Object stream parsing can exhaust PCRE JIT and read a missing capture

Description

Parser::parseObject() separates an object-stream index from its body with a nested repeated regular expression, ignores the result of preg_match(), and then unconditionally reads capture 3.

On PHP 8.5 with PCRE 10.47, a synthetic object stream containing about 4,000 object/offset pairs makes the match return false with JIT stack limit exhausted. The subsequent array access raises Undefined array key 3.

The expression also eventually reaches the recursion limit with JIT disabled, so changing PCRE limits is not a durable solution.

Minimal reproduction

The existing ParserSub::exposedParseObject() test helper can reproduce this without a PDF fixture by passing an ObjStm structure containing 4,000 synthetic object-number offset pairs followed by simple null objects.

Expected behavior

Use the object-stream dictionary's required /N and /First entries to bound and separate the index, parse exactly N object/offset pairs with non-recursive logic, and reject malformed counts or offsets with a deterministic exception.

No PDF content or customer data is needed for the regression.

Start with Parser::parseObject() and the existing ParserSub::exposedParseObject() test helper. Build the described 4,000-pair synthetic ObjStm regression and inspect the current handling of /N, /First, preg_match(), and capture 3. Done means exactly N pairs are parsed without recursive matching, while malformed counts or offsets produce a deterministic exception.