diff options
author | weili <weili@chromium.org> | 2016-08-23 22:08:37 -0700 |
---|---|---|
committer | Commit bot <commit-bot@chromium.org> | 2016-08-23 22:08:37 -0700 |
commit | a470b5e5371d0674d06068ec38d0d3c3279e85e1 (patch) | |
tree | e13f893084515082052e30c1cb8d94ec6303e38b /core/fpdfapi/fpdf_parser/cpdf_reference.cpp | |
parent | 0dadcc6fdab7ad1f2ee95d763f31aad5d3534f93 (diff) | |
download | pdfium-a470b5e5371d0674d06068ec38d0d3c3279e85e1.tar.xz |
Fix stack overflow in object Clone() functions
For some complex objects such as CPDF_Dictionary, CPDF_Array,
CPDF_Stream, and CPDF_Reference, Clone() could be executed with
infinite recursion to cause the stack overflow. Fix this by
checking already cloned objects to avoid recursion.
BUG=pdfium:513
Review-Url: https://codereview.chromium.org/2250533002
Diffstat (limited to 'core/fpdfapi/fpdf_parser/cpdf_reference.cpp')
-rw-r--r-- | core/fpdfapi/fpdf_parser/cpdf_reference.cpp | 14 |
1 files changed, 12 insertions, 2 deletions
diff --git a/core/fpdfapi/fpdf_parser/cpdf_reference.cpp b/core/fpdfapi/fpdf_parser/cpdf_reference.cpp index afda50c324..4e7b3786d3 100644 --- a/core/fpdfapi/fpdf_parser/cpdf_reference.cpp +++ b/core/fpdfapi/fpdf_parser/cpdf_reference.cpp @@ -7,6 +7,7 @@ #include "core/fpdfapi/fpdf_parser/include/cpdf_reference.h" #include "core/fpdfapi/fpdf_parser/include/cpdf_indirect_object_holder.h" +#include "third_party/base/stl_util.h" CPDF_Reference::CPDF_Reference(CPDF_IndirectObjectHolder* pDoc, int objnum) : m_pObjList(pDoc), m_RefObjNum(objnum) {} @@ -49,10 +50,19 @@ const CPDF_Reference* CPDF_Reference::AsReference() const { return this; } -CPDF_Object* CPDF_Reference::Clone(FX_BOOL bDirect) const { +CPDF_Object* CPDF_Reference::Clone() const { + return CloneObjectNonCyclic(false); +} + +CPDF_Object* CPDF_Reference::CloneNonCyclic( + bool bDirect, + std::set<const CPDF_Object*>* pVisited) const { + pVisited->insert(this); if (bDirect) { auto* pDirect = GetDirect(); - return pDirect ? pDirect->Clone(TRUE) : nullptr; + return pDirect && !pdfium::ContainsKey(*pVisited, pDirect) + ? pDirect->CloneNonCyclic(true, pVisited) + : nullptr; } return new CPDF_Reference(m_pObjList, m_RefObjNum); } |