From 83910224167a7087e219d3ab2613826b692d75d4 Mon Sep 17 00:00:00 2001
From: m-holger <m-holger@kubitscheck.org>
Date: Mon, 19 Dec 2022 14:52:32 +0000
Subject: Avoid inserting direct null objects into olist

---
 libqpdf/QPDFParser.cc         | 17 ++++++++++-------
 libqpdf/QPDF_Array.cc         |  8 ++++++--
 libqpdf/qpdf/SparseOHArray.hh |  3 +++
 3 files changed, 19 insertions(+), 9 deletions(-)

(limited to 'libqpdf')

diff --git a/libqpdf/QPDFParser.cc b/libqpdf/QPDFParser.cc
index 6b3cdb4e..30888911 100644
--- a/libqpdf/QPDFParser.cc
+++ b/libqpdf/QPDFParser.cc
@@ -308,7 +308,7 @@ QPDFParser::parse(bool& empty, bool content_stream)
                 setDescription(object, input->getLastOffset());
             }
             set_offset = true;
-            olist.push_back(is_null ? null_oh : object);
+            olist.push_back(object);
             break;
 
         case st_top:
@@ -339,16 +339,19 @@ QPDFParser::parse(bool& empty, bool content_stream)
                 // Convert list to map. Alternating elements are keys.  Attempt
                 // to recover more or less gracefully from invalid dictionaries.
                 std::set<std::string> names;
-                size_t n_elements = olist.size();
-                for (size_t i = 0; i < n_elements; ++i) {
-                    QPDFObjectHandle oh = olist.at(i);
-                    if ((!oh.isIndirect()) && oh.isName()) {
-                        names.insert(oh.getName());
+                for (auto& obj: olist) {
+                    if (obj) {
+                        if (obj->getTypeCode() == ::ot_name) {
+                            names.insert(obj->getStringValue());
+                        }
+                    } else {
+                        obj = null_oh;
                     }
                 }
 
                 std::map<std::string, QPDFObjectHandle> dict;
                 int next_fake_key = 1;
+                size_t n_elements = olist.size();
                 for (unsigned int i = 0; i < n_elements; ++i) {
                     QPDFObjectHandle key_obj = olist.at(i);
                     QPDFObjectHandle val;
@@ -414,7 +417,7 @@ QPDFParser::parse(bool& empty, bool content_stream)
             if (state_stack.back() == st_top) {
                 done = true;
             } else {
-                stack.back().olist.push_back(is_null ? null_oh : object);
+                stack.back().olist.push_back(object);
             }
         }
     }
diff --git a/libqpdf/QPDF_Array.cc b/libqpdf/QPDF_Array.cc
index 12e4b3e9..de34103e 100644
--- a/libqpdf/QPDF_Array.cc
+++ b/libqpdf/QPDF_Array.cc
@@ -123,8 +123,12 @@ void
 QPDF_Array::setFromVector(std::vector<std::shared_ptr<QPDFObject>>&& v)
 {
     this->elements = SparseOHArray();
-    for (auto&& iter: v) {
-        this->elements.append(iter);
+    for (auto&& item: v) {
+        if (item) {
+            this->elements.append(item);
+        } else {
+            ++this->elements.n_elements;
+        }
     }
 }
 
diff --git a/libqpdf/qpdf/SparseOHArray.hh b/libqpdf/qpdf/SparseOHArray.hh
index b2b98313..26ae3dc0 100644
--- a/libqpdf/qpdf/SparseOHArray.hh
+++ b/libqpdf/qpdf/SparseOHArray.hh
@@ -4,6 +4,8 @@
 #include <qpdf/QPDFObjectHandle.hh>
 #include <unordered_map>
 
+class QPDF_Array;
+
 class SparseOHArray
 {
   public:
@@ -25,6 +27,7 @@ class SparseOHArray
     const_iterator end() const;
 
   private:
+    friend class QPDF_Array;
     std::unordered_map<size_t, QPDFObjectHandle> elements;
     size_t n_elements;
 };
-- 
cgit v1.2.3-54-g00ecf