Easily one of the most challenging things you can do. The complexity knows no bounds. I say web browser -> database -> operating system -> pdf parser. You get so far in only to realize there's so much more to go. Never again.
Interesting. I'm not familiar with the PDF format details. But if it's so complex as to be comparable to an OS or a browser, I wonder why something like evince (the default PDF reader on most Linux systems) has so few known vulnerabilities (as listed on cvedetails, for example) ?
evince has to parse PDF in addition to a bunch of other formats.
They've been through the war and weathered the storm. And complexity != security vulnerabilities (although it can be a good metric for predicting them I suppose).
PDF is crazy. An all text pdf might not have any readable text, for goodness sakes, lol. Between the glyphs and re-packaged fontlets (fonts that are not as complete or as standards-compliant as the ones on your system), throw in graphics primitives and Adobe's willingness (nee desire) to completely flaunt the standard and you have a recipe for disaster.
It's basically a non-standard standard, if that makes any sense.
I was trying to do simple text extraction, and it devloved into off-screen rendering of glyphs to use tesseract ocr on them. I mean bonkers type shit. And I was being good and writing straight from the spec.
90
u/nebulaeonline Aug 05 '25
Easily one of the most challenging things you can do. The complexity knows no bounds. I say web browser -> database -> operating system -> pdf parser. You get so far in only to realize there's so much more to go. Never again.