1 files changed, 21 insertions, 17 deletions

diff --git a/core/fpdfdoc/cpdf_nametree.cpp b/core/fpdfdoc/cpdf_nametree.cpp
index a47078331d..631571c9e4 100644
--- a/core/fpdfdoc/cpdf_nametree.cpp
+++ b/core/fpdfdoc/cpdf_nametree.cpp
@@ -155,8 +155,8 @@ bool UpdateNodesAndLimitsUponDeletion(CPDF_Dictionary* pNode,
 // will be the index that it should be added at.
 CPDF_Object* SearchNameNodeByName(const CPDF_Dictionary* pNode,
                                   const WideString& csName,
-                                  size_t& nIndex,
                                   int nLevel,
+                                  size_t* nIndex,
                                   CPDF_Array** ppFind,
                                   int* pFindIndex) {
   if (nLevel > nMaxRecursion)
@@ -199,10 +199,10 @@ CPDF_Object* SearchNameNodeByName(const CPDF_Dictionary* pNode,
       if (iCompare < 0)
         continue;
 
-      nIndex += i;
+      *nIndex += i;
       return pNames->GetDirectObjectAt(i * 2 + 1);
     }
-    nIndex += dwCount;
+    *nIndex += dwCount;
     return nullptr;
   }
 
@@ -216,7 +216,7 @@ CPDF_Object* SearchNameNodeByName(const CPDF_Dictionary* pNode,
     if (!pKid)
       continue;
 
-    CPDF_Object* pFound = SearchNameNodeByName(pKid, csName, nIndex, nLevel + 1,
+    CPDF_Object* pFound = SearchNameNodeByName(pKid, csName, nLevel + 1, nIndex,
                                                ppFind, pFindIndex);
     if (pFound)
       return pFound;
@@ -230,8 +230,8 @@ CPDF_Object* SearchNameNodeByName(const CPDF_Dictionary* pNode,
 // index of the pair in |pFind|.
 CPDF_Object* SearchNameNodeByIndex(const CPDF_Dictionary* pNode,
                                    size_t nIndex,
-                                   size_t& nCurIndex,
                                    int nLevel,
+                                   size_t* nCurIndex,
                                    WideString* csName,
                                    CPDF_Array** ppFind,
                                    int* pFindIndex) {
@@ -241,17 +241,17 @@ CPDF_Object* SearchNameNodeByIndex(const CPDF_Dictionary* pNode,
   CPDF_Array* pNames = pNode->GetArrayFor("Names");
   if (pNames) {
     size_t nCount = pNames->GetCount() / 2;
-    if (nIndex >= nCurIndex + nCount) {
-      nCurIndex += nCount;
+    if (nIndex >= *nCurIndex + nCount) {
+      *nCurIndex += nCount;
       return nullptr;
     }
     if (ppFind)
       *ppFind = pNames;
     if (pFindIndex)
-      *pFindIndex = nIndex - nCurIndex;
+      *pFindIndex = nIndex - *nCurIndex;
 
-    *csName = pNames->GetUnicodeTextAt((nIndex - nCurIndex) * 2);
-    return pNames->GetDirectObjectAt((nIndex - nCurIndex) * 2 + 1);
+    *csName = pNames->GetUnicodeTextAt((nIndex - *nCurIndex) * 2);
+    return pNames->GetDirectObjectAt((nIndex - *nCurIndex) * 2 + 1);
   }
 
   CPDF_Array* pKids = pNode->GetArrayFor("Kids");
@@ -263,7 +263,7 @@ CPDF_Object* SearchNameNodeByIndex(const CPDF_Dictionary* pNode,
     if (!pKid)
       continue;
     CPDF_Object* pFound = SearchNameNodeByIndex(
-        pKid, nIndex, nCurIndex, nLevel + 1, csName, ppFind, pFindIndex);
+        pKid, nIndex, nLevel + 1, nCurIndex, csName, ppFind, pFindIndex);
     if (pFound)
       return pFound;
   }
@@ -323,8 +323,10 @@ int CPDF_NameTree::GetIndex(const WideString& csName) const {
     return -1;
 
   size_t nIndex = 0;
-  if (!SearchNameNodeByName(m_pRoot.Get(), csName, nIndex, 0, nullptr, nullptr))
+  if (!SearchNameNodeByName(m_pRoot.Get(), csName, 0, &nIndex, nullptr,
+                            nullptr)) {
     return -1;
+  }
   return nIndex;
 }
 
@@ -337,8 +339,10 @@ bool CPDF_NameTree::AddValueAndName(std::unique_ptr<CPDF_Object> pObj,
   CPDF_Array* pFind = nullptr;
   int nFindIndex = -1;
   // Fail if the tree already contains this name or if the tree is too deep.
-  if (SearchNameNodeByName(m_pRoot.Get(), name, nIndex, 0, &pFind, &nFindIndex))
+  if (SearchNameNodeByName(m_pRoot.Get(), name, 0, &nIndex, &pFind,
+                           &nFindIndex)) {
     return false;
+  }
 
   // If the returned |pFind| is a nullptr, then |name| is smaller than all
   // existing entries in the tree, and we did not find a leaf array to place
@@ -347,7 +351,7 @@ bool CPDF_NameTree::AddValueAndName(std::unique_ptr<CPDF_Object> pObj,
   if (!pFind) {
     size_t nCurIndex = 0;
     WideString csName;
-    SearchNameNodeByIndex(m_pRoot.Get(), 0, nCurIndex, 0, &csName, &pFind,
+    SearchNameNodeByIndex(m_pRoot.Get(), 0, 0, &nCurIndex, &csName, &pFind,
                           nullptr);
   }
   ASSERT(pFind);
@@ -385,7 +389,7 @@ bool CPDF_NameTree::DeleteValueAndName(int nIndex) {
   CPDF_Array* pFind = nullptr;
   int nFindIndex = -1;
   // Fail if the tree does not contain |nIndex|.
-  if (!SearchNameNodeByIndex(m_pRoot.Get(), nIndex, nCurIndex, 0, &csName,
+  if (!SearchNameNodeByIndex(m_pRoot.Get(), nIndex, 0, &nCurIndex, &csName,
                              &pFind, &nFindIndex)) {
     return false;
   }
@@ -406,7 +410,7 @@ CPDF_Object* CPDF_NameTree::LookupValueAndName(int nIndex,
     return nullptr;
 
   size_t nCurIndex = 0;
-  return SearchNameNodeByIndex(m_pRoot.Get(), nIndex, nCurIndex, 0, csName,
+  return SearchNameNodeByIndex(m_pRoot.Get(), nIndex, 0, &nCurIndex, csName,
                                nullptr, nullptr);
 }
 
@@ -415,7 +419,7 @@ CPDF_Object* CPDF_NameTree::LookupValue(const WideString& csName) const {
     return nullptr;
 
   size_t nIndex = 0;
-  return SearchNameNodeByName(m_pRoot.Get(), csName, nIndex, 0, nullptr,
+  return SearchNameNodeByName(m_pRoot.Get(), csName, 0, &nIndex, nullptr,
                               nullptr);
 }