RELEASE-NOTES.txt

-Release Notes -- Apache PDFBox -- Version 1.8.15
+Release Notes -- Apache PDFBox -- Version 1.8.16
 
 Introduction
 ------------
 
 The Apache PDFBox library is an open source Java tool for working with PDF documents.
 
-This is an incremental bugfix release based on the earlier 1.8.14 release. It 
+This is an incremental bugfix release based on the earlier 1.8.15 release. It 
 contains a couple of fixes and small improvements.
 
 For more details on all fixes included in this release, please refer to the following
@@ -13,11 +13,15 @@ issues on the PDFBox issue tracker at https://issues.apache.org/jira/browse/PDFB
 
 Bug
 
-[PDFBOX-4197] - PDStructureElement.getAttributes() ignores reference objects
+[PDFBOX-4261] - Invalidated signature signing pdf twice
+[PDFBOX-4276] - Multiply blend mode not detected
+[PDFBOX-4283] - Allowing Rectangles with additional elements
+[PDFBOX-4298] - NullPointerException when doing overlay
+[PDFBOX-4316] - RemoveAllText does not delete all parameters with " operator
 
 Improvement
 
-[PDFBOX-4251] - Optimize AFMParser
+[PDFBOX-4274] - Get rid of warning about prerequisites
 
 Release Contents
 ----------------
@@ -29,7 +33,7 @@ See the README.txt file for instructions on how to build this release.
 The source archive is accompanied by SHA512 checksum and a PGP signature
 that you can use to verify the authenticity of your download. The public
 key used for the PGP signature can be found at 
-https://svn.apache.org/repos/asf/pdfbox/KEYS.
+https://www.apache.org/dist/pdfbox/KEYS.
 
 About Apache PDFBox
 -------------------

ant/pom.xml

@@ -23,7 +23,7 @@
   <parent>
     <groupId>org.apache.pdfbox</groupId>
     <artifactId>pdfbox-parent</artifactId>
-    <version>1.8.15</version>
+    <version>1.8.16</version>
     <relativePath>../parent/pom.xml</relativePath>
   </parent>
 

app/pom.xml

@@ -23,7 +23,7 @@
   <parent>
     <groupId>org.apache.pdfbox</groupId>
     <artifactId>pdfbox-parent</artifactId>
-    <version>1.8.15</version>
+    <version>1.8.16</version>
     <relativePath>../parent/pom.xml</relativePath>
   </parent>
 

debian/changelog

+libpdfbox-java (1:1.8.16-1) unstable; urgency=medium
+
+  * Team upload.
+  * New upstream version 1.8.16.
+    - Fix CVE-2018-11797: denial-of-service via specially crafted PDF file.
+      (Closes: #910390)
+  * Declare compliance with Debian Policy 4.2.1.
+
+ -- Markus Koschany <apo@debian.org>  Sat, 06 Oct 2018 15:47:18 +0200
+
 libpdfbox-java (1:1.8.15-1) unstable; urgency=medium
 
   * Team upload.

debian/control

@@ -19,7 +19,7 @@ Build-Depends-Indep: default-jdk,
                      libicu4j-java,
                      libmaven-javadoc-plugin-java,
                      poppler-data
-Standards-Version: 4.1.4
+Standards-Version: 4.2.1
 Vcs-Git: https://anonscm.debian.org/git/pkg-java/libpdfbox-java.git
 Vcs-Browser: https://anonscm.debian.org/cgit/pkg-java/libpdfbox-java.git
 Homepage: https://pdfbox.apache.org

examples/pom.xml

@@ -23,7 +23,7 @@
   <parent>
     <groupId>org.apache.pdfbox</groupId>
     <artifactId>pdfbox-parent</artifactId>
-    <version>1.8.15</version>
+    <version>1.8.16</version>
     <relativePath>../parent/pom.xml</relativePath>
   </parent>
 

examples/src/main/java/org/apache/pdfbox/examples/signature/CreateSignature.java

@@ -190,10 +190,6 @@ public class CreateSignature implements SignatureInterface
     } 
     finally
     {
-      if (randomAccessFile!= null) 
-      {
-        randomAccessFile.close();
-      }
       if (scratchFile != null && scratchFile.exists() && !scratchFile.delete())
       {
         scratchFile.deleteOnExit();

examples/src/main/java/org/apache/pdfbox/examples/util/RemoveAllText.java

@@ -83,15 +83,24 @@ public class RemoveAllText
                         if( token instanceof PDFOperator )
                         {
                             PDFOperator op = (PDFOperator)token;
-                            if( op.getOperation().equals( "TJ") || op.getOperation().equals( "Tj" ))
+                            if ("TJ".equals(op.getOperation()) ||
+                                "Tj".equals(op.getOperation()) ||
+                                "'".equals(op.getOperation()))
                             {
                                 //remove the one argument to this operator
                                 newTokens.remove( newTokens.size() -1 );
                                 continue;
                             }
+                            else if ("\"".equals(op.getOperation()))
+                            {
+                                // remove the 3 arguments to this operator
+                                newTokens.remove(newTokens.size() - 1);
+                                newTokens.remove(newTokens.size() - 1);
+                                newTokens.remove(newTokens.size() - 1);
+                                continue;
+                            }
                         }
                         newTokens.add( token );
-
                     }
                     PDStream newContents = new PDStream( document );
                     ContentStreamWriter writer = new ContentStreamWriter( newContents.createOutputStream() );

fontbox/pom.xml

@@ -21,7 +21,7 @@
   <parent>
     <groupId>org.apache.pdfbox</groupId>
     <artifactId>pdfbox-parent</artifactId>
-    <version>1.8.15</version>
+    <version>1.8.16</version>
     <relativePath>../parent/pom.xml</relativePath>
   </parent>
 

jempbox/pom.xml

@@ -21,7 +21,7 @@
   <parent>
     <groupId>org.apache.pdfbox</groupId>
     <artifactId>pdfbox-parent</artifactId>
-    <version>1.8.15</version>
+    <version>1.8.16</version>
     <relativePath>../parent/pom.xml</relativePath>
   </parent>
 

lucene/pom.xml

@@ -23,7 +23,7 @@
   <parent>
     <groupId>org.apache.pdfbox</groupId>
     <artifactId>pdfbox-parent</artifactId>
-    <version>1.8.15</version>
+    <version>1.8.16</version>
     <relativePath>../parent/pom.xml</relativePath>
   </parent>
 

parent/pom.xml

@@ -29,7 +29,7 @@
 
   <groupId>org.apache.pdfbox</groupId>
   <artifactId>pdfbox-parent</artifactId>
-  <version>1.8.15</version>
+  <version>1.8.16</version>
   <packaging>pom</packaging>
 
   <name>PDFBox parent</name>
@@ -49,10 +49,6 @@
     <project.build.sourceEncoding>ISO-8859-1</project.build.sourceEncoding>
   </properties>
 
-  <prerequisites>
-    <maven>3.0.0</maven>
-  </prerequisites>
-
   <profiles>
     <profile>
       <id>pedantic</id>
@@ -73,7 +69,7 @@
           <plugin>
               <groupId>org.owasp</groupId>
               <artifactId>dependency-check-maven</artifactId>
-              <version>3.2.1</version>
+              <version>3.3.2</version>
               <configuration>
                   <failBuildOnAnyVulnerability>true</failBuildOnAnyVulnerability>
                   <suppressionFile>suppressions.xml</suppressionFile>
@@ -93,6 +89,23 @@
 
   <build>
       <plugins>
+        <plugin>
+            <artifactId>maven-enforcer-plugin</artifactId>
+            <executions>
+                <execution>
+                    <goals>
+                        <goal>enforce</goal>
+                    </goals>
+                    <configuration>
+                        <rules combine.children="append">
+                            <requireMavenVersion>
+                                <version>3.0.0</version>
+                            </requireMavenVersion>
+                        </rules>    
+                    </configuration>
+                </execution>
+            </executions>
+        </plugin>
         <plugin>
         <artifactId>maven-compiler-plugin</artifactId>
         <configuration>
@@ -105,7 +118,7 @@
         <configuration>
           <source>1.5</source>
           <links>
-            <link>http://download.oracle.com/javase/1.5.0/docs/api/</link>
+            <link>https://docs.oracle.com/javase/1.5.0/docs/api/</link>
           </links>
         </configuration>
       </plugin>
@@ -133,7 +146,7 @@
         <plugin>
             <groupId>org.codehaus.mojo</groupId>
             <artifactId>animal-sniffer-maven-plugin</artifactId>
-            <version>1.14</version>
+            <version>1.17</version>
             <configuration>
               <signature>
                 <groupId>org.codehaus.mojo.signature</groupId>
@@ -319,8 +332,8 @@
   </developers>
 
   <scm>
-    <connection>scm:svn:http://svn.apache.org/repos/asf/maven/pom/tags/1.8.15/pdfbox-parent</connection>
-    <developerConnection>scm:svn:https://svn.apache.org/repos/asf/maven/pom/tags/1.8.15/pdfbox-parent</developerConnection>
-    <url>http://svn.apache.org/viewvc/maven/pom/tags/1.8.15/pdfbox-parent</url>
+    <connection>scm:svn:http://svn.apache.org/repos/asf/maven/pom/tags/1.8.16/pdfbox-parent</connection>
+    <developerConnection>scm:svn:https://svn.apache.org/repos/asf/maven/pom/tags/1.8.16/pdfbox-parent</developerConnection>
+    <url>http://svn.apache.org/viewvc/maven/pom/tags/1.8.16/pdfbox-parent</url>
   </scm>
 </project>

pdfbox/pom.xml

@@ -23,7 +23,7 @@
     <parent>
         <groupId>org.apache.pdfbox</groupId>
         <artifactId>pdfbox-parent</artifactId>
-        <version>1.8.15</version>
+        <version>1.8.16</version>
         <relativePath>../parent/pom.xml</relativePath>
     </parent>
 

pdfbox/src/main/java/org/apache/pdfbox/Overlay.java

@@ -271,7 +271,8 @@ public class Overlay
             }
             else
             {
-                throw new IOException( "Contents are unknown type:" + contents.getClass().getName() );
+                throw new IOException( "Unknown content type: " +
+                        (contents == null ? "(null)" : contents.getClass().getName()));
             }
         }
     }
@@ -391,7 +392,8 @@ public class Overlay
             }
             else
             {
-                throw new IOException( "Contents are unknown type:" + contents.getClass().getName() );
+                throw new IOException( "Unknown content type: " +
+                        (contents == null ? "(null)" : contents.getClass().getName()));
             }
             pageCount++;
         }

pdfbox/src/main/java/org/apache/pdfbox/cos/COSArray.java

@@ -525,7 +525,9 @@ public class COSArray extends COSBase implements Iterable<COSBase>
         float[] retval = new float[size()];
         for (int i = 0; i < size(); i++)
         {
-            retval[i] = ((COSNumber)getObject( i )).floatValue();
+            COSBase base = getObject(i);
+            retval[i] =
+                base instanceof COSNumber ? ((COSNumber) base).floatValue() : 0;
         }
         return retval;
     }

pdfbox/src/main/java/org/apache/pdfbox/cos/COSDictionary.java

@@ -1448,11 +1448,10 @@ public class COSDictionary extends COSBase
     }
 
     /**
-     * This will add all of the dictionarys keys/values to this dictionary. Only called when adding keys to a trailer
-     * that already exists.
+     * This will add all of the dictionaries keys/values to this dictionary.
+     * Only called when adding keys to a trailer that already exists.
      *
-     * @param dic
-     *            The dic to get the keys from.
+     * @param dic The dictionaries to get the keys from.
      */
     public void addAll(COSDictionary dic)
     {
@@ -1494,14 +1493,15 @@ public class COSDictionary extends COSBase
     }
 
     /**
-     * This will add all of the dictionarys keys/values to this dictionary, but only if they don't already exist. If a
-     * key already exists in this dictionary then nothing is changed.
+     * This will add all of the dictionaries keys/values to this dictionary, but
+     * only if they don't already exist. If a key already exists in this
+     * dictionary then nothing is changed.
      *
-     * @param dic
-     *            The dic to get the keys from.
+     * @param dic The dictionaries to get the keys from.
      *
-     * @deprecated This method should no longer be used and will be removed in 3.0 because it could
-     * also merge attributes that should not be merged (filter and length in a COSStream.
+     * @deprecated This method should no longer be used and will be removed in
+     * 3.0 because it could also merge attributes that should not be merged
+     * (filter and length) in a COSStream.
      */
     @Deprecated
     public void mergeInto(COSDictionary dic)

pdfbox/src/main/java/org/apache/pdfbox/exceptions/COSVisitorException.java

@@ -26,7 +26,7 @@ public class COSVisitorException extends WrappedException
 {
 
     /**
-     * COSVisitorException constructor comment.
+     * Constructor.
      *
      * @param e The root exception that caused this exception.
      */

pdfbox/src/main/java/org/apache/pdfbox/exceptions/WrappedException.java

@@ -28,7 +28,7 @@ package org.apache.pdfbox.exceptions;
 public class WrappedException extends Exception
 {
     /**
-     * constructor comment.
+     * Constructor.
      *
      * @param e The root exception that caused this exception.
      */

pdfbox/src/main/java/org/apache/pdfbox/exceptions/WrappedIOException.java

@@ -27,7 +27,7 @@ import java.io.IOException;
 public class WrappedIOException extends IOException
 {
     /**
-     * constructor comment.
+     * Constructor.
      *
      * @param e The root exception that caused this exception.
      */
@@ -37,7 +37,7 @@ public class WrappedIOException extends IOException
     }
 
     /**
-     * constructor comment.
+     * Constructor.
      *
      * @param message Descriptive text for the exception.
      * @param e The root exception that caused this exception.

pdfbox/src/main/java/org/apache/pdfbox/pdfparser/NonSequentialPDFParser.java

@@ -644,6 +644,8 @@ public class NonSequentialPDFParser extends PDFParser
 
         // check the offsets of all referenced objects
         checkXrefOffsets();
+        // copy xref table
+        document.addXRefTable(xrefTrailerResolver.getXrefTable());
         return trailer;
     }