From 671f0d4949d412f26fba6c675cfb54b1fc170be0 Mon Sep 17 00:00:00 2001 From: Lei Zhang Date: Thu, 31 Aug 2017 11:00:54 -0700 Subject: Prevent FPDFAvail_IsDocAvail() from infinite looping. BUG=pdfium:875 Change-Id: I3cc29990f0a3398ae903bc14417ec695cca30c6c Reviewed-on: https://pdfium-review.googlesource.com/12391 Commit-Queue: Lei Zhang Reviewed-by: Art Snake Reviewed-by: Wei Li --- core/fpdfapi/parser/cpdf_data_avail.cpp | 3 ++- core/fpdfapi/parser/cpdf_data_avail.h | 1 + fpdfsdk/fpdfview_embeddertest.cpp | 7 +++++++ 3 files changed, 10 insertions(+), 1 deletion(-) diff --git a/core/fpdfapi/parser/cpdf_data_avail.cpp b/core/fpdfapi/parser/cpdf_data_avail.cpp index 76190fa9a9..b7ea238507 100644 --- a/core/fpdfapi/parser/cpdf_data_avail.cpp +++ b/core/fpdfapi/parser/cpdf_data_avail.cpp @@ -943,8 +943,9 @@ bool CPDF_DataAvail::CheckTrailer() { return true; } + // Prevent infinite-looping between Prev entries. uint32_t xrefpos = GetDirectInteger(pTrailerDict, "Prev"); - if (!xrefpos) { + if (!xrefpos || !m_SeenPrevPositions.insert(xrefpos).second) { m_dwPrevXRefOffset = 0; m_docStatus = PDF_DATAAVAIL_LOADALLCROSSREF; return true; diff --git a/core/fpdfapi/parser/cpdf_data_avail.h b/core/fpdfapi/parser/cpdf_data_avail.h index 1fcdaf034e..e2a4a20aa1 100644 --- a/core/fpdfapi/parser/cpdf_data_avail.h +++ b/core/fpdfapi/parser/cpdf_data_avail.h @@ -230,6 +230,7 @@ class CPDF_DataAvail final { PageNode m_PageNode; std::set m_pageMapCheckState; std::set m_pagesLoadState; + std::set m_SeenPrevPositions; std::unique_ptr m_pHintTables; bool m_bSupportHintTable; }; diff --git a/fpdfsdk/fpdfview_embeddertest.cpp b/fpdfsdk/fpdfview_embeddertest.cpp index 0e478b448f..8576104c2e 100644 --- a/fpdfsdk/fpdfview_embeddertest.cpp +++ b/fpdfsdk/fpdfview_embeddertest.cpp @@ -318,6 +318,13 @@ TEST_F(FPDFViewEmbeddertest, Hang_298) { // reference loop. Cross references will be rebuilt successfully. TEST_F(FPDFViewEmbeddertest, CrossRefV4Loop) { EXPECT_TRUE(OpenDocument("bug_xrefv4_loop.pdf")); + + // Make sure calling FPDFAvail_IsDocAvail() on this file does not infinite + // loop either. See bug 875. + int ret = PDF_DATA_NOTAVAIL; + while (ret == PDF_DATA_NOTAVAIL) + ret = FPDFAvail_IsDocAvail(avail_, &hints_); + EXPECT_EQ(PDF_DATA_AVAIL, ret); } // The test should pass when circular references to ParseIndirectObject will not -- cgit v1.2.3