Protect against recursive processing of the fat header in MachOImageReader.

chrome/common/safe_browsing/mach_o_image_reader_mac_unittest.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/common/safe_browsing/mach_o_image_reader_mac.h"
 
 #include <arpa/inet.h>
 #include <libkern/OSByteOrder.h>
 #include <mach-o/fat.h>
 #include <mach-o/loader.h>
@@ skipping 465 matching lines @@
 
   const auto& load_commands = reader.GetLoadCommands();
   EXPECT_EQ(3u, load_commands.size());
 
   EXPECT_EQ(static_cast<uint32_t>(LC_SEGMENT), load_commands[0].cmd());
   EXPECT_EQ(static_cast<uint32_t>(LC_SYMSEG), load_commands[1].cmd());
   EXPECT_EQ(sizeof(load_command) - 3, load_commands[1].cmdsize());
   EXPECT_EQ(static_cast<uint32_t>(LC_SEGMENT), load_commands[2].cmd());
 }
 
+// https://crbug.com/591194
+TEST_F(MachOImageReaderTest, RecurseFatHeader) {
+#pragma pack(push, 1)
+  struct TestImage {
+    fat_header header;
+    fat_arch arch1;
+    fat_arch arch2;
+    mach_header_64 macho64;
+    mach_header macho;
+  };
+#pragma pack(pop)
+
+  TestImage test_image = {};
+  test_image.header.magic = FAT_MAGIC;
+  test_image.header.nfat_arch = 2;
+  test_image.arch1.offset = offsetof(TestImage, macho64);
+  test_image.arch1.size = sizeof(mach_header_64);
+  test_image.arch2.offset = 0;  // Cannot point back at the fat_header.
+  test_image.arch2.size = sizeof(test_image);
+
+  test_image.macho64.magic = MH_MAGIC_64;
+  test_image.macho.magic = MH_MAGIC;
+
+  MachOImageReader reader;
+  EXPECT_FALSE(reader.Initialize(reinterpret_cast<const uint8_t*>(&test_image),
+                                 sizeof(test_image)));
+}
+
 }  // namespace
 }  // namespace safe_browsing