A /Prev in a section a guard stops is judged otherwise than a whole read judges it #264

The /Prev of a section a guard stops is judged otherwise than a whole read judges it: a reference to an object MaxObjectLength cuts is blamed on the file, and a fault the guarded read can see without reading past the guard goes unreported.

Batch 14 (#175) reads a /Prev or an /XRefStm written as a reference, in a section a guard ended the chain at, as a whole read reads it, unless it leads to what the guard hides. Two gaps are left, both older than the batch.

A reference to an object the object guard cuts, with no full index. ReadWithoutLoading reads the object /Prev names without recording it. When the object runs past MaxObjectLength, it reads as nothing. Since batch 14, the chain notes that the guard cut it, and a link so cut is unknown where a guard also ended the chain at that section, cutting its rows or filling the index. With MaxObjectLength alone, the section read whole, SectionOffset still reports the section missing: xref.section-missing, then the Error xref.section-not-found ("which no section read before it places where it can be read"), a rebuild, and file.root-invalid for the /Root the older trailer holds. A whole read follows /Prev with no fault. It is the /Prev counterpart of #263, which names /Filter and /Length.

Faults a section a guard stops does not report. SectionOffset is not called:

• when MaxXRefSectionLength cuts a classic table (the ReadTrailerPastRows path);
• when a table fills MaxIndexEntries;
• when MaxDecodedStreamLength cuts a stream's rows.

When a cross-reference stream fills the index, the offset it gets is not followed. So the guarded read never reports a fault of that section's /Prev that it can see without reading past the guard:

• a reference to a free row;
• an offset outside the file;
• a /Prev naming the section itself.

A whole read reports xref.section-missing and the Error xref.section-not-found for the first two, and xref.chain-cycle and the Error xref.chain-loop for the third.

Shapes, reproduced by the eleventh review of batch 14 on its branch

• E1: cross-reference stream 22, /Index [0 1 21 1 2 20], /Prev 21 0 R, no /Root. Object 21 is a comment line of 3,000 bytes, then the older table's offset. With MaxObjectLength = 1024: xref.section-missing, limit.object, xref.rebuilt, file.root-invalid, xref.section-not-found. A whole read gives only file.trailer-value-wrong.
• F: the newest classic table's rows are 0 1 / 21 1 (free) / 2 2 / 4 40, and its trailer is << /Size 44 /Prev 21 0 R >>, with MaxXRefSectionLength = 128. A whole read gives xref.section-missing and xref.section-not-found. The guarded read gives limit.xref-section-length, xref.rebuilt and file.root-invalid, but no finding on /Prev.
• G: the same table, guarded the same way, with /Prev 99999999 (outside the file), or with /Prev its own offset. The guarded read gives only the guard's reports; a whole read gives xref.section-not-found, or xref.chain-cycle and xref.chain-loop.

What closes it

• A link /Prev leads through that the object guard cut is unknown, as one past a full index is: the chain ends there for the guard, which is reported, and nothing is blamed on the file.
• A section a guard stops still judges its /Prev as far as it can without reading past the guard: a reference to a free row, an offset outside the file, or the section itself is reported as a whole read reports it.
• Tests in ReaderLimitsTests and CrossReferenceRuleTests for E1, F and G, each beside the same file read under the default limits.

Placed with batch 19, beside #188 and #197, the chain's reading of where its sections lie.

Found by the eleventh adversarial review of batch 14 (#129, #175).