xmlsecurity PDF verify: fix handling of xref stream free objects

In case our xref table doesn't have an entry for "free" object types,
then the table size won't provide a valid id for a next object. That
resulted in creating all new objects with the same ID.

With this, our verifier at least can see the new signature when
appending one to a signed PDF 1.6 file.

Change-Id: Iac39a400706cfcd23dd814d2b81cb8b950c69fc6
Reviewed-on: https://gerrit.libreoffice.org/30704Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Miklos Vajna <vmiklos@collabora.co.uk>

xmlsecurity/inc/pdfio/pdfdocument.hxx

@@ -53,6 +53,8 @@ enum class TokenizeMode
 /// The type column of an entry in a cross-reference stream.
 enum class XRefEntryType
 {
+    /// xref "f" or xref stream "0".
+    FREE,
     /// xref "n" or xref stream "1".
     NOT_COMPRESSED,
     /// xref stream "2.

xmlsecurity/source/pdfio/pdfdocument.cxx

@@ -1304,13 +1304,24 @@ void PDFDocument::ReadXRefStream(SvStream& rStream)
             nGenerationNumber = (nGenerationNumber << 8) + nCh;
         }
 
-        // "n" entry of the xref table
-        if (nType == 1 || nType == 2)
+        // Ignore invalid nType.
+        if (nType <= 2)
         {
             if (m_aXRef.find(nIndex) == m_aXRef.end())
             {
                 XRefEntry aEntry;
-                aEntry.m_eType = nType == 1 ? XRefEntryType::NOT_COMPRESSED : XRefEntryType::COMPRESSED;
+                switch (nType)
+                {
+                case 0:
+                    aEntry.m_eType = XRefEntryType::FREE;
+                    break;
+                case 1:
+                    aEntry.m_eType = XRefEntryType::NOT_COMPRESSED;
+                    break;
+                case 2:
+                    aEntry.m_eType = XRefEntryType::COMPRESSED;
+                    break;
+                }
                 aEntry.m_nOffset = nStreamOffset;
                 aEntry.m_nGenerationNumber = nGenerationNumber;
                 m_aXRef[nIndex] = aEntry;