Fix stack overflow in object Clone() functions

core/fpdfapi/fpdf_parser/cpdf_indirect_object_holder.cpp

 // Copyright 2016 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "core/fpdfapi/fpdf_parser/include/cpdf_indirect_object_holder.h"
 
 #include "core/fpdfapi/fpdf_parser/include/cpdf_object.h"
 #include "core/fpdfapi/fpdf_parser/include/cpdf_parser.h"
 
 CPDF_IndirectObjectHolder::CPDF_IndirectObjectHolder() : m_LastObjNum(0) {}
 
 CPDF_IndirectObjectHolder::~CPDF_IndirectObjectHolder() {
   for (const auto& pair : m_IndirectObjs)
-    pair.second->Destroy();
+    pair.second->Release();

[dsinclair, 2016/08/18 14:04:31]

I believe this should be Destroy(). The Release() method in CPDF_Object won't
actually do anything if there is an object number assigned. So, we'd end up
leaking all of the objects.

[Wei Li, 2016/08/18 22:02:30]

You are right, done.

 }
 
 CPDF_Object* CPDF_IndirectObjectHolder::GetIndirectObject(
     uint32_t objnum) const {
   if (objnum == 0)
     return nullptr;
 
   auto it = m_IndirectObjs.find(objnum);
   return it != m_IndirectObjs.end() ? it->second : nullptr;
 }
@@ skipping 53 matching lines @@
   return true;
 }
 
 void CPDF_IndirectObjectHolder::ReplaceIndirectObject(CPDF_Object* pObj) {
   m_LastObjNum = std::max(m_LastObjNum, pObj->m_ObjNum);
   if (m_IndirectObjs[pObj->m_ObjNum])
     m_IndirectObjs[pObj->m_ObjNum]->Destroy();
 
   m_IndirectObjs[pObj->m_ObjNum] = pObj;
 }