Fix infinite loop for bookmark search

fpdfsdk/src/fpdfdoc.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "public/fpdf_doc.h"
 
+#include <set>
+
 #include "fpdfsdk/include/fsdk_define.h"
+#include "third_party/base/stl_util.h"
 
 namespace {
 
 int THISMODULE = 0;
 
 CPDF_Bookmark FindBookmark(const CPDF_BookmarkTree& tree,
                            CPDF_Bookmark bookmark,
-                           const CFX_WideString& title) {
+                           const CFX_WideString& title,
+                           std::set<CPDF_Dictionary*>* visited) {
+  // Return if already checked to avoid circular calling.
+  if (pdfium::ContainsKey(*visited, bookmark.GetDict()))
+    return CPDF_Bookmark();
+  visited->insert(bookmark.GetDict());
+
   if (bookmark.GetDict() &&
       bookmark.GetTitle().CompareNoCase(title.c_str()) == 0) {
-    // First check this item
+    // First check this item.
     return bookmark;
   }
-  // go into children items
+
+  // Go into children items.
   CPDF_Bookmark child = tree.GetFirstChild(bookmark);
-  while (child.GetDict()) {
-    // check if this item
-    CPDF_Bookmark found = FindBookmark(tree, child, title);
+  while (child.GetDict() && !pdfium::ContainsKey(*visited, child.GetDict())) {
+    // Check this item and its children.
+    CPDF_Bookmark found = FindBookmark(tree, child, title, visited);
     if (found.GetDict())
       return found;
     child = tree.GetNextSibling(child);
   }
   return CPDF_Bookmark();
 }
 
 void ReleaseLinkList(void* data) {
   delete (CPDF_LinkList*)data;
 }
@@ skipping 56 matching lines @@
 DLLEXPORT FPDF_BOOKMARK STDCALL FPDFBookmark_Find(FPDF_DOCUMENT document,
                                                   FPDF_WIDESTRING title) {
   if (!title || title[0] == 0)
     return nullptr;
   CPDF_Document* pDoc = CPDFDocumentFromFPDFDocument(document);
   if (!pDoc)
     return nullptr;
   CPDF_BookmarkTree tree(pDoc);
   FX_STRSIZE len = CFX_WideString::WStringLength(title);
   CFX_WideString encodedTitle = CFX_WideString::FromUTF16LE(title, len);
-  return FindBookmark(tree, CPDF_Bookmark(), encodedTitle).GetDict();
+  std::set<CPDF_Dictionary*> visited;
+  return FindBookmark(tree, CPDF_Bookmark(), encodedTitle, &visited).GetDict();
 }
 
 DLLEXPORT FPDF_DEST STDCALL FPDFBookmark_GetDest(FPDF_DOCUMENT document,
                                                  FPDF_BOOKMARK pDict) {
   if (!pDict)
     return nullptr;
   CPDF_Document* pDoc = CPDFDocumentFromFPDFDocument(document);
   if (!pDoc)
     return nullptr;
   CPDF_Bookmark bookmark(ToDictionary(static_cast<CPDF_Object*>(pDict)));
@@ skipping 232 matching lines @@
     return 0;
   CFX_WideString text = pInfo->GetUnicodeTextBy(tag);
   // Use UTF-16LE encoding
   CFX_ByteString encodedText = text.UTF16LE_Encode();
   unsigned long len = encodedText.GetLength();
   if (buffer && buflen >= len) {
     FXSYS_memcpy(buffer, encodedText.c_str(), len);
   }
   return len;
 }