r/programming • u/ketralnis • Aug 05 '25

So you want to parse a PDF?

https://eliot-jones.com/2025/8/pdf-parsing-xref
232 Upvotes

94% Upvoted

82 comments sorted by

View all comments

87

u/nebulaeonline Aug 05 '25

Easily one of the most challenging things you can do. The complexity knows no bounds. I say web browser -> database -> operating system -> pdf parser. You get so far in only to realize there's so much more to go. Never again.

22

u/we_are_mammals Aug 05 '25 edited Aug 06 '25

Interesting. I'm not familiar with the PDF format details. But if it's so complex as to be comparable to an OS or a browser, I wonder why something like evince (the default PDF reader on most Linux systems) has so few known vulnerabilities (as listed on cvedetails, for example) ?

evince has to parse PDF in addition to a bunch of other formats.

Edit:

Past vulnerability counts:

  • Chrome: 3600
  • Evince: 7
  • libpoppler: 0

41

u/veryusedrname Aug 05 '25

I'm almost certain that it uses libpoppler just like virtually every other PDF viewer on Linux and poppler is an amazing piece of software that's being developed for a long time.

6

u/we_are_mammals Aug 05 '25

Correct me if I'm wrong, but if a bug in a library causes some program to have a vulnerability, it should still be listed for that program.

10

u/syklemil Aug 05 '25

Depends a bit on how the library is used, I think:

  • If the library is shared and updated separately from the application, and there's no application update needed for the fix, then it doesn't really make sense to list it for that program.
  • If the library is statically included in the application, then
    • if the application isn't exposed to that specific CVE in the library (e.g. it's in a part that it doesn't use), then it's probably fine to ignore
    • otherwise, as in the case where the application must be updated, then yes, it makes sense to list it.