public InputStream getDataToSign() throws IOException {
        if (incrementPart == null || incrementalInput == null) {
            throw new IllegalStateException("PDF not prepared for signing");
        }
        // range of incremental bytes to be signed (includes /ByteRange but not /Contents)
        int incPartSigOffset = (int) (signatureOffset - incrementalInput.length());
        int afterSigOffset = incPartSigOffset + (int) signatureLength;
        int[] range = {0, incPartSigOffset, afterSigOffset, incrementPart.length - afterSigOffset};

        return new SequenceInputStream(new RandomAccessInputStream(incrementalInput),
                new COSFilterInputStream(incrementPart, range));
    }
Return the stream of PDF data to be signed. Clients should use this method only to create
signatures externally. {@link #write(PDDocument)} method should have been called prior. The
created signature should be set using {@link #writeExternalSignature(byte[])}.
<p>
When {@link SignatureInterface} instance is used, COSWriter obtains and writes the signature
itself.
</p>

@return data stream to be signed
@throws IllegalStateException if PDF is not prepared for external signing
@throws IOException           if input data is closed
tika-fuzzing/src/main/java/org/apache/tika/fuzzing/pdf/EvilCOSWriter.java