Stack exhaustion if PDFium returns circular bookmarks.

pdf/pdfium/pdfium_engine.cc

Index: pdf/pdfium/pdfium_engine.cc
diff --git a/pdf/pdfium/pdfium_engine.cc b/pdf/pdfium/pdfium_engine.cc
index 369aa206b3d54ee0eec04ad5df5c28d84f2d786b..a7cfcd9085fc309ea068946998300a91b0bec0be 100644
--- a/pdf/pdfium/pdfium_engine.cc
+++ b/pdf/pdfium/pdfium_engine.cc
@@ -544,7 +544,9 @@ void FormatStringForOS(base::string16* text) {
 // child VarDictionaries (representing the child bookmarks).
 // If NULL is passed in as the bookmark then we traverse from the "root".
 // Note that the "root" bookmark contains no useful information.
-pp::VarDictionary TraverseBookmarks(FPDF_DOCUMENT doc, FPDF_BOOKMARK bookmark) {
+pp::VarDictionary TraverseBookmarks(unsigned int depth,

[Lei Zhang, 2015/10/13 20:07:56]

nit: Can depth be the last param?

+                                    FPDF_DOCUMENT doc,
+                                    FPDF_BOOKMARK bookmark) {
   pp::VarDictionary dict;
   base::string16 title;
   unsigned long buffer_size = FPDFBookmark_GetTitle(bookmark, NULL, 0);
@@ -564,12 +566,19 @@ pp::VarDictionary TraverseBookmarks(FPDF_DOCUMENT doc, FPDF_BOOKMARK bookmark) {
   }
 
   pp::VarArray children;
-  int child_index = 0;
-  for (FPDF_BOOKMARK child_bookmark = FPDFBookmark_GetFirstChild(doc, bookmark);
-      child_bookmark != NULL;
-      child_bookmark = FPDFBookmark_GetNextSibling(doc, child_bookmark)) {
-    children.Set(child_index, TraverseBookmarks(doc, child_bookmark));
-    child_index++;
+
+  // Don't trust PDFium to handle circular bookmarks.
+  const unsigned int kMaxDepth = 128;

[Lei Zhang, 2015/10/13 20:07:56]

How did we pick 128?

+  if (depth < kMaxDepth) {
+    int child_index = 0;
+    for (FPDF_BOOKMARK child_bookmark =
+             FPDFBookmark_GetFirstChild(doc, bookmark);
+         child_bookmark != NULL;
+         child_bookmark = FPDFBookmark_GetNextSibling(doc, child_bookmark)) {
+      children.Set(child_index,
+                   TraverseBookmarks(depth + 1, doc, child_bookmark));
+      child_index++;
+    }
   }
   dict.Set(pp::Var("children"), children);
   return dict;
@@ -2433,7 +2442,7 @@ int PDFiumEngine::GetNumberOfPages() {
 }
 
 pp::VarArray PDFiumEngine::GetBookmarks() {
-  pp::VarDictionary dict = TraverseBookmarks(doc_, NULL);
+  pp::VarDictionary dict = TraverseBookmarks(0, doc_, NULL);
   // The root bookmark contains no useful information.
   return pp::VarArray(dict.Get(pp::Var("children")));
 }