Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(263)

Unified Diff: core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp

Issue 1569343002: Fix infinite loop caused by parsing same indirect objects (Closed) Base URL: https://pdfium.googlesource.com/pdfium.git@master
Patch Set: Created 4 years, 11 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
Index: core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp
diff --git a/core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp b/core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp
index 010b9b7c47213306e2d0d0a6ef1e50dbbd5cf9e5..08c63a65f52550c86b59648c78bea042337ffc0d 100644
--- a/core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp
+++ b/core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp
@@ -1191,6 +1191,11 @@ CPDF_Object* CPDF_Parser::ParseIndirectObject(CPDF_IndirectObjects* pObjList,
if (!IsValidObjectNumber(objnum))
return nullptr;
+ // Prevent circular parsing the same object.
+ if (pdfium::ContainsKey(objnums_in_processing, objnum))
+ return nullptr;
+ ScopedSetInsertion<FX_DWORD> local_insert(&objnums_in_processing, objnum);
+
if (m_V5Type[objnum] == 1 || m_V5Type[objnum] == 255) {
FX_FILESIZE pos = m_ObjectInfo[objnum].pos;
if (pos <= 0)

Powered by Google App Engine
This is Rietveld 408576698