Fix stack overflow from nested arrays.

core/fpdfapi/fpdf_page/fpdf_page_parser_old.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "core/fpdfapi/fpdf_page/pageint.h"
 
 #include <limits.h>
 
@@ skipping 13 matching lines @@
 #include "core/fpdfapi/fpdf_parser/include/cpdf_number.h"
 #include "core/fpdfapi/fpdf_parser/include/cpdf_stream.h"
 #include "core/fpdfapi/fpdf_parser/include/cpdf_stream_acc.h"
 #include "core/fpdfapi/fpdf_parser/include/cpdf_string.h"
 #include "core/fpdfapi/fpdf_parser/include/fpdf_parser_decode.h"
 #include "core/fpdfapi/include/cpdf_modulemgr.h"
 #include "core/fxcodec/include/fx_codec.h"
 #include "core/fxcrt/include/fx_ext.h"
 #include "core/fxcrt/include/fx_safe_types.h"
 
+namespace {
+
+const uint32_t kMaxNestedArrayLevel = 512;
+const uint32_t kMaxWordBuffer = 256;
+const FX_STRSIZE kMaxStringLength = 32767;
+
+}  // namespace
+
 CPDF_StreamParser::CPDF_StreamParser(const uint8_t* pData, uint32_t dwSize) {
   m_pBuf = pData;
   m_Size = dwSize;
   m_Pos = 0;
   m_pLastObj = NULL;
 }
 
 CPDF_StreamParser::~CPDF_StreamParser() {
   if (m_pLastObj) {
     m_pLastObj->Release();
@@ skipping 179 matching lines @@
     }
     m_Pos = dwSavePos;
     pData = FX_Alloc(uint8_t, dwStreamSize);
     FXSYS_memcpy(pData, m_pBuf + m_Pos, dwStreamSize);
     m_Pos += dwStreamSize;
   }
   pDict->SetAtInteger("Length", (int)dwStreamSize);
   return new CPDF_Stream(pData, dwStreamSize, pDict);
 }
 
-#define MAX_WORD_BUFFER 256
-#define MAX_STRING_LENGTH 32767
-
 CPDF_StreamParser::SyntaxType CPDF_StreamParser::ParseNextElement() {
   if (m_pLastObj) {
     m_pLastObj->Release();
     m_pLastObj = nullptr;
   }
 
   m_WordSize = 0;
   FX_BOOL bIsNumber = TRUE;
   if (!PositionIsInBounds())
     return EndOfData;
@@ skipping 15 matching lines @@
         return EndOfData;
 
       ch = m_pBuf[m_Pos++];
       if (PDFCharIsLineEnding(ch))
         break;
     }
   }
 
   if (PDFCharIsDelimiter(ch) && ch != '/') {
     m_Pos--;
-    m_pLastObj = ReadNextObject();
+    m_pLastObj = ReadNextObject(false, 0);
     return Others;
   }
 
   while (1) {
-    if (m_WordSize < MAX_WORD_BUFFER)
+    if (m_WordSize < kMaxWordBuffer)
       m_WordBuffer[m_WordSize++] = ch;
 
     if (!PDFCharIsNumeric(ch))
       bIsNumber = FALSE;
 
     if (!PositionIsInBounds())
       break;
 
     ch = m_pBuf[m_Pos++];
 
@@ skipping 21 matching lines @@
     }
   } else if (m_WordSize == 5) {
     if (memcmp(m_WordBuffer, "false", 5) == 0) {
       m_pLastObj = new CPDF_Boolean(FALSE);
       return Others;
     }
   }
   return Keyword;
 }
 
-CPDF_Object* CPDF_StreamParser::ReadNextObject(FX_BOOL bAllowNestedArray,
-                                               FX_BOOL bInArray) {
+CPDF_Object* CPDF_StreamParser::ReadNextObject(bool bAllowNestedArray,
+                                               uint32_t dwInArrayLevel) {
   FX_BOOL bIsNumber;
   GetNextWord(bIsNumber);
-  if (m_WordSize == 0) {
-    return NULL;
-  }
+  if (!m_WordSize)
+    return nullptr;
+
   if (bIsNumber) {
     m_WordBuffer[m_WordSize] = 0;
     return new CPDF_Number(CFX_ByteStringC(m_WordBuffer, m_WordSize));
   }
+
   int first_char = m_WordBuffer[0];
   if (first_char == '/') {
     return new CPDF_Name(
         PDF_NameDecode(CFX_ByteStringC(m_WordBuffer + 1, m_WordSize - 1)));
   }
-  if (first_char == '(') {
+
+  if (first_char == '(')
     return new CPDF_String(ReadString(), FALSE);
-  }
+
   if (first_char == '<') {
-    if (m_WordSize == 1) {
+    if (m_WordSize == 1)
       return new CPDF_String(ReadHexString(), TRUE);
-    }
+
     CPDF_Dictionary* pDict = new CPDF_Dictionary;
     while (1) {
       GetNextWord(bIsNumber);
-      if (m_WordSize == 0) {
+      if (m_WordSize == 2 && m_WordBuffer[0] == '>')
+        break;
+
+      if (!m_WordSize || m_WordBuffer[0] != '/') {
         pDict->Release();
         return nullptr;
       }
-      if (m_WordSize == 2 && m_WordBuffer[0] == '>') {
-        break;
-      }
-      if (m_WordBuffer[0] != '/') {
-        pDict->Release();
-        return nullptr;
-      }
+
       CFX_ByteString key =
           PDF_NameDecode(CFX_ByteStringC(m_WordBuffer + 1, m_WordSize - 1));
-      CPDF_Object* pObj = ReadNextObject(TRUE);
+      CPDF_Object* pObj = ReadNextObject(true, 0);
       if (!pObj) {
         pDict->Release();
         return nullptr;
       }
-      if (!key.IsEmpty()) {
+
+      if (key.IsEmpty())
+        pObj->Release();
+      else
         pDict->SetAt(key, pObj);
-      } else {
-        pObj->Release();
-      }
     }
     return pDict;
   }
+
   if (first_char == '[') {
-    if (!bAllowNestedArray && bInArray) {
-      return NULL;
+    if ((!bAllowNestedArray && dwInArrayLevel) ||
+        dwInArrayLevel > kMaxNestedArrayLevel) {
+      return nullptr;
     }
+
     CPDF_Array* pArray = new CPDF_Array;
     while (1) {
-      CPDF_Object* pObj = ReadNextObject(bAllowNestedArray, TRUE);
+      CPDF_Object* pObj = ReadNextObject(bAllowNestedArray, dwInArrayLevel + 1);
       if (pObj) {
         pArray->Add(pObj);
         continue;
       }
 
-      if (m_WordSize == 0 || m_WordBuffer[0] == ']')
+      if (!m_WordSize || m_WordBuffer[0] == ']')
         break;
     }
     return pArray;
   }
+
+  if (m_WordSize == 5 && !memcmp(m_WordBuffer, "false", 5))
+    return new CPDF_Boolean(FALSE);
+
   if (m_WordSize == 4) {
-    if (memcmp(m_WordBuffer, "true", 4) == 0) {
+    if (memcmp(m_WordBuffer, "true", 4) == 0)
       return new CPDF_Boolean(TRUE);
-    }
-    if (memcmp(m_WordBuffer, "null", 4) == 0) {
+
+    if (memcmp(m_WordBuffer, "null", 4) == 0)
       return new CPDF_Null;
-    }
-  } else if (m_WordSize == 5) {
-    if (memcmp(m_WordBuffer, "false", 5) == 0) {
-      return new CPDF_Boolean(FALSE);
-    }
   }
-  return NULL;
+
+  return nullptr;
 }
 
 void CPDF_StreamParser::GetNextWord(FX_BOOL& bIsNumber) {
   m_WordSize = 0;
   bIsNumber = TRUE;
   if (!PositionIsInBounds())
     return;
 
   int ch = m_pBuf[m_Pos++];
   while (1) {
@@ skipping 22 matching lines @@
     if (ch == '/') {
       while (1) {
         if (!PositionIsInBounds())
           return;
         ch = m_pBuf[m_Pos++];
         if (!PDFCharIsOther(ch) && !PDFCharIsNumeric(ch)) {
           m_Pos--;
           return;
         }
 
-        if (m_WordSize < MAX_WORD_BUFFER)
+        if (m_WordSize < kMaxWordBuffer)
           m_WordBuffer[m_WordSize++] = ch;
       }
     } else if (ch == '<') {
       if (!PositionIsInBounds())
         return;
       ch = m_pBuf[m_Pos++];
       if (ch == '<')
         m_WordBuffer[m_WordSize++] = ch;
       else
         m_Pos--;
     } else if (ch == '>') {
       if (!PositionIsInBounds())
         return;
       ch = m_pBuf[m_Pos++];
       if (ch == '>')
         m_WordBuffer[m_WordSize++] = ch;
       else
         m_Pos--;
     }
     return;
   }
 
   while (1) {
-    if (m_WordSize < MAX_WORD_BUFFER)
+    if (m_WordSize < kMaxWordBuffer)
       m_WordBuffer[m_WordSize++] = ch;
     if (!PDFCharIsNumeric(ch))
       bIsNumber = FALSE;
 
     if (!PositionIsInBounds())
       return;
     ch = m_pBuf[m_Pos++];
     if (PDFCharIsDelimiter(ch) || PDFCharIsWhitespace(ch)) {
       m_Pos--;
       break;
     }
   }
 }
 
 CFX_ByteString CPDF_StreamParser::ReadString() {
   if (!PositionIsInBounds())
     return CFX_ByteString();
 
   uint8_t ch = m_pBuf[m_Pos++];
   CFX_ByteTextBuf buf;
   int parlevel = 0;
   int status = 0;
   int iEscCode = 0;
   while (1) {
     switch (status) {
       case 0:
         if (ch == ')') {
           if (parlevel == 0) {
-            if (buf.GetLength() > MAX_STRING_LENGTH) {
-              return CFX_ByteString(buf.GetBuffer(), MAX_STRING_LENGTH);
+            if (buf.GetLength() > kMaxStringLength) {
+              return CFX_ByteString(buf.GetBuffer(), kMaxStringLength);
             }
             return buf.AsStringC();
           }
           parlevel--;
           buf.AppendChar(')');
         } else if (ch == '(') {
           parlevel++;
           buf.AppendChar('(');
         } else if (ch == '\\') {
           status = 1;
@@ skipping 57 matching lines @@
         break;
     }
     if (!PositionIsInBounds())
       break;
 
     ch = m_pBuf[m_Pos++];
   }
   if (PositionIsInBounds())
     ++m_Pos;
 
-  if (buf.GetLength() > MAX_STRING_LENGTH) {
-    return CFX_ByteString(buf.GetBuffer(), MAX_STRING_LENGTH);
+  if (buf.GetLength() > kMaxStringLength) {
+    return CFX_ByteString(buf.GetBuffer(), kMaxStringLength);
   }
   return buf.AsStringC();
 }
 
 CFX_ByteString CPDF_StreamParser::ReadHexString() {
   if (!PositionIsInBounds())
     return CFX_ByteString();
 
   CFX_ByteTextBuf buf;
   bool bFirst = true;
@@ skipping 12 matching lines @@
       code = val * 16;
     } else {
       code += val;
       buf.AppendByte((uint8_t)code);
     }
     bFirst = !bFirst;
   }
   if (!bFirst)
     buf.AppendChar((char)code);
 
-  if (buf.GetLength() > MAX_STRING_LENGTH)
-    return CFX_ByteString(buf.GetBuffer(), MAX_STRING_LENGTH);
+  if (buf.GetLength() > kMaxStringLength)
+    return CFX_ByteString(buf.GetBuffer(), kMaxStringLength);
 
   return buf.AsStringC();
 }
 
 bool CPDF_StreamParser::PositionIsInBounds() const {
   return m_Pos < m_Size;
 }
 
 CPDF_ContentParser::CPDF_ContentParser()
     : m_Status(Ready),
@@ skipping 193 matching lines @@
       }
       m_Status = Done;
       return;
     }
     steps++;
     if (pPause && pPause->NeedToPauseNow()) {
       break;
     }
   }
 }