xmlsecurity PDF verify: fix reading names containing ']'

Also fix parsing '<< /Foo [ /Bar ] >>'.

Change-Id: I3375001730b4d2e447b0dd8a7809a7bfb013126c
Reviewed-on: https://gerrit.libreoffice.org/31498
Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Miklos Vajna <vmiklos@collabora.co.uk>

1 files changed, 12 insertions, 7 deletions

diff --git a/xmlsecurity/source/pdfio/pdfdocument.cxx b/xmlsecurity/source/pdfio/pdfdocument.cxx
index 81f8caae8655..1c949b161ee3 100644
--- a/xmlsecurity/source/pdfio/pdfdocument.cxx
+++ b/xmlsecurity/source/pdfio/pdfdocument.cxx
@@ -2906,14 +2906,19 @@ size_t PDFDictionaryElement::Parse(const std::vector< std::unique_ptr<PDFElement
             }
             else
             {
-                // Name-name key-value.
-                rDictionary[aName] = pName;
-                if (pThisDictionary)
+                if (pArray)
+                    pArray->PushBack(pName);
+                else
                 {
-                    pThisDictionary->SetKeyOffset(aName, nNameOffset);
-                    pThisDictionary->SetKeyValueLength(aName, pName->GetLocation() + pName->GetLength() - nNameOffset);
+                    // Name-name key-value.
+                    rDictionary[aName] = pName;
+                    if (pThisDictionary)
+                    {
+                        pThisDictionary->SetKeyOffset(aName, nNameOffset);
+                        pThisDictionary->SetKeyValueLength(aName, pName->GetLocation() + pName->GetLength() - nNameOffset);
+                    }
+                    aName.clear();
                 }
-                aName.clear();
             }
             continue;
         }
@@ -3487,7 +3492,7 @@ bool PDFNameElement::Read(SvStream& rStream)
     rStream.ReadChar(ch);
     while (!rStream.IsEof())
     {
-        if (isspace(ch) || ch == '/' || ch == '[' || ch == '<' || ch == '>' || ch == '(')
+        if (isspace(ch) || ch == '/' || ch == '[' || ch == ']' || ch == '<' || ch == '>' || ch == '(')
         {
             rStream.SeekRel(-1);
             m_aValue = aBuf.makeStringAndClear();