Skip to content
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
33 changes: 33 additions & 0 deletions src/main/java/org/verapdf/pd/PDAnnotation.java
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,7 @@
import org.verapdf.exceptions.LoopedException;
import org.verapdf.pd.actions.PDAction;
import org.verapdf.pd.actions.PDAnnotationAdditionalActions;
import org.verapdf.tools.StaticResources;
import org.verapdf.tools.TypeConverter;

import java.util.HashSet;
Expand Down Expand Up @@ -290,4 +291,36 @@ public static Boolean isOutsideCropBox(PDPage page, PDAnnotation annotation) {
}
return null;
}

public static COSObject getPageFromDestination(COSObject destination, ASAtom key) {
if (destination.getType() == COSObjType.COS_STRING) {
PDNamesDictionary namesDictionary = StaticResources.getDocument().getCatalog().getNamesDictionary();
if (namesDictionary == null) {
return null;
}
PDNameTreeNode dests = namesDictionary.getDests();
if (dests != null) {
destination = dests.getObject(destination.getString());
if (destination == null) {
return null;
}
}
} else if (destination.getType() == COSObjType.COS_NAME) {
COSObject dests = StaticResources.getDocument().getCatalog().getDests();
if (dests != null) {
destination = dests.getKey(destination.getDirectBase().getName());
if (destination == null) {
return null;
}
}
}
if (destination.getType() == COSObjType.COS_DICT) {
destination = destination.getKey(key);
}
COSObject obj = null;
if (destination.getType() == COSObjType.COS_ARRAY && destination.size() > 0) {
obj = destination.at(0);
}
return obj;
}
Comment on lines +295 to +325
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

Fix null-safety and destination resolution order in getPageFromDestination.

There are two correctness issues:

  • On Line [295], destination can be null and is dereferenced immediately.
  • On Line [318], destination.getKey(key) can return null, then Line [321] dereferences it.
  • Also, when a dict resolves to COS_STRING/COS_NAME, named-destination lookup is skipped because that logic runs earlier.
Proposed fix
 public static COSObject getPageFromDestination(COSObject destination,  ASAtom key) {
-    if (destination.getType() == COSObjType.COS_STRING) {
-        PDNamesDictionary namesDictionary = StaticResources.getDocument().getCatalog().getNamesDictionary();
-        if (namesDictionary == null) {
-            return null;
-        }
-        PDNameTreeNode dests = namesDictionary.getDests();
-        if (dests != null) {
-            destination = dests.getObject(destination.getString());
-            if (destination == null) {
-                return null;
-            }
-        }
-    } else if (destination.getType() == COSObjType.COS_NAME) {
-        COSObject dests = StaticResources.getDocument().getCatalog().getDests();
-        if (dests != null) {
-            destination = dests.getKey(destination.getDirectBase().getName());
-            if (destination == null) {
-                return null;
-            }
-        }
-    }
-    if (destination.getType() == COSObjType.COS_DICT) {
-        destination = destination.getKey(key);
-    }
-    COSObject obj = null;
-    if (destination.getType() == COSObjType.COS_ARRAY && destination.size() > 0) {
-        obj = destination.at(0);
-    }
-    return obj;
+    if (destination == null) {
+        return null;
+    }
+
+    while (destination != null) {
+        if (destination.getType() == COSObjType.COS_DICT) {
+            destination = destination.getKey(key);
+            continue;
+        }
+        if (destination.getType() == COSObjType.COS_STRING) {
+            PDNamesDictionary namesDictionary = StaticResources.getDocument().getCatalog().getNamesDictionary();
+            if (namesDictionary == null) {
+                return null;
+            }
+            PDNameTreeNode dests = namesDictionary.getDests();
+            destination = dests == null ? null : dests.getObject(destination.getString());
+            continue;
+        }
+        if (destination.getType() == COSObjType.COS_NAME) {
+            COSObject dests = StaticResources.getDocument().getCatalog().getDests();
+            destination = dests == null ? null : dests.getKey(destination.getName());
+            continue;
+        }
+        if (destination.getType() == COSObjType.COS_ARRAY) {
+            return destination.size() > 0 ? destination.at(0) : null;
+        }
+        return null;
+    }
+    return null;
 }
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@src/main/java/org/verapdf/pd/PDAnnotation.java` around lines 295 - 325, The
getPageFromDestination method has null-safety and lookup-order bugs: ensure you
null-check the initial destination before dereferencing its type (avoid calling
destination.getType() if destination==null), guard uses of
destination.getKey(key) and subsequent destination.size()/at(0) against null
returns, and adjust resolution order so that if destination is a COS_DICT whose
value for the provided key is a COS_STRING or COS_NAME you perform the
named-destination lookup (using PDNamesDictionary/PDNameTreeNode or
Catalog.getDests()) on that value rather than skipping it; update logic in
getPageFromDestination to reassign destination only after null-checks and to
handle getKey/getString/getDirectBase returning null before further dereferences
(refer to method getPageFromDestination, variables destination, key,
PDNamesDictionary, PDNameTreeNode, and calls getKey/getString/getDirectBase).

}
Loading