Fix infinite loops caused by calling circular indirect objects

core/src/fpdfapi/fpdf_parser/fpdf_parser_objects.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "core/include/fpdfapi/fpdf_objects.h"
 
 #include <algorithm>
 
 #include "core/include/fpdfapi/fpdf_parser.h"
 #include "core/include/fxcrt/fx_string.h"
 #include "third_party/base/stl_util.h"
 
 namespace {
 
 const FX_DWORD kBlockSize = 1024;
 
 }  // namespace
 
-// static
-int CPDF_Object::s_nCurRefDepth = 0;
-
 void CPDF_Object::Release() {
   if (m_ObjNum) {
     return;
   }
   Destroy();
 }
 void CPDF_Object::Destroy() {
   switch (m_Type) {
     case PDFOBJ_STRING:
       delete AsString();
       break;
     case PDFOBJ_NAME:
       delete AsName();
       break;
     case PDFOBJ_ARRAY:
       delete AsArray();
       break;
     case PDFOBJ_DICTIONARY:
       delete AsDictionary();
       break;
     case PDFOBJ_STREAM:
       delete AsStream();
       break;
     default:
       delete this;
   }
 }
+
+const CPDF_Object* const CPDF_Object::GetBasicObject() const {
+  if (m_Type != PDFOBJ_REFERENCE)

[Lei Zhang, 2016/01/16 00:51:57]

You can just call AsReference() and omit this check. If it's not a reference,
it'll return nullptr. Check for that instead.

[Wei Li, 2016/01/19 20:16:24]

Done.

+    return this;
+
+  const CPDF_Reference* pRef = AsReference();
+  if (!pRef->m_pObjList)
+    return nullptr;
+  return pRef->m_pObjList->GetIndirectObject(pRef->GetRefObjNum(), nullptr);
+}
+
 CFX_ByteString CPDF_Object::GetString() const {
-  switch (m_Type) {
-    case PDFOBJ_BOOLEAN:
-      return AsBoolean()->m_bValue ? "true" : "false";
-    case PDFOBJ_NUMBER:
-      return AsNumber()->GetString();
-    case PDFOBJ_STRING:
-      return AsString()->m_String;
-    case PDFOBJ_NAME:
-      return AsName()->m_Name;
-    case PDFOBJ_REFERENCE: {
-      const CPDF_Reference* pRef = AsReference();
-      if (!pRef->m_pObjList)
-        break;
-
-      CPDF_Object* pObj =
-          pRef->m_pObjList->GetIndirectObject(pRef->GetRefObjNum(), nullptr);
-      return pObj ? pObj->GetString() : CFX_ByteString();
+  const CPDF_Object* obj = GetBasicObject();
+  if (obj) {
+    switch (obj->GetType()) {
+      case PDFOBJ_BOOLEAN:
+        return obj->AsBoolean()->GetString();
+      case PDFOBJ_NUMBER:
+        return obj->AsNumber()->GetString();
+      case PDFOBJ_STRING:
+        return obj->AsString()->GetString();
+      case PDFOBJ_NAME:
+        return obj->AsName()->GetString();
     }
   }
   return CFX_ByteString();
 }
+
 CFX_ByteStringC CPDF_Object::GetConstString() const {
-  switch (m_Type) {
-    case PDFOBJ_STRING: {
-      CFX_ByteString str = AsString()->m_String;
-      return CFX_ByteStringC((const uint8_t*)str, str.GetLength());
+  const CPDF_Object* obj = GetBasicObject();
+  if (obj) {
+    FX_DWORD type = obj->GetType();
+    if (type == PDFOBJ_STRING) {
+      CFX_ByteString str = obj->AsString()->GetString();
+      return CFX_ByteStringC(str);
     }
-    case PDFOBJ_NAME: {
-      CFX_ByteString name = AsName()->m_Name;
-      return CFX_ByteStringC((const uint8_t*)name, name.GetLength());
-    }
-    case PDFOBJ_REFERENCE: {
-      const CPDF_Reference* pRef = AsReference();
-      if (!pRef->m_pObjList)
-        break;
-
-      CPDF_Object* pObj =
-          pRef->m_pObjList->GetIndirectObject(pRef->GetRefObjNum(), nullptr);
-      return pObj ? pObj->GetConstString() : CFX_ByteStringC();
+    if (type == PDFOBJ_NAME) {
+      CFX_ByteString name = obj->AsName()->GetString();
+      return CFX_ByteStringC(name);
     }
   }
   return CFX_ByteStringC();
 }
 
 FX_FLOAT CPDF_Object::GetNumber() const {
-  switch (m_Type) {
-    case PDFOBJ_NUMBER:
-      return AsNumber()->GetNumber();
-    case PDFOBJ_REFERENCE: {
-      const CPDF_Reference* pRef = AsReference();
-      if (!pRef->m_pObjList)
-        break;
-
-      CPDF_Object* pObj =
-          pRef->m_pObjList->GetIndirectObject(pRef->GetRefObjNum(), nullptr);
-      return pObj ? pObj->GetNumber() : 0;
-    }
-  }
+  const CPDF_Object* obj = GetBasicObject();
+  if (obj && obj->GetType() == PDFOBJ_NUMBER)
+    return AsNumber()->GetNumber();
   return 0;
 }
 
 FX_FLOAT CPDF_Object::GetNumber16() const {
   return GetNumber();
 }
 
 int CPDF_Object::GetInteger() const {
-  CFX_AutoRestorer<int> restorer(&s_nCurRefDepth);
-  if (++s_nCurRefDepth > kObjectRefMaxDepth)
-    return 0;
-
-  switch (m_Type) {
-    case PDFOBJ_BOOLEAN:
-      return AsBoolean()->m_bValue;
-    case PDFOBJ_NUMBER:
-      return AsNumber()->GetInteger();
-    case PDFOBJ_REFERENCE: {
-      const CPDF_Reference* pRef = AsReference();
-      PARSE_CONTEXT context;
-      FXSYS_memset(&context, 0, sizeof(PARSE_CONTEXT));
-      if (!pRef->m_pObjList)
-        return 0;
-
-      CPDF_Object* pObj =
-          pRef->m_pObjList->GetIndirectObject(pRef->GetRefObjNum(), &context);
-      return pObj ? pObj->GetInteger() : 0;
-    }
+  const CPDF_Object* obj = GetBasicObject();
+  if (obj) {
+    FX_DWORD type = obj->GetType();
+    if (type == PDFOBJ_BOOLEAN)
+      return obj->AsBoolean()->GetValue();
+    if (type == PDFOBJ_NUMBER)
+      return obj->AsNumber()->GetInteger();
   }
   return 0;
 }
 
 CPDF_Dictionary* CPDF_Object::GetDict() const {
-  switch (m_Type) {
-    case PDFOBJ_DICTIONARY:
+  const CPDF_Object* obj = GetBasicObject();
+  if (obj) {
+    FX_DWORD type = obj->GetType();
+    if (type == PDFOBJ_DICTIONARY) {
       // The method should be made non-const if we want to not be const.
       // See bug #234.
       return const_cast<CPDF_Dictionary*>(AsDictionary());
-    case PDFOBJ_STREAM:
+    }
+    if (type == PDFOBJ_STREAM)
       return AsStream()->GetDict();
-    case PDFOBJ_REFERENCE: {
-      const CPDF_Reference* pRef = AsReference();
-      CPDF_IndirectObjectHolder* pIndirect = pRef->GetObjList();
-      if (!pIndirect)
-        return nullptr;
-      CPDF_Object* pObj =
-          pIndirect->GetIndirectObject(pRef->GetRefObjNum(), nullptr);
-      if (!pObj || (pObj == this))
-        return nullptr;
-      return pObj->GetDict();
-    }
-    default:
-      return nullptr;
   }
+  return nullptr;
 }
 
 CPDF_Array* CPDF_Object::GetArray() const {
   // The method should be made non-const if we want to not be const.
   // See bug #234.
   return const_cast<CPDF_Array*>(AsArray());
 }
 
 void CPDF_Object::SetString(const CFX_ByteString& str) {
   switch (m_Type) {
@@ skipping 959 matching lines @@
       pObj->Destroy();
       return FALSE;
     }
     it->second->Destroy();
   }
   pObj->m_ObjNum = objnum;
   m_IndirectObjs[objnum] = pObj;
   m_LastObjNum = std::max(m_LastObjNum, objnum);
   return TRUE;
 }