Fix infinite loop caused by parsing same indirect objects

core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "core/include/fpdfapi/fpdf_parser.h"
 
 #include <algorithm>
 #include <memory>
@@ skipping 18 matching lines @@
 // A limit on the maximum object number in the xref table. Theoretical limits
 // are higher, but this may be large enough in practice.
 const FX_DWORD kMaxObjectNumber = 1048576;
 
 struct SearchTagRecord {
   const char* m_pTag;
   FX_DWORD m_Len;
   FX_DWORD m_Offset;
 };
 
+template <typename T>
+class ScopedSetInsertion {
+ public:
+  ScopedSetInsertion(std::set<T>* org_set, T elem)
+      : m_Set(org_set), m_Entry(elem) {
+    m_Set->insert(m_Entry);
+  }
+  ~ScopedSetInsertion() { m_Set->erase(m_Entry); }
+
+ private:
+  std::set<T>* const m_Set;
+  const T m_Entry;
+};
+
 int CompareFileSize(const void* p1, const void* p2) {
   return *(FX_FILESIZE*)p1 - *(FX_FILESIZE*)p2;
 }
 
 int32_t GetHeaderOffset(IFX_FileRead* pFile) {
   const FX_DWORD tag = FXDWORD_FROM_LSBFIRST(0x46445025);
   const size_t kBufSize = 4;
   uint8_t buf[kBufSize];
   int32_t offset = 0;
   while (offset <= 1024) {
@@ skipping 1135 matching lines @@
   m_Syntax.RestorePos(SavedPos);
   return TRUE;
 }
 
 CPDF_Object* CPDF_Parser::ParseIndirectObject(CPDF_IndirectObjects* pObjList,
                                               FX_DWORD objnum,
                                               PARSE_CONTEXT* pContext) {
   if (!IsValidObjectNumber(objnum))
     return nullptr;
 
+  // Prevent circular parsing the same object.
+  if (pdfium::ContainsKey(m_ParsingObjNums, objnum))
+    return nullptr;
+  ScopedSetInsertion<FX_DWORD> local_insert(&m_ParsingObjNums, objnum);
+
   if (m_V5Type[objnum] == 1 || m_V5Type[objnum] == 255) {
     FX_FILESIZE pos = m_ObjectInfo[objnum].pos;
     if (pos <= 0)
       return nullptr;
     return ParseIndirectObjectAt(pObjList, pos, objnum, pContext);
   }
   if (m_V5Type[objnum] != 2)
     return nullptr;
 
   CPDF_StreamAcc* pObjStream = GetObjectStream(m_ObjectInfo[objnum].pos);
@@ skipping 3765 matching lines @@
   if (!m_pLinearizedDict)
     return -1;
   CPDF_Array* pRange = m_pLinearizedDict->GetArray("H");
   if (!pRange)
     return -1;
   CPDF_Object* pStreamLen = pRange->GetElementValue(1);
   if (!pStreamLen)
     return -1;
   return pStreamLen->GetInteger();
 }