Fix an infinite loop in CPDF_Parser::RebuildCrossRef().

core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "parser_int.h"
 
+#include <algorithm>
 #include <memory>
 #include <set>
 #include <utility>
 #include <vector>
 
 #include "core/include/fpdfapi/fpdf_module.h"
 #include "core/include/fpdfapi/fpdf_page.h"
 #include "core/include/fpdfapi/fpdf_parser.h"
 #include "core/include/fxcrt/fx_ext.h"
 #include "core/include/fxcrt/fx_safe_types.h"
@@ skipping 593 matching lines @@
   m_ObjectInfo.clear();
   m_V5Type.RemoveAll();
   m_SortedOffset.RemoveAll();
   m_ObjVersion.RemoveAll();
   if (m_pTrailer) {
     m_pTrailer->Release();
     m_pTrailer = NULL;
   }
   int32_t status = 0;
   int32_t inside_index = 0;
-  FX_DWORD objnum = 0, gennum = 0;
+  FX_DWORD objnum = 0;
+  FX_DWORD gennum = 0;
   int32_t depth = 0;
-  uint8_t* buffer = FX_Alloc(uint8_t, 4096);
+  const FX_DWORD kBufferSize = 4096;
+  std::vector<uint8_t> buffer(kBufferSize);
   FX_FILESIZE pos = m_Syntax.m_HeaderOffset;
-  FX_FILESIZE start_pos = 0, start_pos1 = 0;
-  FX_FILESIZE last_obj = -1, last_xref = -1, last_trailer = -1;
+  FX_FILESIZE start_pos = 0;
+  FX_FILESIZE start_pos1 = 0;
+  FX_FILESIZE last_obj = -1;
+  FX_FILESIZE last_xref = -1;
+  FX_FILESIZE last_trailer = -1;
   while (pos < m_Syntax.m_FileLen) {
-    FX_BOOL bOverFlow = FALSE;
-    FX_DWORD size = (FX_DWORD)(m_Syntax.m_FileLen - pos);
-    if (size > 4096) {
-      size = 4096;
-    }
-    if (!m_Syntax.m_pFileAccess->ReadBlock(buffer, pos, size)) {
+    const FX_FILESIZE saved_pos = pos;
+    bool bOverFlow = false;
+    FX_DWORD size = std::min((FX_DWORD)(m_Syntax.m_FileLen - pos), kBufferSize);
+    if (!m_Syntax.m_pFileAccess->ReadBlock(buffer.data(), pos, size))
       break;
-    }
+
     for (FX_DWORD i = 0; i < size; i++) {
       uint8_t byte = buffer[i];
       switch (status) {
         case 0:
           if (PDFCharIsWhitespace(byte))
             status = 1;
 
           if (std::isdigit(byte)) {
             --i;
             status = 1;
@@ skipping 153 matching lines @@
                 m_Syntax.RestorePos(obj_pos);
                 offset = m_Syntax.FindTag("obj", 0);
                 if (offset == -1) {
                   offset = 0;
                 } else {
                   offset += 3;
                 }
                 FX_FILESIZE nLen = obj_end - obj_pos - offset;
                 if ((FX_DWORD)nLen > size - i) {
                   pos = obj_end + m_Syntax.m_HeaderOffset;
-                  bOverFlow = TRUE;
+                  bOverFlow = true;
                 } else {
                   i += (FX_DWORD)nLen;
                 }
                 if (!m_ObjectInfo.empty() && IsValidObjectNumber(objnum) &&
                     m_ObjectInfo[objnum].pos) {
                   if (pObject) {
                     FX_DWORD oldgen = m_ObjVersion.GetAt(objnum);
                     m_ObjectInfo[objnum].pos = obj_pos;
                     m_ObjVersion.SetAt(objnum, (int16_t)gennum);
                     if (oldgen != gennum) {
@@ skipping 26 matching lines @@
                 } else {
                   CPDF_Stream* pStream = pObj->AsStream();
                   if (CPDF_Dictionary* pTrailer =
                           pStream ? pStream->GetDict() : pObj->AsDictionary()) {
                     if (m_pTrailer) {
                       CPDF_Object* pRoot = pTrailer->GetElement("Root");
                       CPDF_Reference* pRef = ToReference(pRoot);
                       if (!pRoot ||
                           (pRef && IsValidObjectNumber(pRef->GetRefObjNum()) &&
                            m_ObjectInfo[pRef->GetRefObjNum()].pos != 0)) {
-                        FX_POSITION pos = pTrailer->GetStartPos();
-                        while (pos) {
+                        FX_POSITION trailer_pos = pTrailer->GetStartPos();
+                        while (trailer_pos) {
                           CFX_ByteString key;
                           CPDF_Object* pElement =
-                              pTrailer->GetNextElement(pos, key);
+                              pTrailer->GetNextElement(trailer_pos, key);
                           FX_DWORD dwObjNum =
                               pElement ? pElement->GetObjNum() : 0;
                           if (dwObjNum) {
                             m_pTrailer->SetAtReference(key, m_pDocument,
                                                        dwObjNum);
                           } else {
                             m_pTrailer->SetAt(key, pElement->Clone());
                           }
                         }
                         pObj->Release();
@@ skipping 86 matching lines @@
             inside_index++;
           }
           break;
       }
       if (bOverFlow) {
         size = 0;
         break;
       }
     }
     pos += size;
+
+    // If the position has not changed at all in a loop iteration, then break
+    // out to prevent infinite looping.
+    if (pos == saved_pos)
+      break;
   }
   if (last_xref != -1 && last_xref > last_obj) {
     last_trailer = last_xref;
   } else if (last_trailer == -1 || last_xref < last_obj) {
     last_trailer = m_Syntax.m_FileLen;
   }
   FX_FILESIZE offset = last_trailer - m_Syntax.m_HeaderOffset;
   void* pResult =
       FXSYS_bsearch(&offset, m_SortedOffset.GetData(), m_SortedOffset.GetSize(),
                     sizeof(FX_FILESIZE), CompareFileSize);
   if (!pResult) {
     m_SortedOffset.Add(offset);
   }
-  FX_Free(buffer);
   return m_pTrailer && !m_ObjectInfo.empty();
 }
 
 FX_BOOL CPDF_Parser::LoadCrossRefV5(FX_FILESIZE* pos, FX_BOOL bMainXRef) {
   CPDF_Object* pObject = ParseIndirectObjectAt(m_pDocument, *pos, 0, nullptr);
   if (!pObject)
     return FALSE;
   if (m_pDocument) {
     FX_BOOL bInserted = FALSE;
     CPDF_Dictionary* pDict = m_pDocument->GetRoot();
@@ skipping 3997 matching lines @@
   if (!m_pLinearizedDict)
     return -1;
   CPDF_Array* pRange = m_pLinearizedDict->GetArray("H");
   if (!pRange)
     return -1;
   CPDF_Object* pStreamLen = pRange->GetElementValue(1);
   if (!pStreamLen)
     return -1;
   return pStreamLen->GetInteger();
 }