Fix infinite loop for objects that reference themselves.

core/src/fpdfapi/fpdf_parser/fpdf_parser_objects.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "../../../include/fpdfapi/fpdf_parser.h"
 #include "../../../include/fxcrt/fx_string.h"
 
 // static
@@ skipping 116 matching lines @@
       CPDF_Object* pObj =
           pRef->m_pObjList->GetIndirectObject(pRef->m_RefObjNum, &context);
       if (pObj == NULL) {
         return 0;
       }
       return pObj->GetInteger();
     }
   }
   return 0;
 }
+
 CPDF_Dictionary* CPDF_Object::GetDict() const {
   switch (m_Type) {
     case PDFOBJ_DICTIONARY:
       return (CPDF_Dictionary*)this;
     case PDFOBJ_STREAM:
       return ((CPDF_Stream*)this)->GetDict();
     case PDFOBJ_REFERENCE: {
       CPDF_Reference* pRef = (CPDF_Reference*)this;
-      if (pRef->m_pObjList == NULL) {
-        break;
-      }
-      CPDF_Object* pObj =
-          pRef->m_pObjList->GetIndirectObject(pRef->m_RefObjNum);
-      if (pObj == NULL) {
-        return NULL;
-      }
+      CPDF_IndirectObjects* pIndirect = pRef->GetObjList();
+      if (!pIndirect)
+        return nullptr;
+      CPDF_Object* pObj = pIndirect->GetIndirectObject(pRef->m_RefObjNum);

[jun_fang, 2015/08/21 21:44:43]

nit: call pRef->GetRefObjNum to get object number to replace pRef->m_RefObjNum.
It's the same rule as pRef->GetObjList().

[Lei Zhang, 2015/08/31 05:45:02]

Done. I made the same change everywhere in the file.

+      if (!pObj || (pObj == this))
+        return nullptr;
       return pObj->GetDict();
     }
+    default:
+      return nullptr;
   }
-  return NULL;
 }
+
 CPDF_Array* CPDF_Object::GetArray() const {
   if (m_Type == PDFOBJ_ARRAY)
     return (CPDF_Array*)this;
 
   return NULL;
 }
 void CPDF_Object::SetString(const CFX_ByteString& str) {
   ASSERT(this != NULL);
   switch (m_Type) {
     case PDFOBJ_BOOLEAN:
@@ skipping 1029 matching lines @@
   }
   pObj->m_ObjNum = objnum;
   m_IndirectObjs.SetAt((void*)(uintptr_t)objnum, pObj);
   if (m_LastObjNum < objnum) {
     m_LastObjNum = objnum;
   }
 }
 FX_DWORD CPDF_IndirectObjects::GetLastObjNum() const {
   return m_LastObjNum;
 }