From ec04a95e3655b2ac82655755b6f4423dfe3dc675 Mon Sep 17 00:00:00 2001
From: Pete Matsyburka <pete@docuseal.com>
Date: Sun, 6 Sep 2026 09:39:53 +0300
Subject: [PATCH] fix pdf validation

---
 lib/pdfium.rb               |  4 ++--
 lib/verify_pdf_signature.rb | 11 +++++++++--
 2 files changed, 11 insertions(+), 4 deletions(-)

diff --git a/lib/pdfium.rb b/lib/pdfium.rb
index f5d46396..6724b232 100644
--- a/lib/pdfium.rb
+++ b/lib/pdfium.rb
@@ -2306,14 +2306,14 @@ class Pdfium
       [PageObject, *to_a].hash
     end
 
-    private
-
     def object_ptr
       page.ensure_not_closed!
 
       Pdfium.FPDFPage_GetObject(page.page_ptr, index)
     end
 
+    private
+
     def read_bounds
       buffer = Array.new(4) { FFI::MemoryPointer.new(:float) }
 
diff --git a/lib/verify_pdf_signature.rb b/lib/verify_pdf_signature.rb
index ec588e5e..f8da1408 100644
--- a/lib/verify_pdf_signature.rb
+++ b/lib/verify_pdf_signature.rb
@@ -173,7 +173,7 @@ module VerifyPdfSignature
     io.seek(0)
 
     Pdfium::Document.open_bytes(io.read(signed_end)) do |signed_document|
-      next false unless signed_document.valid_cross_reference_table?
+      next true unless signed_document.valid_cross_reference_table?
 
       serialized_document(signed_document) != serialized_document(document)
     end
@@ -182,13 +182,20 @@ module VerifyPdfSignature
   def serialized_document(document)
     pages = (0...document.page_count).map do |index|
       page = document.get_page(index)
+      objects = page.objects.map { |object| [*object.to_a, image_digest(page, object)] }
 
-      [page.rotation, page.objects, page.annotations, page.text]
+      [page.rotation, objects, page.annotations, page.text]
     end
 
     [pages, document.bookmarks]
   end
 
+  def image_digest(page, object)
+    return unless object.image?
+
+    Digest::SHA256.hexdigest(page.extract_image_bitmap(object.object_ptr)[:data])
+  end
+
   def signed_data(io, byte_range)
     byte_range.each_slice(2).map do |offset, length|
       io.seek(offset)