diff options
| author | Tom Sepez <tsepez@chromium.org> | 2015-01-26 16:51:21 -0800 |
|---|---|---|
| committer | Tom Sepez <tsepez@chromium.org> | 2015-01-26 16:51:21 -0800 |
| commit | a03932372b0906a340a6e3860c87e45f9ec79042 (patch) | |
| tree | bb92376fc72a8b30e76a09aec332141eeae58634 /testing/resources/bug_451830.pdf | |
| parent | fa370ac5cf6472f0ec0c9ecf62d1f9dd20ebfa42 (diff) | |
| download | pdfium-a03932372b0906a340a6e3860c87e45f9ec79042.tar.xz | |
Fix infinite recursion in CPDF_Parser::ParseIndirectObjectAt().
A suitably corrupted file can cause the parser(s) to repeatedly re-read
sections of the file at increasing parser recursion depth until the
stack is exhausted. There is supposed to be a check for this based upon
the parser "level", but not all call paths pass or update the level as
required.
Much as I hate per-class statics, this introduces one to track the depth
so that the check is enforced no matter how screwy the call path might be
that leads the parser to re-enter itself. This is more palatable than trying
to find all these paths and fix them. We know this is OK since there is
only one thread in here modifying the static.
BUG=451830
R=thestig@chromium.org
Review URL: https://codereview.chromium.org/875263002
Diffstat (limited to 'testing/resources/bug_451830.pdf')
| -rw-r--r-- | testing/resources/bug_451830.pdf | 14 |
1 files changed, 14 insertions, 0 deletions
diff --git a/testing/resources/bug_451830.pdf b/testing/resources/bug_451830.pdf new file mode 100644 index 0000000000..f209bb3ed1 --- /dev/null +++ b/testing/resources/bug_451830.pdf @@ -0,0 +1,14 @@ +%PDF-1.2 +%âãÏÓ +7 0 obj << + /Type /Font +trailer +<</// +endobj +4 0 obj << + /Resources << + /FT 7 0 R +>> +endstream +endobj +%%EOF |