Prevent duplicate parses of same data, in the same recursive descent

When parsing if there is a loop in the data being parsed, the
recursions will just keep cycling until it exhausts memory and
crashes. This CL introduces a parsed set, which a reference to is
passed down the descent. If the data being parsed at a specific stage
of the descent is already in the parsed set, then the parse returns at
that point.

BUG=chromium:759224

Change-Id: I1dca73d81020099dec03fd49aaa44cdcdf38e17e
Reviewed-on: https://pdfium-review.googlesource.com/12470
Reviewed-by: Tom Sepez <tsepez@chromium.org>
Commit-Queue: Ryan Harrison <rharrison@chromium.org>

1 files changed, 7 insertions, 2 deletions

diff --git a/core/fpdfapi/page/cpdf_form.h b/core/fpdfapi/page/cpdf_form.h
index 2cce800f23..c5285a1d01 100644
--- a/core/fpdfapi/page/cpdf_form.h
+++ b/core/fpdfapi/page/cpdf_form.h
@@ -7,6 +7,9 @@
 #ifndef CORE_FPDFAPI_PAGE_CPDF_FORM_H_
 #define CORE_FPDFAPI_PAGE_CPDF_FORM_H_
 
+#include <memory>
+#include <set>
+
 #include "core/fpdfapi/page/cpdf_pageobjectholder.h"
 
 class CPDF_Document;
@@ -28,13 +31,15 @@ class CPDF_Form : public CPDF_PageObjectHolder {
   void ParseContentWithParams(CPDF_AllStates* pGraphicStates,
                               const CFX_Matrix* pParentMatrix,
                               CPDF_Type3Char* pType3Char,
-                              int level);
+                              std::set<const uint8_t*>* parsedSet);
 
  private:
   void StartParse(CPDF_AllStates* pGraphicStates,
                   const CFX_Matrix* pParentMatrix,
                   CPDF_Type3Char* pType3Char,
-                  int level);
+                  std::set<const uint8_t*>* parsedSet);
+
+  std::unique_ptr<std::set<const uint8_t*>> m_ParsedSet;
 };
 
 #endif  // CORE_FPDFAPI_PAGE_CPDF_FORM_H_