fix: recover missing root object when xref stream is incomplete

(cherry picked from commit 3022f5d)

Author: vitormattos

samples/bugs/PullRequest812-pdf.js.pdf

@@ -523,6 +523,41 @@ protected function getObjectHeaderLen(array $objRefs): int
         return 5 + \strlen($objRefs[0]) + \strlen($objRefs[1]);
     }
 
+    /**
+     * Merge missing xref offsets by scanning object headers directly in the PDF body.
+     *
+     * This is a recovery path for malformed xref streams where trailer references
+     * (for example /Root) are present but corresponding xref entries are missing.
+     */
+    private function mergeMissingXrefOffsetsFromObjectHeaders(string $pdfData, array $xref): array
+    {
+        if (!isset($xref['xref']) || !\is_array($xref['xref'])) {
+            $xref['xref'] = [];
+        }
+
+        if (
+            preg_match_all(
+                '/(?:^|[\r\n])([0-9]+)[\x09\x0a\x0c\x0d\x20]+([0-9]+)[\x09\x0a\x0c\x0d\x20]+obj(?=[\x09\x0a\x0c\x0d\x20<])/i',
+                $pdfData,
+                $matches,
+                \PREG_OFFSET_CAPTURE
+            ) > 0
+        ) {
+            foreach ($matches[1] as $idx => $objMatch) {
+                $objNum = $objMatch[0];
+                $offset = $objMatch[1];
+                $genNum = $matches[2][$idx][0];
+                $objRef = $objNum.'_'.$genNum;
+
+                if (!isset($xref['xref'][$objRef])) {
+                    $xref['xref'][$objRef] = $offset;
+                }
+            }
+        }
+
+        return $xref;
+    }
+
     /**
      * Get content of indirect object.
      *
@@ -984,6 +1019,11 @@ public function parseData(string $data): array
             $xref = $this->getXrefData($pdfData);
         }
 
+        $rootObjectRef = $xref['trailer']['root'] ?? null;
+        if (\is_string($rootObjectRef) && !isset($xref['xref'][$rootObjectRef])) {
+            $xref = $this->mergeMissingXrefOffsetsFromObjectHeaders($pdfData, $xref);
+        }
+
         // parse all document objects
         $objects = [];
         foreach ($xref['xref'] as $obj => $offset) {

src/Smalot/PdfParser/RawData/RawDataParser.php

@@ -112,9 +112,14 @@ public function testPDFDocEncodingDecode(): void
         self::assertStringContainsString($testSubject, $details['Subject']);
     }
 
-    public function testParseFileWhenStartxrefPointsNearXrefKeyword(): void
+    /**
+     * Ensures malformed xref streams with missing /Root xref entries still recover pages.
+     *
+     * @see https://github.com/mozilla/pdf.js/blob/master/test/pdfs/issue18986.pdf
+     */
+    public function testMalformedXrefStreamMissingRootEntryStillParsesPage(): void
     {
-        $document = (new Parser())->parseFile($this->rootDir.'/samples/bugs/PullRequest794.pdf');
+        $document = (new Parser())->parseFile($this->rootDir.'/samples/bugs/PullRequest812-pdf.js.pdf');
 
         self::assertCount(1, $document->getPages());
     }