Try to find another rootNum if actual rootNum doesn't point to a dict

Bug #14303

2 files changed, 14 insertions, 4 deletions

diff --git a/poppler/XRef.cc b/poppler/XRef.cc
index 9a0c9006..4d013202 100644
--- a/poppler/XRef.cc
+++ b/poppler/XRef.cc
@@ -774,7 +774,7 @@ GBool XRef::readXRefStreamSection(Stream *xrefStr, int *w, int first, int n) {
 }
 
 // Attempt to construct an xref table for a damaged file.
-GBool XRef::constructXRef(GBool *wasReconstructed) {
+GBool XRef::constructXRef(GBool *wasReconstructed, GBool needCatalogDict) {
   Parser *parser;
   Object newTrailerDict, obj;
   char buf[256];
@@ -834,7 +834,7 @@ GBool XRef::constructXRef(GBool *wasReconstructed) {
         parser->getObj(&newTrailerDict);
         if (newTrailerDict.isDict()) {
 	  newTrailerDict.dictLookupNF("Root", &obj);
-	  if (obj.isRef()) {
+	  if (obj.isRef() && (!gotRoot || !needCatalogDict) && rootNum != obj.getRefNum()) {
 	    rootNum = obj.getRefNum();
 	    rootGen = obj.getRefGen();
 	    if (!trailerDict.isNone()) {
@@ -990,6 +990,16 @@ GBool XRef::okToAssemble(GBool ignoreOwnerPW) {
   return (!ignoreOwnerPW && ownerPasswordOk) || (permFlags & permAssemble);
 }
 
+Object *XRef::getCatalog(Object *catalog) {
+  Object *obj = fetch(rootNum, rootGen, catalog);
+  if (obj->isDict()) {
+    return obj;
+  }
+  GBool wasReconstructed = false;
+  GBool ok = constructXRef(&wasReconstructed, gTrue);
+  return (ok) ? fetch(rootNum, rootGen, catalog) : obj;
+}
+
 Object *XRef::fetch(int num, int gen, Object *obj, int recursion) {
   XRefEntry *e;
   Parser *parser;
diff --git a/poppler/XRef.h b/poppler/XRef.h
index 76621ad4..2add0a14 100644
--- a/poppler/XRef.h
+++ b/poppler/XRef.h
@@ -106,7 +106,7 @@ public:
   int getPermFlags() { return permFlags; }
 
   // Get catalog object.
-  Object *getCatalog(Object *obj) { return fetch(rootNum, rootGen, obj); }
+  Object *getCatalog(Object *obj);
 
   // Fetch an indirect reference.
   Object *fetch(int num, int gen, Object *obj, int recursion = 0);
@@ -179,7 +179,7 @@ private:
   GBool readXRefTable(Parser *parser, Guint *pos, std::vector<Guint> *followedXRefStm);
   GBool readXRefStreamSection(Stream *xrefStr, int *w, int first, int n);
   GBool readXRefStream(Stream *xrefStr, Guint *pos);
-  GBool constructXRef(GBool *wasReconstructed);
+  GBool constructXRef(GBool *wasReconstructed, GBool needCatalogDict = gFalse);
   GBool parseEntry(Guint offset, XRefEntry *entry);
 
   class XRefWriter {