diff options
author | Ryan Harrison <rharrison@chromium.org> | 2017-08-31 11:57:14 -0400 |
---|---|---|
committer | Chromium commit bot <commit-bot@chromium.org> | 2017-08-31 17:06:29 +0000 |
commit | bc0ca1ec9b157ab8773c9043725c7422f7c1a57c (patch) | |
tree | c1e46db02a10e3377d597265dcf125b980c277b0 /core/fpdfapi/page/cpdf_form.h | |
parent | df064df7a08e008b3c8e4d56bb0b75da9f014147 (diff) | |
download | pdfium-bc0ca1ec9b157ab8773c9043725c7422f7c1a57c.tar.xz |
Prevent duplicate parses of same data, in the same recursive descent
When parsing if there is a loop in the data being parsed, the
recursions will just keep cycling until it exhausts memory and
crashes. This CL introduces a parsed set, which a reference to is
passed down the descent. If the data being parsed at a specific stage
of the descent is already in the parsed set, then the parse returns at
that point.
BUG=chromium:759224
Change-Id: I1dca73d81020099dec03fd49aaa44cdcdf38e17e
Reviewed-on: https://pdfium-review.googlesource.com/12470
Reviewed-by: Tom Sepez <tsepez@chromium.org>
Commit-Queue: Ryan Harrison <rharrison@chromium.org>
Diffstat (limited to 'core/fpdfapi/page/cpdf_form.h')
-rw-r--r-- | core/fpdfapi/page/cpdf_form.h | 9 |
1 files changed, 7 insertions, 2 deletions
diff --git a/core/fpdfapi/page/cpdf_form.h b/core/fpdfapi/page/cpdf_form.h index 2cce800f23..c5285a1d01 100644 --- a/core/fpdfapi/page/cpdf_form.h +++ b/core/fpdfapi/page/cpdf_form.h @@ -7,6 +7,9 @@ #ifndef CORE_FPDFAPI_PAGE_CPDF_FORM_H_ #define CORE_FPDFAPI_PAGE_CPDF_FORM_H_ +#include <memory> +#include <set> + #include "core/fpdfapi/page/cpdf_pageobjectholder.h" class CPDF_Document; @@ -28,13 +31,15 @@ class CPDF_Form : public CPDF_PageObjectHolder { void ParseContentWithParams(CPDF_AllStates* pGraphicStates, const CFX_Matrix* pParentMatrix, CPDF_Type3Char* pType3Char, - int level); + std::set<const uint8_t*>* parsedSet); private: void StartParse(CPDF_AllStates* pGraphicStates, const CFX_Matrix* pParentMatrix, CPDF_Type3Char* pType3Char, - int level); + std::set<const uint8_t*>* parsedSet); + + std::unique_ptr<std::set<const uint8_t*>> m_ParsedSet; }; #endif // CORE_FPDFAPI_PAGE_CPDF_FORM_H_ |