7 files changed, 26 insertions, 21 deletions
diff --git a/core/fpdfapi/fpdf_font/cpdf_cidfont.cpp b/core/fpdfapi/fpdf_font/cpdf_cidfont.cpp
index ce7d5090d5..45db54fa67 100644
--- a/core/fpdfapi/fpdf_font/cpdf_cidfont.cpp
+++ b/core/fpdfapi/fpdf_font/cpdf_cidfont.cpp
@@ -428,7 +428,7 @@ bool CPDF_CIDFont::Load() {
   return true;
 }
 
-FX_RECT CPDF_CIDFont::GetCharBBox(uint32_t charcode, int level) {
+FX_RECT CPDF_CIDFont::GetCharBBox(uint32_t charcode) {
   if (charcode < 256 && m_CharBBox[charcode].right != -1)
     return m_CharBBox[charcode];
 
@@ -499,7 +499,7 @@ FX_RECT CPDF_CIDFont::GetCharBBox(uint32_t charcode, int level) {
   return rect;
 }
 
-int CPDF_CIDFont::GetCharWidthF(uint32_t charcode, int level) {
+int CPDF_CIDFont::GetCharWidthF(uint32_t charcode) {
   if (charcode < 0x80 && m_bAnsiWidthsFixed)
     return (charcode >= 32 && charcode < 127) ? 500 : 0;
 
diff --git a/core/fpdfapi/fpdf_font/cpdf_cidfont.h b/core/fpdfapi/fpdf_font/cpdf_cidfont.h
index 2c7df93b64..3e8c042c75 100644
--- a/core/fpdfapi/fpdf_font/cpdf_cidfont.h
+++ b/core/fpdfapi/fpdf_font/cpdf_cidfont.h
@@ -41,8 +41,8 @@ class CPDF_CIDFont : public CPDF_Font {
   const CPDF_CIDFont* AsCIDFont() const override;
   CPDF_CIDFont* AsCIDFont() override;
   int GlyphFromCharCode(uint32_t charcode, bool* pVertGlyph) override;
-  int GetCharWidthF(uint32_t charcode, int level = 0) override;
-  FX_RECT GetCharBBox(uint32_t charcode, int level = 0) override;
+  int GetCharWidthF(uint32_t charcode) override;
+  FX_RECT GetCharBBox(uint32_t charcode) override;
   uint32_t GetNextChar(const FX_CHAR* pString,
                        int nStrLen,
                        int& offset) const override;
diff --git a/core/fpdfapi/fpdf_font/cpdf_font.h b/core/fpdfapi/fpdf_font/cpdf_font.h
index 04f942c03c..0d2f50b61a 100644
--- a/core/fpdfapi/fpdf_font/cpdf_font.h
+++ b/core/fpdfapi/fpdf_font/cpdf_font.h
@@ -91,8 +91,8 @@ class CPDF_Font {
   uint32_t FallbackFontFromCharcode(uint32_t charcode);
   int FallbackGlyphFromCharcode(int fallbackFont, uint32_t charcode);
 
-  virtual int GetCharWidthF(uint32_t charcode, int level = 0) = 0;
-  virtual FX_RECT GetCharBBox(uint32_t charcode, int level = 0) = 0;
+  virtual int GetCharWidthF(uint32_t charcode) = 0;
+  virtual FX_RECT GetCharBBox(uint32_t charcode) = 0;
 
   CPDF_Document* m_pDocument;
   CFX_Font m_Font;
diff --git a/core/fpdfapi/fpdf_font/cpdf_simplefont.cpp b/core/fpdfapi/fpdf_font/cpdf_simplefont.cpp
index dda642380f..3bb3730fb5 100644
--- a/core/fpdfapi/fpdf_font/cpdf_simplefont.cpp
+++ b/core/fpdfapi/fpdf_font/cpdf_simplefont.cpp
@@ -78,7 +78,7 @@ void CPDF_SimpleFont::LoadCharMetrics(int charcode) {
   }
 }
 
-int CPDF_SimpleFont::GetCharWidthF(uint32_t charcode, int level) {
+int CPDF_SimpleFont::GetCharWidthF(uint32_t charcode) {
   if (charcode > 0xff)
     charcode = 0;
 
@@ -91,7 +91,7 @@ int CPDF_SimpleFont::GetCharWidthF(uint32_t charcode, int level) {
   return m_CharWidth[charcode];
 }
 
-FX_RECT CPDF_SimpleFont::GetCharBBox(uint32_t charcode, int level) {
+FX_RECT CPDF_SimpleFont::GetCharBBox(uint32_t charcode) {
   if (charcode > 0xff)
     charcode = 0;
 
diff --git a/core/fpdfapi/fpdf_font/cpdf_simplefont.h b/core/fpdfapi/fpdf_font/cpdf_simplefont.h
index 47067687a3..f286c1a228 100644
--- a/core/fpdfapi/fpdf_font/cpdf_simplefont.h
+++ b/core/fpdfapi/fpdf_font/cpdf_simplefont.h
@@ -20,8 +20,8 @@ class CPDF_SimpleFont : public CPDF_Font {
   ~CPDF_SimpleFont() override;
 
   // CPDF_Font
-  int GetCharWidthF(uint32_t charcode, int level = 0) override;
-  FX_RECT GetCharBBox(uint32_t charcode, int level = 0) override;
+  int GetCharWidthF(uint32_t charcode) override;
+  FX_RECT GetCharBBox(uint32_t charcode) override;
   int GlyphFromCharCode(uint32_t charcode, bool* pVertGlyph) override;
   bool IsUnicodeCompatible() const override;
   CFX_WideString UnicodeFromCharCode(uint32_t charcode) const override;
diff --git a/core/fpdfapi/fpdf_font/cpdf_type3font.cpp b/core/fpdfapi/fpdf_font/cpdf_type3font.cpp
index 4c81202bc4..e43ccda904 100644
--- a/core/fpdfapi/fpdf_font/cpdf_type3font.cpp
+++ b/core/fpdfapi/fpdf_font/cpdf_type3font.cpp
@@ -19,7 +19,8 @@
 CPDF_Type3Font::CPDF_Type3Font()
     : m_pCharProcs(nullptr),
       m_pPageResources(nullptr),
-      m_pFontResources(nullptr) {
+      m_pFontResources(nullptr),
+      m_CharLoadingDepth(0) {
   FXSYS_memset(m_CharWidthL, 0, sizeof(m_CharWidthL));
 }
 
@@ -87,8 +88,8 @@ void CPDF_Type3Font::CheckType3FontMetrics() {
   CheckFontMetrics();
 }
 
-CPDF_Type3Char* CPDF_Type3Font::LoadChar(uint32_t charcode, int level) {
-  if (level >= _FPDF_MAX_TYPE3_FORM_LEVEL_)
+CPDF_Type3Char* CPDF_Type3Font::LoadChar(uint32_t charcode) {
+  if (m_CharLoadingDepth >= _FPDF_MAX_TYPE3_FORM_LEVEL_)
     return nullptr;
 
   auto it = m_CacheMap.find(charcode);
@@ -111,7 +112,9 @@ CPDF_Type3Char* CPDF_Type3Font::LoadChar(uint32_t charcode, int level) {
   // This can trigger recursion into this method. The content of |m_CacheMap|
   // can change as a result. Thus after it returns, check the cache again for
   // a cache hit.
-  pNewChar->m_pForm->ParseContent(nullptr, nullptr, pNewChar.get(), level + 1);
+  m_CharLoadingDepth++;
+  pNewChar->m_pForm->ParseContent(nullptr, nullptr, pNewChar.get());
+  m_CharLoadingDepth--;
   it = m_CacheMap.find(charcode);
   if (it != m_CacheMap.end())
     return it->second.get();
@@ -139,18 +142,18 @@ CPDF_Type3Char* CPDF_Type3Font::LoadChar(uint32_t charcode, int level) {
   return pCachedChar;
 }
 
-int CPDF_Type3Font::GetCharWidthF(uint32_t charcode, int level) {
+int CPDF_Type3Font::GetCharWidthF(uint32_t charcode) {
   if (charcode >= FX_ArraySize(m_CharWidthL))
     charcode = 0;
 
   if (m_CharWidthL[charcode])
     return m_CharWidthL[charcode];
 
-  const CPDF_Type3Char* pChar = LoadChar(charcode, level);
+  const CPDF_Type3Char* pChar = LoadChar(charcode);
   return pChar ? pChar->m_Width : 0;
 }
 
-FX_RECT CPDF_Type3Font::GetCharBBox(uint32_t charcode, int level) {
-  const CPDF_Type3Char* pChar = LoadChar(charcode, level);
+FX_RECT CPDF_Type3Font::GetCharBBox(uint32_t charcode) {
+  const CPDF_Type3Char* pChar = LoadChar(charcode);
   return pChar ? pChar->m_BBox : FX_RECT();
 }
diff --git a/core/fpdfapi/fpdf_font/cpdf_type3font.h b/core/fpdfapi/fpdf_font/cpdf_type3font.h
index 2b840f2267..03078298f1 100644
--- a/core/fpdfapi/fpdf_font/cpdf_type3font.h
+++ b/core/fpdfapi/fpdf_font/cpdf_type3font.h
@@ -26,13 +26,13 @@ class CPDF_Type3Font : public CPDF_SimpleFont {
   bool IsType3Font() const override;
   const CPDF_Type3Font* AsType3Font() const override;
   CPDF_Type3Font* AsType3Font() override;
-  int GetCharWidthF(uint32_t charcode, int level = 0) override;
-  FX_RECT GetCharBBox(uint32_t charcode, int level = 0) override;
+  int GetCharWidthF(uint32_t charcode) override;
+  FX_RECT GetCharBBox(uint32_t charcode) override;
 
   void SetPageResources(CPDF_Dictionary* pResources) {
     m_pPageResources = pResources;
   }
-  CPDF_Type3Char* LoadChar(uint32_t charcode, int level = 0);
+  CPDF_Type3Char* LoadChar(uint32_t charcode);
   void CheckType3FontMetrics();
 
   CFX_Matrix& GetFontMatrix() { return m_FontMatrix; }
@@ -52,6 +52,8 @@ class CPDF_Type3Font : public CPDF_SimpleFont {
   CPDF_Dictionary* m_pPageResources;
   CPDF_Dictionary* m_pFontResources;
   std::map<uint32_t, std::unique_ptr<CPDF_Type3Char>> m_CacheMap;
+  // The depth char loading is in, to avoid recurive calling LoadChar().
+  int m_CharLoadingDepth;
 };
 
 #endif  // CORE_FPDFAPI_FPDF_FONT_CPDF_TYPE3FONT_H_