From 1576c291f952844835bf42846fe0968ae47eab89 Mon Sep 17 00:00:00 2001
From: Simon Cropp <simon.cropp@gmail.com>
Date: Tue, 14 Jul 2026 21:20:54 +1000
Subject: [PATCH] Guard PDF ID scan on unterminated strings

Prevent index overruns when normalizing truncated `/ID` entries that end without closing `>` or `)`. The normalizer now only advances past terminators when they actually exist, so malformed buffers are zeroed safely up to available bytes. Added regression tests for unterminated hex and literal `/ID` forms.
---
 src/Tests/PdfNormalizerTests.cs    | 11 +++++++++++
 src/Verify.DocNet/PdfNormalizer.cs | 10 ++++++++--
 2 files changed, 19 insertions(+), 2 deletions(-)

diff --git a/src/Tests/PdfNormalizerTests.cs b/src/Tests/PdfNormalizerTests.cs
index 125bd08..8c85cc2 100644
--- a/src/Tests/PdfNormalizerTests.cs
+++ b/src/Tests/PdfNormalizerTests.cs
@@ -105,6 +105,17 @@ public void LeavesLookalikeKeysUntouched()
         Assert.That(Normalize(input), Is.EqualTo(input));
     }
 
+    [Test]
+    public void HandlesUnterminatedFileIdWithoutOverrunning()
+    {
+        // A truncated /ID whose string runs to the end of the buffer with no closing '>'/')' (and no
+        // closing ']') must not scan past the buffer: the value is zeroed as far as it exists and the
+        // scan stops cleanly rather than throwing. Hex string form (no closing '>'):
+        Assert.That(Normalize("/ID [<ABCD"), Is.EqualTo("/ID [<0000"));
+        // Literal string form (no closing ')'):
+        Assert.That(Normalize("/ID [(ABCD"), Is.EqualTo("/ID [(0000"));
+    }
+
     [Test]
     public void NormalizedDocumentStillLoads()
     {
diff --git a/src/Verify.DocNet/PdfNormalizer.cs b/src/Verify.DocNet/PdfNormalizer.cs
index 93cd993..dd32fa4 100644
--- a/src/Verify.DocNet/PdfNormalizer.cs
+++ b/src/Verify.DocNet/PdfNormalizer.cs
@@ -124,14 +124,20 @@ static void ZeroFileId(byte[] data)
                     var start = i + 1;
                     i = FindByte(data, start, (byte) '>');
                     Overwrite(data, start, i, Fill.Hex);
-                    i++;
+                    if (i < data.Length)
+                    {
+                        i++;
+                    }
                 }
                 else if (data[i] == (byte) '(')
                 {
                     var start = i + 1;
                     i = FindLiteralEnd(data, start);
                     Overwrite(data, start, i, Fill.All);
-                    i++;
+                    if (i < data.Length)
+                    {
+                        i++;
+                    }
                 }
                 else
                 {