Fix infinite loop caused by parsing same indirect objects

core/include/fpdfapi/fpdf_parser.h

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #ifndef CORE_INCLUDE_FPDFAPI_FPDF_PARSER_H_
 #define CORE_INCLUDE_FPDFAPI_FPDF_PARSER_H_
 
 #include <map>
 #include <memory>
+#include <set>
 
 #include "core/include/fpdfapi/fpdf_objects.h"
 #include "core/include/fxcrt/fx_system.h"
 
 class CFX_Font;
 class CFX_Matrix;
 class CPDF_ColorSpace;
 class CPDF_CryptoHandler;
 class CPDF_DocPageData;
 class CPDF_DocRenderData;
@@ skipping 335 matching lines @@
   FX_FILESIZE m_DataEnd;
 };
 
 #define PDFPARSE_ERROR_SUCCESS 0
 #define PDFPARSE_ERROR_FILE 1
 #define PDFPARSE_ERROR_FORMAT 2
 #define PDFPARSE_ERROR_PASSWORD 3
 #define PDFPARSE_ERROR_HANDLER 4
 #define PDFPARSE_ERROR_CERT 5
 
+template <typename T>
+class ScopedSetInsertion {

[Lei Zhang, 2016/01/08 20:27:07]

Move this to fpdf_parser_parser.cpp's anonymous namespace since it's only used
there... for now?

[Wei Li, 2016/01/08 22:01:50]

Done.

+ public:
+  ScopedSetInsertion(std::set<T>* org_set, T elem) {
+    org_set->insert(elem);
+    set = org_set;

[Lei Zhang, 2016/01/08 20:27:07]

Put these in the initializer list instead?

[Wei Li, 2016/01/08 22:01:50]

Done.

+    entry = elem;
+  }
+  ~ScopedSetInsertion() { set->erase(entry); }
+
+ private:
+  std::set<T>* set;

[Lei Zhang, 2016/01/08 20:27:07]

std::set<T>* const m_set;

[Lei Zhang, 2016/01/08 20:27:07]

m_set / m_entry

[Wei Li, 2016/01/08 22:01:50]

Done.

[Wei Li, 2016/01/08 22:01:50]

Done.

+  T entry;
+};
+
 class CPDF_Parser {
  public:
   CPDF_Parser();
   ~CPDF_Parser();
 
   FX_DWORD StartParse(IFX_FileRead* pFile,
                       FX_BOOL bReParse = FALSE,
                       FX_BOOL bOwnFileRead = TRUE);
 
   void CloseParser(FX_BOOL bReParse = FALSE);
@@ skipping 152 matching lines @@
   CFX_MapPtrToPtr m_ObjectStreamMap;
 
   // Mapping of object numbers to offsets. The offsets are relative to the first
   // object in the stream.
   using StreamObjectCache = std::map<FX_DWORD, FX_DWORD>;
 
   // Mapping of streams to their object caches. This is valid as long as the
   // streams in |m_ObjectStreamMap| are valid.
   std::map<CPDF_StreamAcc*, StreamObjectCache> m_ObjCache;
 
+  // All indirect object numbers that are being parsed.
+  std::set<FX_DWORD> objnums_in_processing;

[Lei Zhang, 2016/01/08 20:27:07]

Also m_SomeThing.

[Wei Li, 2016/01/08 22:01:50]

Done.

+
   friend class CPDF_Creator;
   friend class CPDF_DataAvail;
 };
 
 #define FXCIPHER_NONE 0
 #define FXCIPHER_RC4 1
 #define FXCIPHER_AES 2
 #define FXCIPHER_AES2 3
 class CPDF_SecurityHandler {
  public:
@@ skipping 426 matching lines @@
                        FX_DWORD src_size,
                        const CPDF_Dictionary* pDict,
                        uint8_t*& dest_buf,
                        FX_DWORD& dest_size,
                        CFX_ByteString& ImageEncoding,
                        CPDF_Dictionary*& pImageParms,
                        FX_DWORD estimated_size,
                        FX_BOOL bImageAcc);
 
 #endif  // CORE_INCLUDE_FPDFAPI_FPDF_PARSER_H_