Add parse depth limit to FormCalc parser

Due to the recursive nature of the FormCalc parser, deeply nested
expressions can lead to memory being exhausted. This check is being
added to have the parser exit early instead of running out of
memory. This should reduce the number of false positives about
addressing issues being found by fuzzers.

BUG=chromium:752433

Change-Id: I511ecfb07e32073555e1fd1658f3b8b47f1a5a91
Reviewed-on: https://pdfium-review.googlesource.com/11170
Commit-Queue: Ryan Harrison <rharrison@chromium.org>
Reviewed-by: Tom Sepez <tsepez@chromium.org>

1 files changed, 7 insertions, 0 deletions

diff --git a/xfa/fxfa/fm2js/cxfa_fmparser.h b/xfa/fxfa/fm2js/cxfa_fmparser.h
index 66eb1f8392..ddfaa1aaa6 100644
--- a/xfa/fxfa/fm2js/cxfa_fmparser.h
+++ b/xfa/fxfa/fm2js/cxfa_fmparser.h
@@ -21,9 +21,14 @@ class CXFA_FMParser {
   std::unique_ptr<CXFA_FMFunctionDefinition> Parse();
   bool HasError() const;
 
+  void SetMaxParseDepthForTest(unsigned long max_depth) {
+    m_max_parse_depth = max_depth;
+  }
+
  private:
   bool NextToken();
   bool CheckThenNext(XFA_FM_TOKEN op);
+  bool IncrementParseDepthAndCheck();
 
   std::vector<std::unique_ptr<CXFA_FMExpression>> ParseTopExpression();
   std::unique_ptr<CXFA_FMExpression> ParseFunction();
@@ -54,6 +59,8 @@ class CXFA_FMParser {
   std::unique_ptr<CXFA_FMLexer> m_lexer;
   std::unique_ptr<CXFA_FMToken> m_token;
   bool m_error;
+  unsigned long m_parse_depth;
+  unsigned long m_max_parse_depth;
 };
 
 #endif  // XFA_FXFA_FM2JS_CXFA_FMPARSER_H_