Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(294)

Side by Side Diff: core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp

Issue 1569343002: Fix infinite loop caused by parsing same indirect objects (Closed) Base URL: https://pdfium.googlesource.com/pdfium.git@master
Patch Set: Created 4 years, 11 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
OLDNEW
1 // Copyright 2014 PDFium Authors. All rights reserved. 1 // Copyright 2014 PDFium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be 2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file. 3 // found in the LICENSE file.
4 4
5 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com 5 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
6 6
7 #include "core/include/fpdfapi/fpdf_parser.h" 7 #include "core/include/fpdfapi/fpdf_parser.h"
8 8
9 #include <algorithm> 9 #include <algorithm>
10 #include <memory> 10 #include <memory>
(...skipping 1173 matching lines...) Expand 10 before | Expand all | Expand 10 after
1184 m_Syntax.RestorePos(SavedPos); 1184 m_Syntax.RestorePos(SavedPos);
1185 return TRUE; 1185 return TRUE;
1186 } 1186 }
1187 1187
1188 CPDF_Object* CPDF_Parser::ParseIndirectObject(CPDF_IndirectObjects* pObjList, 1188 CPDF_Object* CPDF_Parser::ParseIndirectObject(CPDF_IndirectObjects* pObjList,
1189 FX_DWORD objnum, 1189 FX_DWORD objnum,
1190 PARSE_CONTEXT* pContext) { 1190 PARSE_CONTEXT* pContext) {
1191 if (!IsValidObjectNumber(objnum)) 1191 if (!IsValidObjectNumber(objnum))
1192 return nullptr; 1192 return nullptr;
1193 1193
1194 // Prevent circular parsing the same object.
1195 if (pdfium::ContainsKey(objnums_in_processing, objnum))
1196 return nullptr;
1197 ScopedSetInsertion<FX_DWORD> local_insert(&objnums_in_processing, objnum);
1198
1194 if (m_V5Type[objnum] == 1 || m_V5Type[objnum] == 255) { 1199 if (m_V5Type[objnum] == 1 || m_V5Type[objnum] == 255) {
1195 FX_FILESIZE pos = m_ObjectInfo[objnum].pos; 1200 FX_FILESIZE pos = m_ObjectInfo[objnum].pos;
1196 if (pos <= 0) 1201 if (pos <= 0)
1197 return nullptr; 1202 return nullptr;
1198 return ParseIndirectObjectAt(pObjList, pos, objnum, pContext); 1203 return ParseIndirectObjectAt(pObjList, pos, objnum, pContext);
1199 } 1204 }
1200 if (m_V5Type[objnum] != 2) 1205 if (m_V5Type[objnum] != 2)
1201 return nullptr; 1206 return nullptr;
1202 1207
1203 CPDF_StreamAcc* pObjStream = GetObjectStream(m_ObjectInfo[objnum].pos); 1208 CPDF_StreamAcc* pObjStream = GetObjectStream(m_ObjectInfo[objnum].pos);
(...skipping 3765 matching lines...) Expand 10 before | Expand all | Expand 10 after
4969 if (!m_pLinearizedDict) 4974 if (!m_pLinearizedDict)
4970 return -1; 4975 return -1;
4971 CPDF_Array* pRange = m_pLinearizedDict->GetArray("H"); 4976 CPDF_Array* pRange = m_pLinearizedDict->GetArray("H");
4972 if (!pRange) 4977 if (!pRange)
4973 return -1; 4978 return -1;
4974 CPDF_Object* pStreamLen = pRange->GetElementValue(1); 4979 CPDF_Object* pStreamLen = pRange->GetElementValue(1);
4975 if (!pStreamLen) 4980 if (!pStreamLen)
4976 return -1; 4981 return -1;
4977 return pStreamLen->GetInteger(); 4982 return pStreamLen->GetInteger();
4978 } 4983 }
OLDNEW

Powered by Google App Engine
This is Rietveld 408576698