Baixar pdfcpu 0.16.4 para Windows

# pdfcpu v0.16.4

This is a security update for crafted PDFs and form or create data that could cause excessive CPU or memory use or terminate a
process.

Additive Go API Changes：`types.DecodeStreamFunc` and `types.NewLazyObjectStreamObjectWithDecoder`.
Existing constructors and signatures remain unchanged.
Requires Go 1.26 or later.

**Release binaries were built with [Go 1.27.3](https://go.dev/doc/devel/release#go1.27.3), which includes security fixes for `crypto/x509`.**

**1) Unbounded object traversal — [GHSA-2623-w998-vcr4](https://github.com/pdfcpu/pdfcpu/security/advisories/GHSA-2623-w998-vcr4):**

Long chains of PDF objects could exhaust the Go stack and terminate the process during optimization while reading,
annotation removal, or page migration. These paths now use iterative traversal. The fix preserves long valid chains,
handles objects whose value is another reference, and bounds error-path output.

Fix：[0bb00190](https://github.com/pdfcpu/pdfcpu/commit/0bb001901ef160aa75e882d839ee2997d56fdcb2).

**2) Repeated stream data — [GHSA-pr6x-vqwr-4hj2](https://github.com/pdfcpu/pdfcpu/security/advisories/GHSA-pr6x-vqwr-4hj2):**

Shared or nested stream aliases and oversized declared lengths could make a small PDF retain unbounded encoded or
decoded data. Encoded streams now count toward the existing per-read budget, lengths past the end of the input no
longer size buffers, and compressed xref entries that share one current object-stream index are rejected.

Filtered decodes through `XRefTable.DecodeStream` and lazy object streams each receive a separate cumulative allowance
`A = max(1 GiB, 2 × MaxDecodeBytes)`; both default to 1 GiB. The allowances count cumulative decoding, not live memory.
Object streams remain lazy, image extraction remains subject to its per-stream and image limits, and a negative
`MaxDecodeBytes` disables these limits.

Fix：[82c88cec](https://github.com/pdfcpu/pdfcpu/commit/82c88cecdee7dac398bebf06d0bdd28728235a57).

**3) Poster tile grids — [GHSA-g5q6-53hx-f68j](https://github.com/pdfcpu/pdfcpu/security/advisories/GHSA-g5q6-53hx-f68j):**

A crafted page size could make `poster` create an unbounded number of tile definitions and output pages, consuming
excessive CPU and memory. Poster output is now limited to 1,000 tiles per source page, and oversized grids are rejected
before page content is transformed or tile objects are allocated. Zero, negative and non-finite page or tile dimensions
are rejected.

Tiles produced by `poster`, `cut` and `ndown` now share one resource dictionary per source page instead of carrying a
copy each. With a margin, each tile references the shared page content through a content array instead of embedding a
copy of it. Rendered output is unchanged.

Fix：[a9725db6](https://github.com/pdfcpu/pdfcpu/commit/a9725db622f32c519fee90c1733b779ccd5dd598).

**4) Create table dimensions — [GHSA-cphg-88q6-whwh](https://github.com/pdfcpu/pdfcpu/security/advisories/GHSA-cphg-88q6-whwh):**

Table `rows` and `cols` in a `create` template were unbounded, so a few hundred bytes of JSON could make create
allocate and render without limit. All tables of a template now share a limit of 100,000 rows plus columns. A table
whose `anchor` is invalid, or given together with `pos`, is now rejected; previously its remaining validation was
skipped.

Fix：[5367e878](https://github.com/pdfcpu/pdfcpu/commit/5367e878f7766b94dd5f7e9e3128e1ab5f9b30b6).

**5) Unbounded page numbers — [GHSA-gx4m-7r76-vpww](https://github.com/pdfcpu/pdfcpu/security/advisories/GHSA-gx4m-7r76-vpww):**

A large page number in a `create` template or form-fill data could make pdfcpu allocate excessive memory or stall.
`create` now limits additions to 1,000 pages beyond the existing document; `form fill` and `form multifill` accept image
page numbers only within the document. Both paths reject page numbers below 1.

Fix：[ebac361a](https://github.com/pdfcpu/pdfcpu/commit/ebac361ac40798d81a97299c8231e7248e0094ab).

**6) Bookmark split page numbers — [GHSA-p2r6-9jcq-fp7v](https://github.com/pdfcpu/pdfcpu/security/advisories/GHSA-p2r6-9jcq-fp7v):**

An outline destination with a very large page number could make `split -m bookmark` allocate memory proportional to
that number, or panic for library callers. Bookmark page spans are now checked against the page count before their
pages are listed; such files fail with the same "invalid page number" error as before.

Fix：[70f1a860](https://github.com/pdfcpu/pdfcpu/commit/70f1a8604f9529962486e75ba82d1e93f10e3cde).

**7) Shared resource graphs — [GHSA-vwmc-mhq7-fqhc](https://github.com/pdfcpu/pdfcpu/security/advisories/GHSA-vwmc-mhq7-fqhc):**

Validation could repeatedly process the same shared object through different paths in resource, pattern, property-list
and visibility-expression graphs. A small PDF could therefore keep validation busy for an extended time. The fix
reuses successful validation results while preserving checks on deeper paths and existing cycle handling. Commands
that validate PDFs during reading benefit from the fix.

Fix：[7653f158](https://github.com/pdfcpu/pdfcpu/commit/7653f15888400d02c97d933effbf8a4a128245c4).

**8) Shared object comparison graphs — [GHSA-8pv5-h3hv-xhc9](https://github.com/pdfcpu/pdfcpu/security/advisories/GHSA-8pv5-h3hv-xhc9):**

Object comparison could repeatedly process the same pair of indirect objects when font, image, form XObject or
content-stream dictionaries contained shared reference graphs. The comparison is used by default for font, image and
form XObject deduplication, validation's info-dictionary reconciliation and image reuse during create; content-stream
deduplication is optional. A small PDF could therefore cause exponential comparison work. Object comparison now memoizes
indirect-reference pairs for the duration of each comparison, limits distinct pairs to the document's object table size
and enforces the existing recursion-depth limit. Reaching either limit conservatively treats the objects as different,
so callers keep both objects instead of failing the command; the optimize log reports the cutoff.

Fix：[d6abb27e](https://github.com/pdfcpu/pdfcpu/commit/d6abb27eb84361de96bcc5674ce361ab3b157509).

## Thanks

Special thanks to [Black Water (@Manyo9)](https://github.com/Manyo9) for reporting these vulnerabilities.

## Changelog
• 0f5ac76def20e130ab8ffbf39d378613ff71ff91 bump version
• a9725db622f32c519fee90c1733b779ccd5dd598 fix GHSA-g5q6-53hx-f68j：bound poster tile grids
• d6abb27eb84361de96bcc5674ce361ab3b157509 fix GHSA-8pv5-h3hv-xhc9：memoize indirect-reference pairs in object comparison
• 5367e878f7766b94dd5f7e9e3128e1ab5f9b30b6 fix GHSA-cphg-88q6-whwh：bound create table rows and columns
• 70f1a8604f9529962486e75ba82d1e93f10e3cde fix GHSA-p2r6-9jcq-fp7v：check bookmark page spans before splitting
• 82c88cecdee7dac398bebf06d0bdd28728235a57 fix GHSA-pr6x-vqwr-4hj2：bound repeated stream data while reading
• ebac361ac40798d81a97299c8231e7248e0094ab fix GHSA-gx4m-7r76-vpww：bound page numbers in create and form fill
• 0bb001901ef160aa75e882d839ee2997d56fdcb2 fix GHSA-2623-w998-vcr4：walk object graphs without recursion
• 7653f15888400d02c97d933effbf8a4a128245c4 fix GHSA-vwmc-mhq7-fqhc：validate shared resource graphs once per depth
• 358a9a9f528ce1ba428c819683d25434f1caf4a4 add GHSA regression tests and use ghsa_<id> test naming