Detect resursive loading of type3 font char to avoid infinite loop

The original way of detecting loops was passing a level parameter
through various functions. This missed some cases which also lead
to load type3 font char, for example, FindFont() may call
CheckType3FontMetrics() which may eventually lead to LoadChar().

The new way is to store the char loading depth, and abort when the depth
exceeds the max.

BUG=chromium:651304

Review-Url: https://codereview.chromium.org/2384853002

7 files changed, 26 insertions, 21 deletions

diff --git a/core/fpdfapi/fpdf_font/cpdf_cidfont.cpp b/core/fpdfapi/fpdf_font/cpdf_cidfont.cpp
index ce7d5090d5..45db54fa67 100644
--- a/core/fpdfapi/fpdf_font/cpdf_cidfont.cpp
+++ b/core/fpdfapi/fpdf_font/cpdf_cidfont.cpp
@@ -428,7 +428,7 @@ bool CPDF_CIDFont::Load() {
   return true;
 }
 
-FX_RECT CPDF_CIDFont::GetCharBBox(uint32_t charcode, int level) {
+FX_RECT CPDF_CIDFont::GetCharBBox(uint32_t charcode) {
   if (charcode < 256 && m_CharBBox[charcode].right != -1)
     return m_CharBBox[charcode];
 
@@ -499,7 +499,7 @@ FX_RECT CPDF_CIDFont::GetCharBBox(uint32_t charcode, int level) {
   return rect;
 }
 
-int CPDF_CIDFont::GetCharWidthF(uint32_t charcode, int level) {
+int CPDF_CIDFont::GetCharWidthF(uint32_t charcode) {
   if (charcode < 0x80 && m_bAnsiWidthsFixed)
     return (charcode >= 32 && charcode < 127) ? 500 : 0;
 
diff --git a/core/fpdfapi/fpdf_font/cpdf_cidfont.h b/core/fpdfapi/fpdf_font/cpdf_cidfont.h
index 2c7df93b64..3e8c042c75 100644
--- a/core/fpdfapi/fpdf_font/cpdf_cidfont.h
+++ b/core/fpdfapi/fpdf_font/cpdf_cidfont.h
@@ -41,8 +41,8 @@ class CPDF_CIDFont : public CPDF_Font {
   const CPDF_CIDFont* AsCIDFont() const override;
   CPDF_CIDFont* AsCIDFont() override;
   int GlyphFromCharCode(uint32_t charcode, bool* pVertGlyph) override;
-  int GetCharWidthF(uint32_t charcode, int level = 0) override;
-  FX_RECT GetCharBBox(uint32_t charcode, int level = 0) override;
+  int GetCharWidthF(uint32_t charcode) override;
+  FX_RECT GetCharBBox(uint32_t charcode) override;
   uint32_t GetNextChar(const FX_CHAR* pString,
                        int nStrLen,
                        int& offset) const override;
diff --git a/core/fpdfapi/fpdf_font/cpdf_font.h b/core/fpdfapi/fpdf_font/cpdf_font.h
index 04f942c03c..0d2f50b61a 100644
--- a/core/fpdfapi/fpdf_font/cpdf_font.h
+++ b/core/fpdfapi/fpdf_font/cpdf_font.h
@@ -91,8 +91,8 @@ class CPDF_Font {
   uint32_t FallbackFontFromCharcode(uint32_t charcode);
   int FallbackGlyphFromCharcode(int fallbackFont, uint32_t charcode);
 
-  virtual int GetCharWidthF(uint32_t charcode, int level = 0) = 0;
-  virtual FX_RECT GetCharBBox(uint32_t charcode, int level = 0) = 0;
+  virtual int GetCharWidthF(uint32_t charcode) = 0;
+  virtual FX_RECT GetCharBBox(uint32_t charcode) = 0;
 
   CPDF_Document* m_pDocument;
   CFX_Font m_Font;
diff --git a/core/fpdfapi/fpdf_font/cpdf_simplefont.cpp b/core/fpdfapi/fpdf_font/cpdf_simplefont.cpp
index dda642380f..3bb3730fb5 100644
--- a/core/fpdfapi/fpdf_font/cpdf_simplefont.cpp
+++ b/core/fpdfapi/fpdf_font/cpdf_simplefont.cpp
@@ -78,7 +78,7 @@ void CPDF_SimpleFont::LoadCharMetrics(int charcode) {
   }
 }
 
-int CPDF_SimpleFont::GetCharWidthF(uint32_t charcode, int level) {
+int CPDF_SimpleFont::GetCharWidthF(uint32_t charcode) {
   if (charcode > 0xff)
     charcode = 0;
 
@@ -91,7 +91,7 @@ int CPDF_SimpleFont::GetCharWidthF(uint32_t charcode, int level) {
   return m_CharWidth[charcode];
 }
 
-FX_RECT CPDF_SimpleFont::GetCharBBox(uint32_t charcode, int level) {
+FX_RECT CPDF_SimpleFont::GetCharBBox(uint32_t charcode) {
   if (charcode > 0xff)
     charcode = 0;
 
diff --git a/core/fpdfapi/fpdf_font/cpdf_simplefont.h b/core/fpdfapi/fpdf_font/cpdf_simplefont.h
index 47067687a3..f286c1a228 100644
--- a/core/fpdfapi/fpdf_font/cpdf_simplefont.h
+++ b/core/fpdfapi/fpdf_font/cpdf_simplefont.h
@@ -20,8 +20,8 @@ class CPDF_SimpleFont : public CPDF_Font {
   ~CPDF_SimpleFont() override;
 
   // CPDF_Font
-  int GetCharWidthF(uint32_t charcode, int level = 0) override;
-  FX_RECT GetCharBBox(uint32_t charcode, int level = 0) override;
+  int GetCharWidthF(uint32_t charcode) override;
+  FX_RECT GetCharBBox(uint32_t charcode) override;
   int GlyphFromCharCode(uint32_t charcode, bool* pVertGlyph) override;
   bool IsUnicodeCompatible() const override;
   CFX_WideString UnicodeFromCharCode(uint32_t charcode) const override;
diff --git a/core/fpdfapi/fpdf_font/cpdf_type3font.cpp b/core/fpdfapi/fpdf_font/cpdf_type3font.cpp
index 4c81202bc4..e43ccda904 100644
--- a/core/fpdfapi/fpdf_font/cpdf_type3font.cpp
+++ b/core/fpdfapi/fpdf_font/cpdf_type3font.cpp
@@ -19,7 +19,8 @@
 CPDF_Type3Font::CPDF_Type3Font()
     : m_pCharProcs(nullptr),
       m_pPageResources(nullptr),
-      m_pFontResources(nullptr) {
+      m_pFontResources(nullptr),
+      m_CharLoadingDepth(0) {
   FXSYS_memset(m_CharWidthL, 0, sizeof(m_CharWidthL));
 }
 
@@ -87,8 +88,8 @@ void CPDF_Type3Font::CheckType3FontMetrics() {
   CheckFontMetrics();
 }
 
-CPDF_Type3Char* CPDF_Type3Font::LoadChar(uint32_t charcode, int level) {
-  if (level >= _FPDF_MAX_TYPE3_FORM_LEVEL_)
+CPDF_Type3Char* CPDF_Type3Font::LoadChar(uint32_t charcode) {
+  if (m_CharLoadingDepth >= _FPDF_MAX_TYPE3_FORM_LEVEL_)
     return nullptr;
 
   auto it = m_CacheMap.find(charcode);
@@ -111,7 +112,9 @@ CPDF_Type3Char* CPDF_Type3Font::LoadChar(uint32_t charcode, int level) {
   // This can trigger recursion into this method. The content of |m_CacheMap|
   // can change as a result. Thus after it returns, check the cache again for
   // a cache hit.
-  pNewChar->m_pForm->ParseContent(nullptr, nullptr, pNewChar.get(), level + 1);
+  m_CharLoadingDepth++;
+  pNewChar->m_pForm->ParseContent(nullptr, nullptr, pNewChar.get());
+  m_CharLoadingDepth--;
   it = m_CacheMap.find(charcode);
   if (it != m_CacheMap.end())
     return it->second.get();
@@ -139,18 +142,18 @@ CPDF_Type3Char* CPDF_Type3Font::LoadChar(uint32_t charcode, int level) {
   return pCachedChar;
 }
 
-int CPDF_Type3Font::GetCharWidthF(uint32_t charcode, int level) {
+int CPDF_Type3Font::GetCharWidthF(uint32_t charcode) {
   if (charcode >= FX_ArraySize(m_CharWidthL))
     charcode = 0;
 
   if (m_CharWidthL[charcode])
     return m_CharWidthL[charcode];
 
-  const CPDF_Type3Char* pChar = LoadChar(charcode, level);
+  const CPDF_Type3Char* pChar = LoadChar(charcode);
   return pChar ? pChar->m_Width : 0;
 }
 
-FX_RECT CPDF_Type3Font::GetCharBBox(uint32_t charcode, int level) {
-  const CPDF_Type3Char* pChar = LoadChar(charcode, level);
+FX_RECT CPDF_Type3Font::GetCharBBox(uint32_t charcode) {
+  const CPDF_Type3Char* pChar = LoadChar(charcode);
   return pChar ? pChar->m_BBox : FX_RECT();
 }
diff --git a/core/fpdfapi/fpdf_font/cpdf_type3font.h b/core/fpdfapi/fpdf_font/cpdf_type3font.h
index 2b840f2267..03078298f1 100644
--- a/core/fpdfapi/fpdf_font/cpdf_type3font.h
+++ b/core/fpdfapi/fpdf_font/cpdf_type3font.h
@@ -26,13 +26,13 @@ class CPDF_Type3Font : public CPDF_SimpleFont {
   bool IsType3Font() const override;
   const CPDF_Type3Font* AsType3Font() const override;
   CPDF_Type3Font* AsType3Font() override;
-  int GetCharWidthF(uint32_t charcode, int level = 0) override;
-  FX_RECT GetCharBBox(uint32_t charcode, int level = 0) override;
+  int GetCharWidthF(uint32_t charcode) override;
+  FX_RECT GetCharBBox(uint32_t charcode) override;
 
   void SetPageResources(CPDF_Dictionary* pResources) {
     m_pPageResources = pResources;
   }
-  CPDF_Type3Char* LoadChar(uint32_t charcode, int level = 0);
+  CPDF_Type3Char* LoadChar(uint32_t charcode);
   void CheckType3FontMetrics();
 
   CFX_Matrix& GetFontMatrix() { return m_FontMatrix; }
@@ -52,6 +52,8 @@ class CPDF_Type3Font : public CPDF_SimpleFont {
   CPDF_Dictionary* m_pPageResources;
   CPDF_Dictionary* m_pFontResources;
   std::map<uint32_t, std::unique_ptr<CPDF_Type3Char>> m_CacheMap;
+  // The depth char loading is in, to avoid recurive calling LoadChar().
+  int m_CharLoadingDepth;
 };
 
 #endif  // CORE_FPDFAPI_FPDF_FONT_CPDF_TYPE3FONT_H_