Font::loadTranslateTable() mis-parses bfrange destination arrays and may enter enormous loop

• PHP Version: 8.4.21
• PDFParser Version: v2.12.5

Description:

Trying to parse this PDF enters an basically infinite loop in Font.php, so parsing will never finish.

I did some debugging into this and am trying to describe my findings:

When looping through the objects in Document.php->init(), the object with key 197_0 seems to have issues parsing. The object with key 503_0 also takes a few seconds to parse, but eventually finishes. But let's focus on object 197_0.

In Font.php, there's a section Support for multiple bfrange sections where a Regex '/<(?P<from>[0-9A-F]+)> *<(?P<to>[0-9A-F]+)> *(?P<dest><[0-9A-F]+>|\[[\r\n<>0-9A-F ]+\])[ \r\n]+/is' is trying to capture items. Eventually, this regex is fed with the $section:

<01><80>[<0394><0398><039B><039E><03A0><03A3><03A5>
<03A6><03A8><2126><00660066><00660069><0066006C><006600660069><00660066006C>
<0131><0237><0060><00B4><02C7><02D8><00AF><02DA>
<00B8><00DF><00E6><0153><00F8><00C6><0152><00D8>
<0337><0021><201D><0023><0024><0025><0026><2019>
<0028><0029><002A><002B><002C><002D><002E><002F>
<0030><0031><0032><0033><0034><0035><0036><0037>
<0038><0039><003A><003B><00A1><003D><00BF><003F>
<0040><0041><0042><0043><0044><0045><0046><0047>
<0048><0049><004A><004B><004C><004D><004E><004F>
<0050><0051><0052><0053><0054><0055><0056><0057>
<0058><0059><005A><005B><201C><005D><02C6><02D9>
<2018><0061><0062><0063><0064><0065><0066><0067>
<0068><0069><006A><006B><006C><006D><006E><006F>
<0070><0071><0072><0073><0074><0075><0076><0077>
<0078><0079><007A><2013><2014><02DD><02DC><00A8>
<0337>]

and returns these matches (json encoded for readability):

{
   "0":[
      "<03A0><03A3><03A5>\n",
      "<0066006C><006600660069><00660066006C>\n",
      "<02D8><00AF><02DA>\n",
      "<00C6><0152><00D8>\n",
      "<0025><0026><2019>\n",
      "<002D><002E><002F>\n",
      "<0035><0036><0037>\n",
      "<003D><00BF><003F>\n",
      "<0045><0046><0047>\n",
      "<004D><004E><004F>\n",
      "<0055><0056><0057>\n",
      "<005D><02C6><02D9>\n",
      "<0065><0066><0067>\n",
      "<006D><006E><006F>\n",
      "<0075><0076><0077>\n",
      "<02DD><02DC><00A8>\n"
   ],
   "from":[
      "03A0",
      "0066006C",
      "02D8",
      "00C6",
      "0025",
      "002D",
      "0035",
      "003D",
      "0045",
      "004D",
      "0055",
      "005D",
      "0065",
      "006D",
      "0075",
      "02DD"
   ],
   "1":[
      "03A0",
      "0066006C",
      "02D8",
      "00C6",
      "0025",
      "002D",
      "0035",
      "003D",
      "0045",
      "004D",
      "0055",
      "005D",
      "0065",
      "006D",
      "0075",
      "02DD"
   ],
   "to":[
      "03A3",
      "006600660069",
      "00AF",
      "0152",
      "0026",
      "002E",
      "0036",
      "00BF",
      "0046",
      "004E",
      "0056",
      "02C6",
      "0066",
      "006E",
      "0076",
      "02DC"
   ],
   "2":[
      "03A3",
      "006600660069",
      "00AF",
      "0152",
      "0026",
      "002E",
      "0036",
      "00BF",
      "0046",
      "004E",
      "0056",
      "02C6",
      "0066",
      "006E",
      "0076",
      "02DC"
   ],
   "dest":[
      "<03A5>",
      "<00660066006C>",
      "<02DA>",
      "<00D8>",
      "<2019>",
      "<002F>",
      "<0037>",
      "<003F>",
      "<0047>",
      "<004F>",
      "<0057>",
      "<02D9>",
      "<0067>",
      "<006F>",
      "<0077>",
      "<00A8>"
   ],
   "3":[
      "<03A5>",
      "<00660066006C>",
      "<02DA>",
      "<00D8>",
      "<2019>",
      "<002F>",
      "<0037>",
      "<003F>",
      "<0047>",
      "<004F>",
      "<0057>",
      "<02D9>",
      "<0067>",
      "<006F>",
      "<0077>",
      "<00A8>"
   ]
}

When the foreach loop reaches $key === 1, the nested for loop

for ($char = $char_from; $char <= $char_to; ++$char) {
    $this->table[$char] = self::uchr($char - $char_from + $offset);
}

is executed with $char_from = 6684780 and $char_to = 438093348969, basically leading to an infinite loop.

Now since I absolutely don't know anything about how a PDF file works internally, I tried getting some explanations from AI. I know about the bad reputation that AI might have, and the explanation might be incorrect, so please bear with me.

Basically it stated that the bfrange parser expects entries of either

• a range with single destination start (<srcFrom> <srcTo> <dstStart>)
• or a range with explicit destination array (<srcFrom> <srcTo> [<dst1> <dst2> ...])

My actual section is this:
<01><80>[<0394><0398><039B>...<0337>], so it's of the second form.

Apparently, the regex in Font::loadTranslateTable() is greedy-but-constrained and requires trailing whitespace after the whole match, it fails to consume the full array and instead starts matching inside the array, treating chunks like <03A0><03A3><03A5> as if they were a standalone bfrange line:

• from = 03A0
• to = 03A3
• dest = <03A5>

The regex just scans for any substring that looks like <hex><hex><hex-or-[...]> and starts matching inside the bracket array.

It eventually hits:

• from = 0066006C
• to = 006600660069
• dest = <00660066006C>

Which is converted to

• hexdec('0066006C') = 6684780
• hexdec('006600660069') = 438093348969

PDF input

045b92d0ee913f9635ff1359aa1ef2a941215f4f.pdf

Expected output & actual output

The parser should produce output in a reasonable amount of time.

Code

$parser = new PdfParser();
$pdf = $parser->parseFile($filePath);

Start in Font.php at Font::loadTranslateTable(), then inspect Document.php->init() to understand how object 197_0 reaches the parser. Reproduce with 045b92d0ee913f9635ff1359aa1ef2a941215f4f.pdf and trace the bfrange regex and loop; done means the PDF parses in a reasonable time without treating array contents as ranges.