pdf: add filter count heuristic

libclamav/pdf.c

@@ -2457,6 +2457,12 @@ int cli_pdf(const char *dir, cli_ctx *ctx, off_t offset)
         }
 
         pdf_parseobj(&pdf, obj);
+        if (SCAN_ALGO && obj->numfilters > PDF_FILTER_DTRIGGER) {
+            cli_append_virus(ctx, "Heuristic.PDF.TooManyFilters");
+            alerts++;
+            if (!SCAN_ALL)
+                rc = CL_VIRUS;
+        }
     }
 
     pdf_handle_enc(&pdf);

libclamav/pdf.h

@@ -22,7 +22,8 @@
 #define __PDF_H
 
 #include "others.h"
-#define PDF_FILTERLIST_MAX 64
+#define PDF_FILTERLIST_MAX  64
+#define PDF_FILTER_DTRIGGER 8
 struct pdf_obj {
     uint32_t start;
     uint32_t id;