Bug 693503: Fix stack overflows due to infinite recursion.

If a colorspace refers to itself as a base, we can get an infinite
recursion and hence stack overflow. Thanks to zeniko for pointing out
that this occurs in embedded CMAPs and stitching functions. Also
solved here.

To avoid having to keep a long list of the objects we've traversed
through, extend the pdf_dict_mark functions to work on all pdf objects,
and hence rename them as pdf_obj_mark etc. Thanks to zeniko again for
feedback on this way of working.

Problem found in a test file, 3882.pdf.SIGSEGV.99.3204 supplied
by Mateusz "j00ru" Jurczyk and Gynvael Coldwind of the Google
Security Team using Address Sanitizer. Many thanks!

10 files changed, 158 insertions, 103 deletions

diff --git a/pdf/mupdf.h b/pdf/mupdf.h
index 5daba8da..72248017 100644
--- a/pdf/mupdf.h
+++ b/pdf/mupdf.h
@@ -44,10 +44,10 @@ int pdf_is_stream(pdf_document *doc, int num, int gen);
 
 int pdf_objcmp(pdf_obj *a, pdf_obj *b);
 
-/* dict marking and unmarking functions - to avoid infinite recursions */
-int pdf_dict_marked(pdf_obj *obj);
-int pdf_dict_mark(pdf_obj *obj);
-void pdf_dict_unmark(pdf_obj *obj);
+/* obj marking and unmarking functions - to avoid infinite recursions. */
+int pdf_obj_marked(pdf_obj *obj);
+int pdf_obj_mark(pdf_obj *obj);
+void pdf_obj_unmark(pdf_obj *obj);
 
 /* safe, silent failure, no error reporting on type mismatches */
 int pdf_to_bool(pdf_obj *obj);
diff --git a/pdf/pdf_cmap_load.c b/pdf/pdf_cmap_load.c
index 8ab7e646..36ca202b 100644
--- a/pdf/pdf_cmap_load.c
+++ b/pdf/pdf_cmap_load.c
@@ -31,6 +31,9 @@ pdf_load_embedded_cmap(pdf_document *xref, pdf_obj *stmobj)
 	fz_var(file);
 	fz_var(cmap);
 
+	if (pdf_obj_marked(stmobj))
+		fz_throw(ctx, "Recursion in embedded cmap");
+
 	if ((cmap = pdf_find_item(ctx, pdf_free_cmap_imp, stmobj)))
 	{
 		return cmap;
@@ -58,7 +61,10 @@ pdf_load_embedded_cmap(pdf_document *xref, pdf_obj *stmobj)
 		else if (pdf_is_indirect(obj))
 		{
 			phase = 3;
+			pdf_obj_mark(obj);
 			usecmap = pdf_load_embedded_cmap(xref, obj);
+			pdf_obj_unmark(obj);
+			phase = 4;
 			pdf_set_usecmap(ctx, cmap, usecmap);
 			pdf_drop_cmap(ctx, usecmap);
 		}
@@ -78,7 +84,11 @@ pdf_load_embedded_cmap(pdf_document *xref, pdf_obj *stmobj)
 		else if (phase < 3)
 			fz_throw(ctx, "cannot load system usecmap '%s'", pdf_to_name(obj));
 		else
+		{
+			if (phase == 3)
+				pdf_obj_unmark(obj);
 			fz_throw(ctx, "cannot load embedded usecmap (%d %d R)", pdf_to_num(obj), pdf_to_gen(obj));
+		}
 	}
 
 	return cmap;
diff --git a/pdf/pdf_colorspace.c b/pdf/pdf_colorspace.c
index 7ebda6cf..1f83c906 100644
--- a/pdf/pdf_colorspace.c
+++ b/pdf/pdf_colorspace.c
@@ -302,81 +302,105 @@ load_indexed(pdf_document *xref, pdf_obj *array)
 static fz_colorspace *
 pdf_load_colorspace_imp(pdf_document *xref, pdf_obj *obj)
 {
+	fz_context *ctx = xref->ctx;
+
+	if (pdf_obj_marked(obj))
+		fz_throw(ctx, "Recursion in colorspace definition");
+
 	if (pdf_is_name(obj))
 	{
-		if (!strcmp(pdf_to_name(obj), "Pattern"))
+		const char *str = pdf_to_name(obj);
+		if (!strcmp(str, "Pattern"))
 			return fz_device_gray;
-		else if (!strcmp(pdf_to_name(obj), "G"))
+		else if (!strcmp(str, "G"))
 			return fz_device_gray;
-		else if (!strcmp(pdf_to_name(obj), "RGB"))
+		else if (!strcmp(str, "RGB"))
 			return fz_device_rgb;
-		else if (!strcmp(pdf_to_name(obj), "CMYK"))
+		else if (!strcmp(str, "CMYK"))
 			return fz_device_cmyk;
-		else if (!strcmp(pdf_to_name(obj), "DeviceGray"))
+		else if (!strcmp(str, "DeviceGray"))
 			return fz_device_gray;
-		else if (!strcmp(pdf_to_name(obj), "DeviceRGB"))
+		else if (!strcmp(str, "DeviceRGB"))
 			return fz_device_rgb;
-		else if (!strcmp(pdf_to_name(obj), "DeviceCMYK"))
+		else if (!strcmp(str, "DeviceCMYK"))
 			return fz_device_cmyk;
 		else
-			fz_throw(xref->ctx, "unknown colorspace: %s", pdf_to_name(obj));
+			fz_throw(ctx, "unknown colorspace: %s", pdf_to_name(obj));
 	}
 
 	else if (pdf_is_array(obj))
 	{
 		pdf_obj *name = pdf_array_get(obj, 0);
+		const char *str = pdf_to_name(name);
 
 		if (pdf_is_name(name))
 		{
 			/* load base colorspace instead */
-			if (!strcmp(pdf_to_name(name), "Pattern"))
-			{
-				obj = pdf_array_get(obj, 1);
-				if (!obj)
-				{
-					return fz_device_gray;
-				}
-
-				return pdf_load_colorspace(xref, obj);
-			}
-
-			else if (!strcmp(pdf_to_name(name), "G"))
+			if (!strcmp(str, "G"))
 				return fz_device_gray;
-			else if (!strcmp(pdf_to_name(name), "RGB"))
+			else if (!strcmp(str, "RGB"))
 				return fz_device_rgb;
-			else if (!strcmp(pdf_to_name(name), "CMYK"))
+			else if (!strcmp(str, "CMYK"))
 				return fz_device_cmyk;
-			else if (!strcmp(pdf_to_name(name), "DeviceGray"))
+			else if (!strcmp(str, "DeviceGray"))
 				return fz_device_gray;
-			else if (!strcmp(pdf_to_name(name), "DeviceRGB"))
+			else if (!strcmp(str, "DeviceRGB"))
 				return fz_device_rgb;
-			else if (!strcmp(pdf_to_name(name), "DeviceCMYK"))
+			else if (!strcmp(str, "DeviceCMYK"))
 				return fz_device_cmyk;
-			else if (!strcmp(pdf_to_name(name), "CalGray"))
+			else if (!strcmp(str, "CalGray"))
 				return fz_device_gray;
-			else if (!strcmp(pdf_to_name(name), "CalRGB"))
+			else if (!strcmp(str, "CalRGB"))
 				return fz_device_rgb;
-			else if (!strcmp(pdf_to_name(name), "CalCMYK"))
+			else if (!strcmp(str, "CalCMYK"))
 				return fz_device_cmyk;
-			else if (!strcmp(pdf_to_name(name), "Lab"))
+			else if (!strcmp(str, "Lab"))
 				return fz_device_lab;
-
-			else if (!strcmp(pdf_to_name(name), "ICCBased"))
-				return load_icc_based(xref, pdf_array_get(obj, 1));
-
-			else if (!strcmp(pdf_to_name(name), "Indexed"))
-				return load_indexed(xref, obj);
-			else if (!strcmp(pdf_to_name(name), "I"))
-				return load_indexed(xref, obj);
-
-			else if (!strcmp(pdf_to_name(name), "Separation"))
-				return load_separation(xref, obj);
-
-			else if (!strcmp(pdf_to_name(name), "DeviceN"))
-				return load_separation(xref, obj);
-
 			else
-				fz_throw(xref->ctx, "syntaxerror: unknown colorspace %s", pdf_to_name(name));
+			{
+				fz_colorspace *cs;
+				fz_try(ctx)
+				{
+					pdf_obj_mark(obj);
+					if (!strcmp(str, "ICCBased"))
+						cs = load_icc_based(xref, pdf_array_get(obj, 1));
+
+					else if (!strcmp(str, "Indexed"))
+						cs = load_indexed(xref, obj);
+					else if (!strcmp(str, "I"))
+						cs = load_indexed(xref, obj);
+
+					else if (!strcmp(str, "Separation"))
+						cs = load_separation(xref, obj);
+
+					else if (!strcmp(str, "DeviceN"))
+						cs = load_separation(xref, obj);
+					else if (!strcmp(str, "Pattern"))
+					{
+						pdf_obj *pobj;
+
+						pobj = pdf_array_get(obj, 1);
+						if (!pobj)
+						{
+							cs = fz_device_gray;
+							break;
+						}
+
+						cs = pdf_load_colorspace(xref, pobj);
+					}
+					else
+						fz_throw(ctx, "syntaxerror: unknown colorspace %s", str);
+				}
+				fz_always(ctx)
+				{
+					pdf_obj_unmark(obj);
+				}
+				fz_catch(ctx)
+				{
+					fz_rethrow(ctx);
+				}
+				return cs;
+			}
 		}
 	}
 
diff --git a/pdf/pdf_function.c b/pdf/pdf_function.c
index 781f1361..c0b67ef3 100644
--- a/pdf/pdf_function.c
+++ b/pdf/pdf_function.c
@@ -1236,7 +1236,10 @@ load_stitching_func(pdf_function *func, pdf_document *xref, pdf_obj *dict)
 	obj = pdf_dict_gets(dict, "Functions");
 	if (!pdf_is_array(obj))
 		fz_throw(ctx, "stitching function has no input functions");
+
+	fz_try(ctx)
 	{
+		pdf_obj_mark(obj);
 		k = pdf_array_len(obj);
 
 		func->u.st.funcs = fz_malloc_array(ctx, k, sizeof(pdf_function*));
@@ -1258,7 +1261,14 @@ load_stitching_func(pdf_function *func, pdf_document *xref, pdf_obj *dict)
 				fz_warn(ctx, "wrong number of outputs for sub function %d", i);
 		}
 	}
-
+	fz_always(ctx)
+	{
+		pdf_obj_unmark(obj);
+	}
+	fz_catch(ctx)
+	{
+		fz_rethrow(ctx);
+	}
 
 	obj = pdf_dict_gets(dict, "Bounds");
 	if (!pdf_is_array(obj))
@@ -1402,6 +1412,9 @@ pdf_load_function(pdf_document *xref, pdf_obj *dict, int in, int out)
 	pdf_obj *obj;
 	int i;
 
+	if (pdf_obj_marked(dict))
+		fz_throw(ctx, "Recursion in function definition");
+
 	if ((func = pdf_find_item(ctx, pdf_free_function_imp, dict)))
 	{
 		return func;
diff --git a/pdf/pdf_interpret.c b/pdf/pdf_interpret.c
index 9f81d629..860ad62d 100644
--- a/pdf/pdf_interpret.c
+++ b/pdf/pdf_interpret.c
@@ -155,7 +155,7 @@ pdf_is_hidden_ocg(pdf_obj *ocg, pdf_csi *csi, pdf_obj *rdb)
 	fz_context *ctx = csi->dev->ctx;
 
 	/* Avoid infinite recursions */
-	if (pdf_dict_marked(ocg))
+	if (pdf_obj_marked(ocg))
 		return 0;
 
 	/* If no ocg descriptor, everything is visible */
@@ -277,8 +277,8 @@ pdf_is_hidden_ocg(pdf_obj *ocg, pdf_csi *csi, pdf_obj *rdb)
 			combine = 0;
 		}
 
-		if (pdf_dict_mark(ocg))
-			fz_throw(ctx, "Failed to mark OCG - out of memory?");
+		if (pdf_obj_mark(ocg))
+			return 0; /* Should never happen */
 		fz_try(ctx)
 		{
 			obj = pdf_dict_gets(ocg, "OCGs");
@@ -307,7 +307,7 @@ pdf_is_hidden_ocg(pdf_obj *ocg, pdf_csi *csi, pdf_obj *rdb)
 		}
 		fz_always(ctx)
 		{
-			pdf_dict_unmark(ocg);
+			pdf_obj_unmark(ocg);
 		}
 		fz_catch(ctx)
 		{
@@ -1387,7 +1387,7 @@ pdf_run_xobject(pdf_csi *csi, pdf_obj *resources, pdf_xobject *xobj, fz_matrix t
 	int popmask;
 
 	/* Avoid infinite recursion */
-	if (xobj == NULL || pdf_dict_mark(xobj->me))
+	if (xobj == NULL || pdf_obj_mark(xobj->me))
 		return;
 
 	fz_var(gstate);
@@ -1477,7 +1477,7 @@ pdf_run_xobject(pdf_csi *csi, pdf_obj *resources, pdf_xobject *xobj, fz_matrix t
 			pdf_grestore(csi);
 		}
 
-		pdf_dict_unmark(xobj->me);
+		pdf_obj_unmark(xobj->me);
 	}
 	fz_catch(ctx)
 	{
diff --git a/pdf/pdf_nametree.c b/pdf/pdf_nametree.c
index ab3244d3..6677e7a2 100644
--- a/pdf/pdf_nametree.c
+++ b/pdf/pdf_nametree.c
@@ -28,10 +28,10 @@ pdf_lookup_name_imp(fz_context *ctx, pdf_obj *node, pdf_obj *needle)
 			{
 				pdf_obj *obj;
 
-				if (pdf_dict_mark(node))
+				if (pdf_obj_mark(node))
 					break;
 				obj = pdf_lookup_name_imp(ctx, kid, needle);
-				pdf_dict_unmark(node);
+				pdf_obj_unmark(node);
 				return obj;
 			}
 		}
@@ -120,12 +120,12 @@ pdf_load_name_tree_imp(pdf_obj *dict, pdf_document *xref, pdf_obj *node)
 
 	UNUSED(ctx);
 
-	if (kids && !pdf_dict_mark(node))
+	if (kids && !pdf_obj_mark(node))
 	{
 		int len = pdf_array_len(kids);
 		for (i = 0; i < len; i++)
 			pdf_load_name_tree_imp(dict, xref, pdf_array_get(kids, i));
-		pdf_dict_unmark(node);
+		pdf_obj_unmark(node);
 	}
 
 	if (names)
diff --git a/pdf/pdf_object.c b/pdf/pdf_object.c
index ab6968c6..dba15872 100644
--- a/pdf/pdf_object.c
+++ b/pdf/pdf_object.c
@@ -3,15 +3,15 @@
 
 typedef enum pdf_objkind_e
 {
-	PDF_NULL,
-	PDF_BOOL,
-	PDF_INT,
-	PDF_REAL,
-	PDF_STRING,
-	PDF_NAME,
-	PDF_ARRAY,
-	PDF_DICT,
-	PDF_INDIRECT
+	PDF_NULL = 0,
+	PDF_BOOL = 'b',
+	PDF_INT = 'i',
+	PDF_REAL = 'f',
+	PDF_STRING = 's',
+	PDF_NAME = 'n',
+	PDF_ARRAY = 'a',
+	PDF_DICT = 'd',
+	PDF_INDIRECT = 'r'
 } pdf_objkind;
 
 struct keyval
@@ -23,7 +23,8 @@ struct keyval
 struct pdf_obj_s
 {
 	int refs;
-	pdf_objkind kind;
+	char kind;
+	char marked;
 	fz_context *ctx;
 	union
 	{
@@ -42,7 +43,6 @@ struct pdf_obj_s
 		} a;
 		struct {
 			char sorted;
-			char marked;
 			int len;
 			int cap;
 			struct keyval *items;
@@ -63,6 +63,7 @@ pdf_new_null(fz_context *ctx)
 	obj->ctx = ctx;
 	obj->refs = 1;
 	obj->kind = PDF_NULL;
+	obj->marked = 0;
 	return obj;
 }
 
@@ -74,6 +75,7 @@ pdf_new_bool(fz_context *ctx, int b)
 	obj->ctx = ctx;
 	obj->refs = 1;
 	obj->kind = PDF_BOOL;
+	obj->marked = 0;
 	obj->u.b = b;
 	return obj;
 }
@@ -86,6 +88,7 @@ pdf_new_int(fz_context *ctx, int i)
 	obj->ctx = ctx;
 	obj->refs = 1;
 	obj->kind = PDF_INT;
+	obj->marked = 0;
 	obj->u.i = i;
 	return obj;
 }
@@ -98,6 +101,7 @@ pdf_new_real(fz_context *ctx, float f)
 	obj->ctx = ctx;
 	obj->refs = 1;
 	obj->kind = PDF_REAL;
+	obj->marked = 0;
 	obj->u.f = f;
 	return obj;
 }
@@ -110,6 +114,7 @@ pdf_new_string(fz_context *ctx, const char *str, int len)
 	obj->ctx = ctx;
 	obj->refs = 1;
 	obj->kind = PDF_STRING;
+	obj->marked = 0;
 	obj->u.s.len = len;
 	memcpy(obj->u.s.buf, str, len);
 	obj->u.s.buf[len] = '\0';
@@ -124,6 +129,7 @@ pdf_new_name(fz_context *ctx, const char *str)
 	obj->ctx = ctx;
 	obj->refs = 1;
 	obj->kind = PDF_NAME;
+	obj->marked = 0;
 	strcpy(obj->u.n, str);
 	return obj;
 }
@@ -136,6 +142,7 @@ pdf_new_indirect(fz_context *ctx, int num, int gen, void *xref)
 	obj->ctx = ctx;
 	obj->refs = 1;
 	obj->kind = PDF_INDIRECT;
+	obj->marked = 0;
 	obj->u.r.num = num;
 	obj->u.r.gen = gen;
 	obj->u.r.xref = xref;
@@ -421,6 +428,7 @@ pdf_new_array(fz_context *ctx, int initialcap)
 	obj->ctx = ctx;
 	obj->refs = 1;
 	obj->kind = PDF_ARRAY;
+	obj->marked = 0;
 
 	obj->u.a.len = 0;
 	obj->u.a.cap = initialcap > 1 ? initialcap : 6;
@@ -678,9 +686,9 @@ pdf_new_dict(fz_context *ctx, int initialcap)
 	obj->ctx = ctx;
 	obj->refs = 1;
 	obj->kind = PDF_DICT;
+	obj->marked = 0;
 
 	obj->u.d.sorted = 0;
-	obj->u.d.marked = 0;
 	obj->u.d.len = 0;
 	obj->u.d.cap = initialcap > 1 ? initialcap : 10;
 
@@ -1094,33 +1102,33 @@ pdf_sort_dict(pdf_obj *obj)
 }
 
 int
-pdf_dict_marked(pdf_obj *obj)
+pdf_obj_marked(pdf_obj *obj)
 {
 	RESOLVE(obj);
-	if (!obj || obj->kind != PDF_DICT)
+	if (!obj)
 		return 0;
-	return obj->u.d.marked;
+	return obj->marked;
 }
 
 int
-pdf_dict_mark(pdf_obj *obj)
+pdf_obj_mark(pdf_obj *obj)
 {
 	int marked;
 	RESOLVE(obj);
-	if (!obj || obj->kind != PDF_DICT)
+	if (!obj)
 		return 0;
-	marked = obj->u.d.marked;
-	obj->u.d.marked = 1;
+	marked = obj->marked;
+	obj->marked = 1;
 	return marked;
 }
 
 void
-pdf_dict_unmark(pdf_obj *obj)
+pdf_obj_unmark(pdf_obj *obj)
 {
 	RESOLVE(obj);
-	if (!obj || obj->kind != PDF_DICT)
+	if (!obj)
 		return;
-	obj->u.d.marked = 0;
+	obj->marked = 0;
 }
 
 static void
diff --git a/pdf/pdf_outline.c b/pdf/pdf_outline.c
index 616f5a15..d92f3fbd 100644
--- a/pdf/pdf_outline.c
+++ b/pdf/pdf_outline.c
@@ -17,7 +17,7 @@ pdf_load_outline_imp(pdf_document *xref, pdf_obj *dict)
 		prev = &first;
 		while (dict && pdf_is_dict(dict))
 		{
-			if (pdf_dict_mark(dict))
+			if (pdf_obj_mark(dict))
 				break;
 			node = fz_malloc_struct(ctx, fz_outline);
 			node->title = NULL;
@@ -45,8 +45,8 @@ pdf_load_outline_imp(pdf_document *xref, pdf_obj *dict)
 	}
 	fz_always(ctx)
 	{
-		for (dict = odict; dict && pdf_dict_marked(dict); dict = pdf_dict_gets(dict, "Next"))
-			pdf_dict_unmark(dict);
+		for (dict = odict; dict && pdf_obj_marked(dict); dict = pdf_dict_gets(dict, "Next"))
+			pdf_obj_unmark(dict);
 	}
 	fz_catch(ctx)
 	{
diff --git a/pdf/pdf_page.c b/pdf/pdf_page.c
index f275d951..08fbbac6 100644
--- a/pdf/pdf_page.c
+++ b/pdf/pdf_page.c
@@ -54,7 +54,7 @@ pdf_load_page_tree_node(pdf_document *xref, pdf_obj *node, struct info info)
 	{
 		do
 		{
-			if (!node || pdf_dict_mark(node))
+			if (!node || pdf_obj_mark(node))
 			{
 				/* NULL node, or we've been here before.
 				 * Nothing to do. */
@@ -112,7 +112,7 @@ pdf_load_page_tree_node(pdf_document *xref, pdf_obj *node, struct info info)
 					xref->page_refs[xref->page_len] = pdf_keep_obj(node);
 					xref->page_objs[xref->page_len] = pdf_keep_obj(dict);
 					xref->page_len ++;
-					pdf_dict_unmark(node);
+					pdf_obj_unmark(node);
 				}
 			}
 			/* Get the next node */
@@ -120,13 +120,13 @@ pdf_load_page_tree_node(pdf_document *xref, pdf_obj *node, struct info info)
 				break;
 			while (++stack[stacklen].pos == stack[stacklen].max)
 			{
-				pdf_dict_unmark(stack[stacklen].node);
+				pdf_obj_unmark(stack[stacklen].node);
 				stacklen--;
 				if (stacklen < 0) /* No more to pop! */
 					break;
 				node = stack[stacklen].node;
 				info = stack[stacklen].info;
-				pdf_dict_unmark(node); /* Unmark it, cos we're about to mark it again */
+				pdf_obj_unmark(node); /* Unmark it, cos we're about to mark it again */
 			}
 			if (stacklen >= 0)
 				node = pdf_array_get(stack[stacklen].kids, stack[stacklen].pos);
@@ -136,7 +136,7 @@ pdf_load_page_tree_node(pdf_document *xref, pdf_obj *node, struct info info)
 	fz_always(ctx)
 	{
 		while (stacklen >= 0)
-			pdf_dict_unmark(stack[stacklen--].node);
+			pdf_obj_unmark(stack[stacklen--].node);
 		fz_free(ctx, stack);
 	}
 	fz_catch(ctx)
@@ -244,7 +244,7 @@ pdf_resources_use_blending(fz_context *ctx, pdf_obj *rdb)
 		return pdf_to_bool(obj);
 
 	/* stop on cyclic resource dependencies */
-	if (pdf_dict_mark(rdb))
+	if (pdf_obj_mark(rdb))
 		return 0;
 
 	fz_try(ctx)
@@ -274,7 +274,7 @@ found:
 	}
 	fz_always(ctx)
 	{
-		pdf_dict_unmark(rdb);
+		pdf_obj_unmark(rdb);
 	}
 	fz_catch(ctx)
 	{
diff --git a/pdf/pdf_write.c b/pdf/pdf_write.c
index 9f4852ff..d57c505a 100644
--- a/pdf/pdf_write.c
+++ b/pdf/pdf_write.c
@@ -793,7 +793,7 @@ mark_all(pdf_document *xref, pdf_write_options *opts, pdf_obj *val, int flag, in
 {
 	fz_context *ctx = xref->ctx;
 
-	if (pdf_dict_mark(val))
+	if (pdf_obj_mark(val))
 		return;
 
 	fz_try(ctx)
@@ -831,7 +831,7 @@ mark_all(pdf_document *xref, pdf_write_options *opts, pdf_obj *val, int flag, in
 	}
 	fz_always(ctx)
 	{
-		pdf_dict_unmark(val);
+		pdf_obj_unmark(val);
 	}
 	fz_catch(ctx)
 	{
@@ -844,7 +844,7 @@ mark_pages(pdf_document *xref, pdf_write_options *opts, pdf_obj *val, int pagenu
 {
 	fz_context *ctx = xref->ctx;
 
-	if (pdf_dict_mark(val))
+	if (pdf_obj_mark(val))
 		return pagenum;
 
 	fz_try(ctx)
@@ -854,7 +854,7 @@ mark_pages(pdf_document *xref, pdf_write_options *opts, pdf_obj *val, int pagenu
 			if (!strcmp("Page", pdf_to_name(pdf_dict_gets(val, "Type"))))
 			{
 				int num = pdf_to_num(val);
-				pdf_dict_unmark(val);
+				pdf_obj_unmark(val);
 				mark_all(xref, opts, val, pagenum == 0 ? USE_PAGE1 : (pagenum<<USE_PAGE_SHIFT), pagenum);
 				page_objects_list_set_page_object(ctx, opts, pagenum, num);
 				pagenum++;
@@ -899,7 +899,7 @@ mark_pages(pdf_document *xref, pdf_write_options *opts, pdf_obj *val, int pagenu
 	}
 	fz_always(ctx)
 	{
-		pdf_dict_unmark(val);
+		pdf_obj_unmark(val);
 	}
 	fz_catch(ctx)
 	{
@@ -914,7 +914,7 @@ mark_root(pdf_document *xref, pdf_write_options *opts, pdf_obj *dict)
 	fz_context *ctx = xref->ctx;
 	int i, n = pdf_dict_len(dict);
 
-	if (pdf_dict_mark(dict))
+	if (pdf_obj_mark(dict))
 		return;
 
 	fz_try(ctx)
@@ -945,7 +945,7 @@ mark_root(pdf_document *xref, pdf_write_options *opts, pdf_obj *dict)
 	}
 	fz_always(ctx)
 	{
-		pdf_dict_unmark(dict);
+		pdf_obj_unmark(dict);
 	}
 	fz_catch(ctx)
 	{
@@ -959,7 +959,7 @@ mark_trailer(pdf_document *xref, pdf_write_options *opts, pdf_obj *dict)
 	fz_context *ctx = xref->ctx;
 	int i, n = pdf_dict_len(dict);
 
-	if (pdf_dict_mark(dict))
+	if (pdf_obj_mark(dict))
 		return;
 
 	fz_try(ctx)
@@ -977,7 +977,7 @@ mark_trailer(pdf_document *xref, pdf_write_options *opts, pdf_obj *dict)
 	}
 	fz_always(ctx)
 	{
-		pdf_dict_unmark(dict);
+		pdf_obj_unmark(dict);
 	}
 	fz_catch(ctx)
 	{
@@ -1168,7 +1168,7 @@ lpr(fz_context *ctx, pdf_obj *node, int depth, int page)
 	pdf_obj *o = NULL;
 	int i, n;
 
-	if (pdf_dict_mark(node))
+	if (pdf_obj_mark(node))
 		return page;
 
 	fz_var(o);
@@ -1233,7 +1233,7 @@ lpr(fz_context *ctx, pdf_obj *node, int depth, int page)
 		fz_rethrow(ctx);
 	}
 
-	pdf_dict_unmark(node);
+	pdf_obj_unmark(node);
 
 	return page;
 }