From 339f755a527e04a7b748db96fd797d5ec469b534 Mon Sep 17 00:00:00 2001
From: Jonas Jenwald <jonas.jenwald@gmail.com>
Date: Mon, 27 Apr 2026 11:46:17 +0200
Subject: [PATCH] Add more validation in the `Catalog.prototype.getPageIndex`
 method

 - Ensure that the /Kids-entries are Arrays, before trying to iterate through them.
 - Ensure that the /Count-entries are (positive) integers.
---
 src/core/catalog.js | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/src/core/catalog.js b/src/core/catalog.js
index 2cab5f961..9199ce177 100644
--- a/src/core/catalog.js
+++ b/src/core/catalog.js
@@ -1495,6 +1495,9 @@ class Catalog {
           if (!kids) {
             return null;
           }
+          if (!Array.isArray(kids)) {
+            throw new FormatError("Kids must be an array.");
+          }
 
           const kidPromises = [];
           let found = false;
@@ -1512,11 +1515,15 @@ class Catalog {
                   throw new FormatError("Kid node must be a dictionary.");
                 }
                 if (obj.has("Count")) {
-                  total += obj.get("Count");
-                } else {
-                  // Page leaf node.
-                  total++;
+                  const count = obj.get("Count");
+                  if (Number.isInteger(count) && count >= 0) {
+                    total += count;
+                    return;
+                  }
+                  throw new FormatError("Count must be a (positive) integer.");
                 }
+                // Page leaf node.
+                total++;
               })
             );
           }