Fix an infinite loop parsing in CPDF_SyntaxParser::GetObject()

core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "core/include/fpdfapi/fpdf_parser.h"
 
 #include <algorithm>
 #include <memory>
@@ skipping 2145 matching lines @@
         dwSignValuePos = m_Pos;
 
       CPDF_Object* pObj = GetObject(pObjList, objnum, gennum, nullptr, true);
       if (!pObj)
         continue;
 
       CFX_ByteStringC keyNoSlash(key.c_str() + 1, key.GetLength() - 1);
       pDict->SetAt(keyNoSlash, pObj);
     }
 
-    if (IsSignatureDict(pDict.get())) {
+    // Only when this is a signature dictionary and has contents, we reset the
+    // contents to the un-decrypted form.
+    if (IsSignatureDict(pDict.get()) && dwSignValuePos) {

[Lei Zhang, 2016/01/11 19:55:02]

If |dwSignValuePos| is non-zero, but still invalid, can we still enter an
infinite loop?

[Wei Li, 2016/01/11 21:07:20]

Infinite loops caused during parsing should repeatedly try to parse objects at
the same position. |dwSignValuePos| is assigned to the actual file position of
'/Contents' field (line 2156), so it won't be arbitrary and should not point
backwards to cause loop. 

       FX_FILESIZE dwSavePos = m_Pos;

[Lei Zhang, 2016/01/11 19:55:02]

Replace with CFX_AutoRestorer while we are here?

[Wei Li, 2016/01/11 21:07:20]

Done.

       m_Pos = dwSignValuePos;
       CPDF_Object* pObj = GetObject(pObjList, objnum, gennum, nullptr, FALSE);
       pDict->SetAt("Contents", pObj);
       m_Pos = dwSavePos;
     }
     if (pContext) {
       pContext->m_DictEnd = m_Pos;
       if (pContext->m_Flags & PDFPARSE_NOSTREAM) {
         return pDict.release();
       }
@@ skipping 2803 matching lines @@
   if (!m_pLinearizedDict)
     return -1;
   CPDF_Array* pRange = m_pLinearizedDict->GetArray("H");
   if (!pRange)
     return -1;
   CPDF_Object* pStreamLen = pRange->GetElementValue(1);
   if (!pStreamLen)
     return -1;
   return pStreamLen->GetInteger();
 }