Fix incorrect recursive object marking.

We use pdf_mark_obj/pdf_unmark_obj to catch cycles when
traversing PDF structures. In some cases we were failing
to actually test the return code, making it pointless.

3 files changed, 6 insertions, 3 deletions

diff --git a/source/pdf/pdf-cmap-load.c b/source/pdf/pdf-cmap-load.c
index 1cfe9dec..87b1c282 100644
--- a/source/pdf/pdf-cmap-load.c
+++ b/source/pdf/pdf-cmap-load.c
@@ -52,7 +52,8 @@ pdf_load_embedded_cmap(fz_context *ctx, pdf_document *doc, pdf_obj *stmobj)
 		}
 		else if (pdf_is_indirect(ctx, obj))
 		{
-			pdf_mark_obj(ctx, obj);
+			if (pdf_mark_obj(ctx, obj))
+				fz_throw(ctx, FZ_ERROR_GENERIC, "recursive CMap");
 			fz_try(ctx)
 				usecmap = pdf_load_embedded_cmap(ctx, doc, obj);
 			fz_always(ctx)
diff --git a/source/pdf/pdf-colorspace.c b/source/pdf/pdf-colorspace.c
index a1fd8140..f9a95335 100644
--- a/source/pdf/pdf-colorspace.c
+++ b/source/pdf/pdf-colorspace.c
@@ -259,7 +259,8 @@ pdf_load_colorspace_imp(fz_context *ctx, pdf_document *doc, pdf_obj *obj)
 				fz_colorspace *cs;
 				fz_try(ctx)
 				{
-					pdf_mark_obj(ctx, obj);
+					if (pdf_mark_obj(ctx, obj))
+						fz_throw(ctx, FZ_ERROR_GENERIC, "recursive colorspace");
 					if (pdf_name_eq(ctx, name, PDF_NAME_ICCBased))
 						cs = load_icc_based(ctx, doc, pdf_array_get(ctx, obj, 1));
 
diff --git a/source/pdf/pdf-function.c b/source/pdf/pdf-function.c
index 1207b191..b319dd97 100644
--- a/source/pdf/pdf-function.c
+++ b/source/pdf/pdf-function.c
@@ -1220,7 +1220,8 @@ load_stitching_func(fz_context *ctx, pdf_document *doc, pdf_function *func, pdf_
 
 	fz_try(ctx)
 	{
-		pdf_mark_obj(ctx, obj);
+		if (pdf_mark_obj(ctx, obj))
+			fz_throw(ctx, FZ_ERROR_GENERIC, "recursive function");
 		k = pdf_array_len(ctx, obj);
 
 		func->u.st.funcs = fz_malloc_array(ctx, k, sizeof(fz_function*));