summaryrefslogtreecommitdiff
path: root/core/fpdfapi/page/cpdf_stitchfunc.cpp
diff options
context:
space:
mode:
authorHenrique Nakashima <hnakashima@chromium.org>2018-04-11 00:13:36 +0000
committerChromium commit bot <commit-bot@chromium.org>2018-04-11 00:13:36 +0000
commit6bebd2e3cfb7790580722836d0debab3103c94d0 (patch)
treecb8096e419b61d4b6aa6214ac7779f672d0761d9 /core/fpdfapi/page/cpdf_stitchfunc.cpp
parent486f39568b6f336b4e6c81300ee9caae54ebdff2 (diff)
downloadpdfium-6bebd2e3cfb7790580722836d0debab3103c94d0.tar.xz
Avoid stack overflow when loading CPDF_Function.chromium/3395
CPDF_StitchFuncs that reference each other create a Load() loop. Maintaining a set of the visited CPDF_Objects during a Load() call tree prevents that. Bug: chromium:830221 Change-Id: I6f494da16c6d79f05870ff85cff38ff8fe69ecfe Reviewed-on: https://pdfium-review.googlesource.com/30050 Commit-Queue: dsinclair <dsinclair@chromium.org> Reviewed-by: dsinclair <dsinclair@chromium.org>
Diffstat (limited to 'core/fpdfapi/page/cpdf_stitchfunc.cpp')
-rw-r--r--core/fpdfapi/page/cpdf_stitchfunc.cpp5
1 files changed, 3 insertions, 2 deletions
diff --git a/core/fpdfapi/page/cpdf_stitchfunc.cpp b/core/fpdfapi/page/cpdf_stitchfunc.cpp
index 336c74bf5c..fd83fd651a 100644
--- a/core/fpdfapi/page/cpdf_stitchfunc.cpp
+++ b/core/fpdfapi/page/cpdf_stitchfunc.cpp
@@ -22,7 +22,8 @@ CPDF_StitchFunc::~CPDF_StitchFunc() {
FX_Free(m_pEncode);
}
-bool CPDF_StitchFunc::v_Init(CPDF_Object* pObj) {
+bool CPDF_StitchFunc::v_Init(CPDF_Object* pObj,
+ std::set<CPDF_Object*>* pVisited) {
CPDF_Dictionary* pDict = pObj->GetDict();
if (!pDict) {
return false;
@@ -42,7 +43,7 @@ bool CPDF_StitchFunc::v_Init(CPDF_Object* pObj) {
CPDF_Object* pSub = pArray->GetDirectObjectAt(i);
if (pSub == pObj)
return false;
- std::unique_ptr<CPDF_Function> pFunc(CPDF_Function::Load(pSub));
+ std::unique_ptr<CPDF_Function> pFunc(CPDF_Function::Load(pSub, pVisited));
if (!pFunc)
return false;
// Check that the input dimensionality is 1, and that all output