte is shifted out of the offset
rather than masked with an int too narrow to hold the mask.
Reachable only from a file whose cross-reference is already a stream, which is
why our own exports never met it. It has no test: the only path that appends a
cross-reference section is signing, and that needs a certificate.
Signed-off-by: Mike Kaganski <mike.kaganski@collabora.com>
Change-Id: I08279fcb43d0c538f66dc029890a58a76f6dab7e
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/13206
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
Reviewed-by: Miklos Vajna <vmiklos@collabora.com>
(cherry picked from commit 7e52e9eabbda9de67fedab5bf96a71902e53bc28)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/211445
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
Tested-by: Jenkins
Mike Kaganski
8343c6e702