Fix infinite loop for objects that reference themselves.

core/src/fpdfapi/fpdf_parser/fpdf_parser_objects.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "../../../include/fpdfapi/fpdf_parser.h"
 #include "../../../include/fxcrt/fx_string.h"
 
 // static
@@ skipping 35 matching lines @@
     case PDFOBJ_STRING:
       return ((CPDF_String*)this)->m_String;
     case PDFOBJ_NAME:
       return ((CPDF_Name*)this)->m_Name;
     case PDFOBJ_REFERENCE: {
       CPDF_Reference* pRef = (CPDF_Reference*)(void*)this;
       if (pRef->m_pObjList == NULL) {
         break;
       }
       CPDF_Object* pObj =
-          pRef->m_pObjList->GetIndirectObject(pRef->m_RefObjNum);
+          pRef->m_pObjList->GetIndirectObject(pRef->GetRefObjNum());
       if (pObj == NULL) {
         return CFX_ByteString();
       }
       return pObj->GetString();
     }
   }
   return CFX_ByteString();
 }
 CFX_ByteStringC CPDF_Object::GetConstString() const {
   switch (m_Type) {
     case PDFOBJ_STRING:
       return CFX_ByteStringC((const uint8_t*)((CPDF_String*)this)->m_String,
                              ((CPDF_String*)this)->m_String.GetLength());
     case PDFOBJ_NAME:
       return CFX_ByteStringC((const uint8_t*)((CPDF_Name*)this)->m_Name,
                              ((CPDF_Name*)this)->m_Name.GetLength());
     case PDFOBJ_REFERENCE: {
       CPDF_Reference* pRef = (CPDF_Reference*)(void*)this;
       if (pRef->m_pObjList == NULL) {
         break;
       }
       CPDF_Object* pObj =
-          pRef->m_pObjList->GetIndirectObject(pRef->m_RefObjNum);
+          pRef->m_pObjList->GetIndirectObject(pRef->GetRefObjNum());
       if (pObj == NULL) {
         return CFX_ByteStringC();
       }
       return pObj->GetConstString();
     }
   }
   return CFX_ByteStringC();
 }
 FX_FLOAT CPDF_Object::GetNumber() const {
   switch (m_Type) {
     case PDFOBJ_NUMBER:
       return ((CPDF_Number*)this)->GetNumber();
     case PDFOBJ_REFERENCE: {
       CPDF_Reference* pRef = (CPDF_Reference*)(void*)this;
       if (pRef->m_pObjList == NULL) {
         break;
       }
       CPDF_Object* pObj =
-          pRef->m_pObjList->GetIndirectObject(pRef->m_RefObjNum);
+          pRef->m_pObjList->GetIndirectObject(pRef->GetRefObjNum());
       if (pObj == NULL) {
         return 0;
       }
       return pObj->GetNumber();
     }
   }
   return 0;
 }
 FX_FLOAT CPDF_Object::GetNumber16() const {
   return GetNumber();
 }
 int CPDF_Object::GetInteger() const {
   CFX_AutoRestorer<int> restorer(&s_nCurRefDepth);
   if (++s_nCurRefDepth > OBJECT_REF_MAX_DEPTH) {
     return 0;
   }
   switch (m_Type) {
     case PDFOBJ_BOOLEAN:
       return ((CPDF_Boolean*)this)->m_bValue;
     case PDFOBJ_NUMBER:
       return ((CPDF_Number*)this)->GetInteger();
     case PDFOBJ_REFERENCE: {
       CPDF_Reference* pRef = (CPDF_Reference*)(void*)this;
       PARSE_CONTEXT context;
       FXSYS_memset(&context, 0, sizeof(PARSE_CONTEXT));
       if (pRef->m_pObjList == NULL) {
         return 0;
       }
       CPDF_Object* pObj =
-          pRef->m_pObjList->GetIndirectObject(pRef->m_RefObjNum, &context);
+          pRef->m_pObjList->GetIndirectObject(pRef->GetRefObjNum(), &context);
       if (pObj == NULL) {
         return 0;
       }
       return pObj->GetInteger();
     }
   }
   return 0;
 }
+
 CPDF_Dictionary* CPDF_Object::GetDict() const {
   switch (m_Type) {
     case PDFOBJ_DICTIONARY:
       return (CPDF_Dictionary*)this;
     case PDFOBJ_STREAM:
       return ((CPDF_Stream*)this)->GetDict();
     case PDFOBJ_REFERENCE: {
       CPDF_Reference* pRef = (CPDF_Reference*)this;
-      if (pRef->m_pObjList == NULL) {
-        break;
-      }
-      CPDF_Object* pObj =
-          pRef->m_pObjList->GetIndirectObject(pRef->m_RefObjNum);
-      if (pObj == NULL) {
-        return NULL;
-      }
+      CPDF_IndirectObjects* pIndirect = pRef->GetObjList();
+      if (!pIndirect)
+        return nullptr;
+      CPDF_Object* pObj = pIndirect->GetIndirectObject(pRef->GetRefObjNum());
+      if (!pObj || (pObj == this))
+        return nullptr;
       return pObj->GetDict();
     }
+    default:
+      return nullptr;
   }
-  return NULL;
 }
+
 CPDF_Array* CPDF_Object::GetArray() const {
   if (m_Type == PDFOBJ_ARRAY)
     return (CPDF_Array*)this;
 
   return NULL;
 }
 void CPDF_Object::SetString(const CFX_ByteString& str) {
   ASSERT(this != NULL);
   switch (m_Type) {
     case PDFOBJ_BOOLEAN:
       ((CPDF_Boolean*)this)->m_bValue = str == FX_BSTRC("true") ? 1 : 0;
       return;
     case PDFOBJ_NUMBER:
       ((CPDF_Number*)this)->SetString(str);
       return;
     case PDFOBJ_STRING:
       ((CPDF_String*)this)->m_String = str;
       return;
     case PDFOBJ_NAME:
       ((CPDF_Name*)this)->m_Name = str;
       return;
   }
   ASSERT(FALSE);
 }
 int CPDF_Object::GetDirectType() const {
   if (m_Type != PDFOBJ_REFERENCE) {
     return m_Type;
   }
   CPDF_Reference* pRef = (CPDF_Reference*)this;
-  return pRef->m_pObjList->GetIndirectType(pRef->m_RefObjNum);
+  return pRef->m_pObjList->GetIndirectType(pRef->GetRefObjNum());
 }
 FX_BOOL CPDF_Object::IsIdentical(CPDF_Object* pOther) const {
   if (this == pOther) {
     return TRUE;
   }
   if (pOther == NULL) {
     return FALSE;
   }
   if (pOther->m_Type != m_Type) {
     if (m_Type == PDFOBJ_REFERENCE && GetDirect()) {
@@ skipping 27 matching lines @@
   return FALSE;
 }
 CPDF_Object* CPDF_Object::GetDirect() const {
   if (m_Type != PDFOBJ_REFERENCE) {
     return (CPDF_Object*)this;
   }
   CPDF_Reference* pRef = (CPDF_Reference*)(void*)this;
   if (pRef->m_pObjList == NULL) {
     return NULL;
   }
-  return pRef->m_pObjList->GetIndirectObject(pRef->m_RefObjNum);
+  return pRef->m_pObjList->GetIndirectObject(pRef->GetRefObjNum());
 }
 CPDF_Object* CPDF_Object::Clone(FX_BOOL bDirect) const {
   CFX_MapPtrToPtr visited;
   return CloneInternal(bDirect, &visited);
 }
 CPDF_Object* CPDF_Object::CloneInternal(FX_BOOL bDirect,
                                         CFX_MapPtrToPtr* visited) const {
   switch (m_Type) {
     case PDFOBJ_BOOLEAN:
       return new CPDF_Boolean(((CPDF_Boolean*)this)->m_bValue);
@@ skipping 36 matching lines @@
       acc.LoadAllData(pThis, TRUE);
       FX_DWORD streamSize = acc.GetSize();
       CPDF_Dictionary* pDict = pThis->GetDict();
       if (pDict)
         pDict = (CPDF_Dictionary*)((CPDF_Object*)pDict)
                     ->CloneInternal(bDirect, visited);
       return new CPDF_Stream(acc.DetachData(), streamSize, pDict);
     }
     case PDFOBJ_REFERENCE: {
       CPDF_Reference* pRef = (CPDF_Reference*)this;
-      FX_DWORD obj_num = pRef->m_RefObjNum;
+      FX_DWORD obj_num = pRef->GetRefObjNum();
       if (bDirect && !visited->GetValueAt((void*)(uintptr_t)obj_num)) {
         visited->SetAt((void*)(uintptr_t)obj_num, (void*)1);
         if (!pRef->GetDirect())
           return nullptr;
 
         return pRef->GetDirect()->CloneInternal(TRUE, visited);
       }
       return new CPDF_Reference(pRef->m_pObjList, obj_num);
     }
   }
@@ skipping 894 matching lines @@
   }
   pObj->m_ObjNum = objnum;
   m_IndirectObjs.SetAt((void*)(uintptr_t)objnum, pObj);
   if (m_LastObjNum < objnum) {
     m_LastObjNum = objnum;
   }
 }
 FX_DWORD CPDF_IndirectObjects::GetLastObjNum() const {
   return m_LastObjNum;
 }