Do not mark annotations as modified when simply reading them in append mode

Also avoid possible NPE in case of invalid PDFs in which page annotations array contains invalid indirect reference.

DEVSIX-2830

Author: yulian-gaponenko

kernel/src/main/java/com/itextpdf/kernel/pdf/PdfPage.java

@@ -777,11 +777,18 @@ public List<PdfAnnotation> getAnnotations() {
         if (annots != null) {
             for (int i = 0; i < annots.size(); i++) {
                 PdfDictionary annot = annots.getAsDictionary(i);
+                if (annot == null) {
+                    continue;
+                }
                 PdfAnnotation annotation = PdfAnnotation.makeAnnotation(annot);
-                // PdfAnnotation.makeAnnotation returns null if annotation SubType is not recognized or not present at all
-                // (although SubType is required according to the spec)
-                if (annotation != null) {
-                    annotations.add(annotation.setPage(this));
+                if (annotation == null) {
+                    continue;
+                }
+                boolean hasBeenNotModified = annot.getIndirectReference() != null && !annot.getIndirectReference().checkState(PdfObject.MODIFIED);
+                annotations.add(annotation.setPage(this));
+                if (hasBeenNotModified) {
+                    annot.getIndirectReference().clearState(PdfObject.MODIFIED);
+                    annot.getIndirectReference().clearState(PdfObject.FORBID_RELEASE);
                 }
             }
         }

sign/src/test/java/com/itextpdf/signatures/sign/SequentialSignaturesTest.java

@@ -0,0 +1,62 @@
+package com.itextpdf.signatures.sign;
+
+import com.itextpdf.kernel.geom.Rectangle;
+import com.itextpdf.kernel.pdf.PdfReader;
+import com.itextpdf.kernel.pdf.StampingProperties;
+import com.itextpdf.signatures.BouncyCastleDigest;
+import com.itextpdf.signatures.DigestAlgorithms;
+import com.itextpdf.signatures.IExternalSignature;
+import com.itextpdf.signatures.PdfSigner;
+import com.itextpdf.signatures.PrivateKeySignature;
+import com.itextpdf.signatures.testutils.Pkcs12FileHelper;
+import com.itextpdf.test.ExtendedITextTest;
+import com.itextpdf.test.annotations.type.IntegrationTest;
+import java.io.FileOutputStream;
+import java.io.IOException;
+import java.security.GeneralSecurityException;
+import java.security.PrivateKey;
+import java.security.Security;
+import java.security.cert.Certificate;
+import org.bouncycastle.jce.provider.BouncyCastleProvider;
+import org.junit.BeforeClass;
+import org.junit.Test;
+import org.junit.experimental.categories.Category;
+
+@Category(IntegrationTest.class)
+public class SequentialSignaturesTest extends ExtendedITextTest {
+    private static final String certsSrc = "./src/test/resources/com/itextpdf/signatures/certs/";
+    private static final String sourceFolder = "./src/test/resources/com/itextpdf/signatures/sign/SequentialSignaturesTest/";
+    private static final String destinationFolder = "./target/test/com/itextpdf/signatures/sign/SequentialSignaturesTest/";
+
+    private static final char[] password = "testpass".toCharArray();
+
+    @BeforeClass
+    public static void before() {
+        Security.addProvider(new org.bouncycastle.jce.provider.BouncyCastleProvider());
+        createOrClearDestinationFolder(destinationFolder);
+    }
+
+    @Test
+    public void sequentialSignOfFileWithAnnots() throws IOException, GeneralSecurityException {
+        String signCertFileName = certsSrc + "signCertRsa01.p12";
+        String outFileName = destinationFolder + "sequentialSignOfFileWithAnnots.pdf";
+        String srcFileName = sourceFolder + "signedWithAnnots.pdf";
+
+        Certificate[] signChain = Pkcs12FileHelper.readFirstChain(signCertFileName, password);
+        PrivateKey signPrivateKey = Pkcs12FileHelper.readFirstKey(signCertFileName, password, password);
+        IExternalSignature pks = new PrivateKeySignature(signPrivateKey, DigestAlgorithms.SHA256, BouncyCastleProvider.PROVIDER_NAME);
+
+        String signatureName = "Signature2";
+        PdfSigner signer = new PdfSigner(new PdfReader(srcFileName), new FileOutputStream(outFileName), new StampingProperties().useAppendMode());
+        signer.setFieldName(signatureName);
+        signer.getSignatureAppearance()
+                .setPageRect(new Rectangle(50, 350, 200, 100))
+                .setReason("Test")
+                .setLocation("TestCity")
+                .setLayer2Text("Approval test signature.\nCreated by iText7.");
+
+        signer.signDetached(new BouncyCastleDigest(), pks, signChain, null, null, null, 0, PdfSigner.CryptoStandard.CADES);
+
+        PadesSigTest.basicCheckSignedDoc(outFileName, signatureName);
+    }
+}