Fix an infinite loop parsing in CPDF_SyntaxParser::GetObject()

CPDF_SyntaxParser::GetObject() may enter into an infinite loop when a
signature dictionary doesn't have 'Contents' field. Add a check to
avoid that.

BUG=pdfium:344
R=thestig@chromium.org

Review URL: https://codereview.chromium.org/1575833004 .

3 files changed, 19 insertions, 3 deletions

diff --git a/core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp b/core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp
index 3ab4423172..49d6760c65 100644
--- a/core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp
+++ b/core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp
@@ -2163,12 +2163,13 @@ CPDF_Object* CPDF_SyntaxParser::GetObject(CPDF_IndirectObjects* pObjList,
       pDict->SetAt(keyNoSlash, pObj);
     }
 
-    if (IsSignatureDict(pDict.get())) {
-      FX_FILESIZE dwSavePos = m_Pos;
+    // Only when this is a signature dictionary and has contents, we reset the
+    // contents to the un-decrypted form.
+    if (IsSignatureDict(pDict.get()) && dwSignValuePos) {
+      CFX_AutoRestorer<FX_FILESIZE> save_pos(&m_Pos);
       m_Pos = dwSignValuePos;
       CPDF_Object* pObj = GetObject(pObjList, objnum, gennum, nullptr, FALSE);
       pDict->SetAt("Contents", pObj);
-      m_Pos = dwSavePos;
     }
     if (pContext) {
       pContext->m_DictEnd = m_Pos;
diff --git a/fpdfsdk/src/fpdfview_embeddertest.cpp b/fpdfsdk/src/fpdfview_embeddertest.cpp
index 6a6d076983..3147c01660 100644
--- a/fpdfsdk/src/fpdfview_embeddertest.cpp
+++ b/fpdfsdk/src/fpdfview_embeddertest.cpp
@@ -221,4 +221,10 @@ TEST_F(FPDFViewEmbeddertest, CrossRefV4Loop) {
 // cause infinite loop.
 TEST_F(FPDFViewEmbeddertest, Hang_343) {
   EXPECT_FALSE(OpenDocument("bug_343.pdf"));
+}
+
+// The test should pass when the absence of 'Contents' field in a signature
+// dictionary will not cause an infinite loop in CPDF_SyntaxParser::GetObject().
+TEST_F(FPDFViewEmbeddertest, Hang_344) {
+  EXPECT_FALSE(OpenDocument("bug_344.pdf"));
 }
\ No newline at end of file
diff --git a/testing/resources/bug_344.pdf b/testing/resources/bug_344.pdf
new file mode 100644
index 0000000000..c015c66791
--- /dev/null
+++ b/testing/resources/bug_344.pdf
@@ -0,0 +1,9 @@
+'%PDF-1.6
+%âãÏÓ
+<<0 0 objParams%PDF-2.4
+trailer%
+<<Subtype:XM/Length 308/Type/Sig[/Me’ada'%PDF-1.6
+%âãÏÓ
+<<0 0 objParams%PDF-1.4
+trailer%
+<<Subtype:XM/Length 308/Type/Sig[/Me’adata>>ta>>%%sPsP
\ No newline at end of file