diff options
| author | Henrique Nakashima <hnakashima@chromium.org> | 2018-04-11 00:13:36 +0000 |
|---|---|---|
| committer | Chromium commit bot <commit-bot@chromium.org> | 2018-04-11 00:13:36 +0000 |
| commit | 6bebd2e3cfb7790580722836d0debab3103c94d0 (patch) | |
| tree | cb8096e419b61d4b6aa6214ac7779f672d0761d9 /core/fpdfapi/page/cpdf_function.h | |
| parent | 486f39568b6f336b4e6c81300ee9caae54ebdff2 (diff) | |
| download | pdfium-6bebd2e3cfb7790580722836d0debab3103c94d0.tar.xz | |
Avoid stack overflow when loading CPDF_Function.chromium/3395
CPDF_StitchFuncs that reference each other create a Load() loop.
Maintaining a set of the visited CPDF_Objects during a Load()
call tree prevents that.
Bug: chromium:830221
Change-Id: I6f494da16c6d79f05870ff85cff38ff8fe69ecfe
Reviewed-on: https://pdfium-review.googlesource.com/30050
Commit-Queue: dsinclair <dsinclair@chromium.org>
Reviewed-by: dsinclair <dsinclair@chromium.org>
Diffstat (limited to 'core/fpdfapi/page/cpdf_function.h')
| -rw-r--r-- | core/fpdfapi/page/cpdf_function.h | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/core/fpdfapi/page/cpdf_function.h b/core/fpdfapi/page/cpdf_function.h index ff7cf847d2..7966194ade 100644 --- a/core/fpdfapi/page/cpdf_function.h +++ b/core/fpdfapi/page/cpdf_function.h @@ -8,6 +8,7 @@ #define CORE_FPDFAPI_PAGE_CPDF_FUNCTION_H_ #include <memory> +#include <set> class CPDF_ExpIntFunc; class CPDF_Object; @@ -50,8 +51,10 @@ class CPDF_Function { protected: explicit CPDF_Function(Type type); - bool Init(CPDF_Object* pObj); - virtual bool v_Init(CPDF_Object* pObj) = 0; + static std::unique_ptr<CPDF_Function> Load(CPDF_Object* pFuncObj, + std::set<CPDF_Object*>* pVisited); + bool Init(CPDF_Object* pObj, std::set<CPDF_Object*>* pVisited); + virtual bool v_Init(CPDF_Object* pObj, std::set<CPDF_Object*>* pVisited) = 0; virtual bool v_Call(float* inputs, float* results) const = 0; uint32_t m_nInputs; |