Stop shipping two denial-of-service defects to our callers

deps_test.go

@@ -0,0 +1,49 @@
+package render
+
+import (
+	"testing"
+	"time"
+
+	"github.com/go-pdfkit/reader"
+)
+
+// TestAFileWithAnAbsurdObjectNumberOpensAtOnce guards the dependency rather
+// than this package's own code.
+//
+// reader v0.4.1 stopped answering "which objects call themselves a catalogue?"
+// by counting from zero to the largest object number a file names. A file of
+// 219 bytes with no trailer and no startxref can only be read by repairing it,
+// and if the last object it declares is numbered 2 147 483 647 that is two
+// thousand million map lookups for four objects: 21.2 seconds, and not one
+// byte allocated, which is why no memory limit anywhere caught it.
+//
+// Requiring v0.4.0 here meant that a caller who asked only for this package
+// got the defect: minimum version selection would give them the version this
+// go.mod names. Nothing in the test suite noticed, because a package's own
+// tests never see its callers' module graph.
+//
+// The file is built rather than committed, so this brings nobody else's PDF
+// into the repository.
+func TestAFileWithAnAbsurdObjectNumberOpensAtOnce(t *testing.T) {
+	file := []byte("%PDF-1.4\n" +
+		"1 0 obj<</Type/Catalog/Pages 2 0 R>>endobj\n" +
+		"2 0 obj<</Type/Pages/Kids[3 0 R]/Count 1>>endobj\n" +
+		"3 0 obj<</Type/Page/Parent 2 0 R/MediaBox[0 0 10 10]>>endobj\n" +
+		"2147483647 0 obj<</X 1>>endobj\n")
+	done := make(chan error, 1)
+	go func() {
+		_, err := reader.Open(file)
+		done <- err
+	}()
+	select {
+	case err := <-done:
+		if err != nil {
+			t.Fatalf("the file did not open: %v", err)
+		}
+	case <-time.After(5 * time.Second):
+		// Against reader v0.4.0 this takes twenty-one seconds. Five is far
+		// more than the fixed version needs and far less than the defect.
+		t.Fatal("219 bytes took more than five seconds to open: the reader " +
+			"this module requires still walks to the largest object number")
+	}
+}

go.mod

@@ -6,7 +6,7 @@ require (
 	github.com/go-gfx/gfx v0.10.0
 	github.com/go-opentype/fonts v0.9.0
 	github.com/go-opentype/opentype v0.10.0
-	github.com/go-pdfkit/reader v0.4.0
+	github.com/go-pdfkit/reader v0.4.1
 )
 
-require github.com/go-pdfkit/pdffont v0.2.0
+require github.com/go-pdfkit/pdffont v0.3.0

go.sum

@@ -2,11 +2,9 @@ github.com/go-gfx/gfx v0.10.0 h1:3AqOO8TZph6/U8+ejJxYkCZ+wzddxAbZ7fxi6TvGop4=
 github.com/go-gfx/gfx v0.10.0/go.mod h1:bFt/MWyYWRU3Ic9IaB8XOC9KLMMHRRmahMk4FaIGK7g=
 github.com/go-opentype/fonts v0.9.0 h1:slB6OB3riLyUPrOxqXe0s6/AzdenF1TDvCN8N87hhQk=
 github.com/go-opentype/fonts v0.9.0/go.mod h1:C6yQL2apHItfEZ5hztpsHF0S5mlX/hklLlq/Z5fRG/g=
-github.com/go-opentype/opentype v0.9.0 h1:GFgcJ3nwTDp4NJr5O+Paw7lhZx5Jv/R+noZwvhYDlkM=
-github.com/go-opentype/opentype v0.9.0/go.mod h1:AOixevJf7XQaH7+WG+OMIOZEbYPXfMqklVk26Y6YTUU=
 github.com/go-opentype/opentype v0.10.0 h1:cZVMZ3RVkcijXmxlmpqyVkjlNc33aSB2ugKVWYvoLUg=
 github.com/go-opentype/opentype v0.10.0/go.mod h1:AOixevJf7XQaH7+WG+OMIOZEbYPXfMqklVk26Y6YTUU=
-github.com/go-pdfkit/pdffont v0.2.0 h1:yAp/oR5Z2kkqs4r0GWMalZMC7rc7XSCZXgwIypbpMWM=
-github.com/go-pdfkit/pdffont v0.2.0/go.mod h1:y4vo5DgT95e57C3XxIWfA/xss+x6RwZwyj6KWdJc86s=
-github.com/go-pdfkit/reader v0.4.0 h1:qPbNZSO+Xl+4NBvQoV1PYt7HlqHaEAQ1tUc6/IL8JAU=
-github.com/go-pdfkit/reader v0.4.0/go.mod h1:fQFOVfCMUui1AdvD4qhimdyvvNr9KvvJ1S7IuKZjyV8=
+github.com/go-pdfkit/pdffont v0.3.0 h1:G5DKcAmsZJ0e17QhSrcUaL7PKEXKjUx4P/iGMl7bAbI=
+github.com/go-pdfkit/pdffont v0.3.0/go.mod h1:bfmNLna1l1CljNX/Utg55YzFylovfmI7sJnvgA3bzKI=
+github.com/go-pdfkit/reader v0.4.1 h1:pRxFqRjsn7H/VsGfWb9nYWyFuDgTU2Pjmoq/f5mgVq4=
+github.com/go-pdfkit/reader v0.4.1/go.mod h1:fQFOVfCMUui1AdvD4qhimdyvvNr9KvvJ1S7IuKZjyV8=