Prevent infinite recursion when loading page tree.

2 files changed, 16 insertions, 3 deletions

diff --git a/mupdf/pdf_page.c b/mupdf/pdf_page.c
index 71087336..57f7bb49 100644
--- a/mupdf/pdf_page.c
+++ b/mupdf/pdf_page.c
@@ -124,19 +124,24 @@ pdf_resourcesuseblending(fz_obj *rdb)
 	dict = fz_dictgets(rdb, "ExtGState");
 	for (i = 0; i < fz_dictlen(dict); i++)
 		if (pdf_extgstateusesblending(fz_dictgetval(dict, i)))
-			return 1;
+			goto found;
 
 	dict = fz_dictgets(rdb, "Pattern");
 	for (i = 0; i < fz_dictlen(dict); i++)
 		if (pdf_patternusesblending(fz_dictgetval(dict, i)))
-			return 1;
+			goto found;
 
 	dict = fz_dictgets(rdb, "XObject");
 	for (i = 0; i < fz_dictlen(dict); i++)
 		if (pdf_xobjectusesblending(fz_dictgetval(dict, i)))
-			return 1;
+			goto found;
 
+	fz_dictdels(rdb, ".seen");
 	return 0;
+
+found:
+	fz_dictdels(rdb, ".seen");
+	return 1;
 }
 
 fz_error
diff --git a/mupdf/pdf_pagetree.c b/mupdf/pdf_pagetree.c
index b58802a8..660f77ee 100644
--- a/mupdf/pdf_pagetree.c
+++ b/mupdf/pdf_pagetree.c
@@ -52,6 +52,10 @@ pdf_loadpagetreenode(pdf_xref *xref, fz_obj *node, struct info info)
 	fz_obj *obj;
 	int i, n;
 
+	/* prevent infinite recursion */
+	if (fz_dictgets(node, ".seen"))
+		return;
+
 	kids = fz_dictgets(node, "Kids");
 	count = fz_dictgets(node, "Count");
 
@@ -70,12 +74,16 @@ pdf_loadpagetreenode(pdf_xref *xref, fz_obj *node, struct info info)
 		if (obj)
 			info.rotate = obj;
 
+		fz_dictputs(node, ".seen", fz_newnull());
+
 		n = fz_arraylen(kids);
 		for (i = 0; i < n; i++)
 		{
 			obj = fz_arrayget(kids, i);
 			pdf_loadpagetreenode(xref, obj, info);
 		}
+
+		fz_dictdels(node, ".seen");
 	}
 	else
 	{