From 6bebd2e3cfb7790580722836d0debab3103c94d0 Mon Sep 17 00:00:00 2001 From: Henrique Nakashima Date: Wed, 11 Apr 2018 00:13:36 +0000 Subject: Avoid stack overflow when loading CPDF_Function. CPDF_StitchFuncs that reference each other create a Load() loop. Maintaining a set of the visited CPDF_Objects during a Load() call tree prevents that. Bug: chromium:830221 Change-Id: I6f494da16c6d79f05870ff85cff38ff8fe69ecfe Reviewed-on: https://pdfium-review.googlesource.com/30050 Commit-Queue: dsinclair Reviewed-by: dsinclair --- core/fpdfapi/page/cpdf_stitchfunc.cpp | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) (limited to 'core/fpdfapi/page/cpdf_stitchfunc.cpp') diff --git a/core/fpdfapi/page/cpdf_stitchfunc.cpp b/core/fpdfapi/page/cpdf_stitchfunc.cpp index 336c74bf5c..fd83fd651a 100644 --- a/core/fpdfapi/page/cpdf_stitchfunc.cpp +++ b/core/fpdfapi/page/cpdf_stitchfunc.cpp @@ -22,7 +22,8 @@ CPDF_StitchFunc::~CPDF_StitchFunc() { FX_Free(m_pEncode); } -bool CPDF_StitchFunc::v_Init(CPDF_Object* pObj) { +bool CPDF_StitchFunc::v_Init(CPDF_Object* pObj, + std::set* pVisited) { CPDF_Dictionary* pDict = pObj->GetDict(); if (!pDict) { return false; @@ -42,7 +43,7 @@ bool CPDF_StitchFunc::v_Init(CPDF_Object* pObj) { CPDF_Object* pSub = pArray->GetDirectObjectAt(i); if (pSub == pObj) return false; - std::unique_ptr pFunc(CPDF_Function::Load(pSub)); + std::unique_ptr pFunc(CPDF_Function::Load(pSub, pVisited)); if (!pFunc) return false; // Check that the input dimensionality is 1, and that all output -- cgit v1.2.3