From 4eeef1d776ce7368063f9a7698cfa736821d4186 Mon Sep 17 00:00:00 2001 From: JUN FANG Date: Thu, 23 Apr 2015 10:12:19 -0700 Subject: Fix segmentation fault 'denial of service condition' BUG=467392 R=thestig@chromium.org, tsepez@chromium.org Review URL: https://codereview.chromium.org/1064713008 --- core/src/fpdfapi/fpdf_parser/fpdf_parser_objects.cpp | 7 +++++++ 1 file changed, 7 insertions(+) (limited to 'core/src/fpdfapi/fpdf_parser/fpdf_parser_objects.cpp') diff --git a/core/src/fpdfapi/fpdf_parser/fpdf_parser_objects.cpp b/core/src/fpdfapi/fpdf_parser/fpdf_parser_objects.cpp index db3d382a1f..912af297f5 100644 --- a/core/src/fpdfapi/fpdf_parser/fpdf_parser_objects.cpp +++ b/core/src/fpdfapi/fpdf_parser/fpdf_parser_objects.cpp @@ -7,6 +7,9 @@ #include "../../../include/fpdfapi/fpdf_parser.h" #include "../../../include/fxcrt/fx_string.h" +//static +int CPDF_Object::s_nCurRefDepth = 0; + void CPDF_Object::Release() { if (m_ObjNum) { @@ -107,6 +110,10 @@ FX_FLOAT CPDF_Object::GetNumber16() const } int CPDF_Object::GetInteger() const { + CFX_AutoRestorer restorer(&s_nCurRefDepth); + if (++s_nCurRefDepth > OBJECT_REF_MAX_DEPTH) { + return 0; + } switch (m_Type) { case PDFOBJ_BOOLEAN: return ((CPDF_Boolean*)this)->m_bValue; -- cgit v1.2.3