readBytes() returns false and code tries accessing it before checking

[manuelKruesi]

We ran into the following warning:
PHP Warning: Trying to access array offset on value of type bool in
.../vendor-composer/setasign/fpdi/src/PdfParser/CrossReference/FixedReader.php on line 74

I looked into the code and saw the error originates from this call:
$line = $this->reader->readBytes(20)

As stated in the function description in StreamReader.php, the readBytes() returns a string or false.

I dont know why it returned false, but this need to be accounted for in the code to stop the warnings.

Thanks for your amazing work!

[JanSlabon]

Thanks! Can you share a test-case which let us reproduce this issue?
It is correct, that this "false"-check is missing but it would be great to see in what situation this is triggered.

[manuelKruesi]

Thanks for the very timely response!

unfortunately, i only saw this in our logs and do not have permission to share the document that was handled then, as it is a confidential customer receipt.

My suggestion would be to handle it like this, as this would support the intended return of readBytes()

if($line === false) {
    return false;
}
elseif ($line[17] === 'f') {
    return false;
}

[JanSlabon]

Can you open the PDF in a text editor and show me the cross-references? Just search for xref. It will look like:

There can be more than one cross-references. Please show all and mark the last one.

Actually I guess that this error can only be rised if the file you are reading from is removed during the process. I'm not able to create a manual test which let me reproduce this as the bytes which should be read by readBytes() are already passed in the previous called read() method.

[manuelKruesi]

We also suspect it is a temporary problem that happened under unknown circumstances. We were not able to reproduce with the same settings. I do not think the ref of the document help, as this was tested again and it worked. We can increase our logging and share that if the problem should arise again (Hopefully not after the fix recommended that takes both documented return values (string or false) of readBytes() into account)
Thank you for your time and effort!

[JanSlabon]

I just created a branch with an additional check for false here: https://github.com/Setasign/FPDI/compare/issue-235?expand=1
I also created a test to trigger the situation. As you can see it is only possible by changing the content of the file we read from... if this happens on your environment you should double-check that you are working with independent temporary files and that they not overwrite each other (my guess).

[manuelKruesi]

thank you, we will check our code for the possibility of such a case. I hope this report was still able to add to the code resilience and thank you for your quick and thoughtful communication! Please close the thread if you feel its appropriate to do so.