From 2f4fee3555f0501838c9ac5c81687f57c222d879 Mon Sep 17 00:00:00 2001
From: Svetlana Kulikova <Svetlana.Kulikova@onlyoffice.com>
Date: Thu, 15 Feb 2024 16:35:27 +0300
Subject: [PATCH 1/2] Fix bug 66504

---
 PdfFile/lib/xpdf/XRef.cc | 12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

diff --git a/PdfFile/lib/xpdf/XRef.cc b/PdfFile/lib/xpdf/XRef.cc
index f7556c3e1ee..b86fc6bdb8c 100644
--- a/PdfFile/lib/xpdf/XRef.cc
+++ b/PdfFile/lib/xpdf/XRef.cc
@@ -419,12 +419,9 @@ GFileOffset XRef::getStartXref() {
   nTry = 1;
   bFind = false;
 
-  do {
-    str->setPos(xrefSearchSize * nTry, -1);
-    n = str->getBlock(buf, xrefSearchSize);
-    if (n <= 0) {
-      break;
-    }
+  str->setPos(xrefSearchSize * nTry, -1);
+  while ((n = str->getBlock(buf, xrefSearchSize)) > 0)
+  {
     buf[n] = '\0';
 
     // find startxref
@@ -439,7 +436,8 @@ GFileOffset XRef::getStartXref() {
       break;
     }
     nTry++;
-  } while (str->getPos() > 0);
+    str->setPos(xrefSearchSize * nTry, -1);
+  }
 
   // read last xrefSearchSize bytes
 

From 5c69cb0358894e29fbdee8456bef4fb823941810 Mon Sep 17 00:00:00 2001
From: Svetlana Kulikova <Svetlana.Kulikova@onlyoffice.com>
Date: Thu, 15 Feb 2024 17:20:57 +0300
Subject: [PATCH 2/2] Fix MemStream::setPos

---
 PdfFile/lib/xpdf/Stream.cc |  4 +++-
 PdfFile/lib/xpdf/XRef.cc   | 10 ++++++----
 2 files changed, 9 insertions(+), 5 deletions(-)

diff --git a/PdfFile/lib/xpdf/Stream.cc b/PdfFile/lib/xpdf/Stream.cc
index e531e7a822d..0d2d284bb5b 100644
--- a/PdfFile/lib/xpdf/Stream.cc
+++ b/PdfFile/lib/xpdf/Stream.cc
@@ -989,7 +989,9 @@ void MemStream::setPos(GFileOffset pos, int dir) {
   } else {
     i = (Guint)(start + length - pos);
   }
-  if (i < start) {
+  if (dir < 0 && start + length < pos) {
+    i = 0;
+  } else if (i < start) {
     i = start;
   } else if (i > start + length) {
     i = start + length;
diff --git a/PdfFile/lib/xpdf/XRef.cc b/PdfFile/lib/xpdf/XRef.cc
index b86fc6bdb8c..3b0f2fe998a 100644
--- a/PdfFile/lib/xpdf/XRef.cc
+++ b/PdfFile/lib/xpdf/XRef.cc
@@ -419,9 +419,12 @@ GFileOffset XRef::getStartXref() {
   nTry = 1;
   bFind = false;
 
-  str->setPos(xrefSearchSize * nTry, -1);
-  while ((n = str->getBlock(buf, xrefSearchSize)) > 0)
+  bool isBreak = false;
+  do
   {
+    str->setPos(xrefSearchSize * nTry, -1);
+    isBreak = str->getPos() == 0;
+    n = str->getBlock(buf, xrefSearchSize);
     buf[n] = '\0';
 
     // find startxref
@@ -436,8 +439,7 @@ GFileOffset XRef::getStartXref() {
       break;
     }
     nTry++;
-    str->setPos(xrefSearchSize * nTry, -1);
-  }
+  } while (!isBreak);
 
   // read last xrefSearchSize bytes