1 files changed, 32 insertions, 5 deletions
diff --git a/source/pdf/pdf-object.c b/source/pdf/pdf-object.c
index d4f504d3..295cfc5c 100644
--- a/source/pdf/pdf-object.c
+++ b/source/pdf/pdf-object.c
@@ -2156,15 +2156,42 @@ int pdf_obj_refs(fz_context *ctx, pdf_obj *obj)
 
 /* Convenience functions */
 
-pdf_obj *pdf_dict_get_inheritable(fz_context *ctx, pdf_obj *dict, pdf_obj *key)
+pdf_obj *
+pdf_dict_get_inheritable(fz_context *ctx, pdf_obj *node, pdf_obj *key)
 {
+	pdf_obj *node2 = node;
 	pdf_obj *val = NULL;
-	while (!val && dict)
+
+	fz_var(node);
+	fz_try(ctx)
+	{
+		do
+		{
+			val = pdf_dict_get(ctx, node, key);
+			if (val)
+				break;
+			if (pdf_mark_obj(ctx, node))
+				fz_throw(ctx, FZ_ERROR_GENERIC, "cycle in tree (parents)");
+			node = pdf_dict_get(ctx, node, PDF_NAME(Parent));
+		}
+		while (node);
+	}
+	fz_always(ctx)
+	{
+		do
+		{
+			pdf_unmark_obj(ctx, node2);
+			if (node2 == node)
+				break;
+			node2 = pdf_dict_get(ctx, node2, PDF_NAME(Parent));
+		}
+		while (node2);
+	}
+	fz_catch(ctx)
 	{
-		val = pdf_dict_get(ctx, dict, key);
-		if (!val)
-			dict = pdf_dict_get(ctx, dict, PDF_NAME(Parent));
+		fz_rethrow(ctx);
 	}
+
 	return val;
 }