summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp14
-rw-r--r--fpdfsdk/src/fpdfview_embeddertest.cpp8
-rw-r--r--testing/resources/bug_113.in29
-rw-r--r--testing/resources/bug_113.pdf38
4 files changed, 85 insertions, 4 deletions
diff --git a/core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp b/core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp
index 29265f407f..4b80895d61 100644
--- a/core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp
+++ b/core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp
@@ -2743,7 +2743,11 @@ public:
}
virtual void GetLinearizedMainXRefInfo(FX_FILESIZE *pPos, FX_DWORD *pSize) FX_OVERRIDE;
+
protected:
+ static const int kMaxDataAvailRecursionDepth = 64;
+ static int s_CurrentDataAvailRecursionDepth;
+
FX_DWORD GetObjectSize(FX_DWORD objnum, FX_FILESIZE& offset);
FX_BOOL IsObjectsAvail(CFX_PtrArray& obj_array, FX_BOOL bParsePage, IFX_DownloadHints* pHints, CFX_PtrArray &ret_array);
FX_BOOL CheckDocStatus(IFX_DownloadHints *pHints);
@@ -2919,6 +2923,9 @@ IPDF_DataAvail* IPDF_DataAvail::Create(IFX_FileAvail* pFileAvail, IFX_FileRead*
return FX_NEW CPDF_DataAvail(pFileAvail, pFileRead);
}
+// static
+int CPDF_DataAvail::s_CurrentDataAvailRecursionDepth = 0;
+
CPDF_DataAvail::CPDF_DataAvail(IFX_FileAvail* pFileAvail, IFX_FileRead* pFileRead)
: IPDF_DataAvail(pFileAvail, pFileRead)
{
@@ -4395,6 +4402,10 @@ FX_BOOL CPDF_DataAvail::CheckLinearizedFirstPage(FX_INT32 iPage, IFX_DownloadHin
}
FX_BOOL CPDF_DataAvail::HaveResourceAncestor(CPDF_Dictionary *pDict)
{
+ CFX_AutoRestorer<int> restorer(&s_CurrentDataAvailRecursionDepth);
+ if (++s_CurrentDataAvailRecursionDepth > kMaxDataAvailRecursionDepth) {
+ return FALSE;
+ }
CPDF_Object *pParent = pDict->GetElement("Parent");
if (!pParent) {
return FALSE;
@@ -4407,9 +4418,8 @@ FX_BOOL CPDF_DataAvail::HaveResourceAncestor(CPDF_Dictionary *pDict)
if (pRet) {
m_pPageResource = pRet;
return TRUE;
- } else {
- return HaveResourceAncestor(pParentDict);
}
+ return HaveResourceAncestor(pParentDict);
}
FX_BOOL CPDF_DataAvail::IsPageAvail(FX_INT32 iPage, IFX_DownloadHints* pHints)
{
diff --git a/fpdfsdk/src/fpdfview_embeddertest.cpp b/fpdfsdk/src/fpdfview_embeddertest.cpp
index f9b611bbf6..04549741ec 100644
--- a/fpdfsdk/src/fpdfview_embeddertest.cpp
+++ b/fpdfsdk/src/fpdfview_embeddertest.cpp
@@ -177,11 +177,15 @@ TEST_F(FPDFViewEmbeddertest, NamedDestsByName) {
}
// The following tests pass if the document opens without crashing.
-TEST_F(FPDFViewEmbeddertest, Crasher1) {
+TEST_F(FPDFViewEmbeddertest, Crasher_113) {
+ EXPECT_TRUE(OpenDocument("testing/resources/bug_113.pdf"));
+}
+
+TEST_F(FPDFViewEmbeddertest, Crasher_451830) {
EXPECT_TRUE(OpenDocument("testing/resources/bug_451830.pdf"));
}
-TEST_F(FPDFViewEmbeddertest, Crasher2) {
+TEST_F(FPDFViewEmbeddertest, Crasher_452455) {
EXPECT_TRUE(OpenDocument("testing/resources/bug_452455.pdf"));
FPDF_PAGE page = LoadPage(0);
EXPECT_NE(nullptr, page);
diff --git a/testing/resources/bug_113.in b/testing/resources/bug_113.in
new file mode 100644
index 0000000000..5fc6e71744
--- /dev/null
+++ b/testing/resources/bug_113.in
@@ -0,0 +1,29 @@
+{{header}}
+{{object 3 0}} <<
+ /Pages 5 0 R
+>>
+endobj
+{{object 4 0}} <<
+/Type /Page
+/Parent 5 0 R
+/Resources <<
+/Font <<xt
+endobj
+% partial object
+{{object 5 0}} <<
+ /Type /Page
+ /Parent 5 0 R
+ /bork <<
+endobj
+% duplicate definition of partial object
+{{object 5 0}} <<
+ /Kids [4 0 R]
+ /bork 1P
+ /MediaBox [ 0
+endobj
+{{xref}}
+trailer <<
+ /Root 3 0 R
+>>
+{{startxref}}
+%%EOF
diff --git a/testing/resources/bug_113.pdf b/testing/resources/bug_113.pdf
new file mode 100644
index 0000000000..0a524c1b8e
--- /dev/null
+++ b/testing/resources/bug_113.pdf
@@ -0,0 +1,38 @@
+%PDF-1.7
+% ò¤ô
+3 0 obj <<
+ /Pages 5 0 R
+>>
+endobj
+4 0 obj <<
+/Type /Page
+/Parent 5 0 R
+/Resources <<
+/Font <<xt
+endobj
+% partial object
+5 0 obj <<
+ /Type /Page
+ /Parent 5 0 R
+ /bork <<
+endobj
+% duplicate definition of partial object
+5 0 obj <<
+ /Kids [4 0 R]
+ /bork 1P
+ /MediaBox [ 0
+endobj
+xref
+0 6
+0000000000 65536 f
+0000000000 65536 f
+0000000000 65536 f
+0000000015 00000 n
+0000000051 00000 n
+0000000237 00000 n
+trailer <<
+ /Root 3 0 R
+>>
+startxref
+298
+%%EOF