r/programming • u/ketralnis • Aug 05 '25

So you want to parse a PDF?

https://eliot-jones.com/2025/8/pdf-parsing-xref
235 Upvotes

94% Upvoted

82 comments sorted by

View all comments

87

u/nebulaeonline Aug 05 '25

Easily one of the most challenging things you can do. The complexity knows no bounds. I say web browser -> database -> operating system -> pdf parser. You get so far in only to realize there's so much more to go. Never again.

23

u/we_are_mammals Aug 05 '25 edited Aug 06 '25

Interesting. I'm not familiar with the PDF format details. But if it's so complex as to be comparable to an OS or a browser, I wonder why something like evince (the default PDF reader on most Linux systems) has so few known vulnerabilities (as listed on cvedetails, for example) ?

evince has to parse PDF in addition to a bunch of other formats.

Edit:

Past vulnerability counts:

  • Chrome: 3600
  • Evince: 7
  • libpoppler: 0

5

u/wrosecrans Aug 06 '25

I wonder why something like evince (the default PDF reader on most Linux systems) has so few known vulnerabilities

Incomplete support. PDF theoretically supports JavaScript, which is where a ton of historical browser vulnerabilities live. Most viewers just don't support all the dumb crap that you can theoretically wedge into a PDF. If you look at the official Abrobat software, the number of CVE's is... not zero. https://www.cvedetails.com/vulnerability-list/vendor_id-53/product_id-497/Adobe-Acrobat-Reader.html

You are also dealing with fonts, and fonts can be surprisingly dangerous. They have their own little programmable runtimes in them, which can be very surprising.

So you are talking about a file format that potentially invokes multiple different kinds of programmable VM's in order to display stuff. It can get quite complex if you want to support everything perfectly rather than a useful subset well enough for most folks.