Fix stack overflow in object Clone() functions

core/fpdfapi/fpdf_parser/cpdf_object.cpp

 // Copyright 2016 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "core/fpdfapi/fpdf_parser/include/cpdf_object.h"
 
 #include <algorithm>
 
 #include "core/fpdfapi/fpdf_parser/include/cpdf_array.h"
 #include "core/fpdfapi/fpdf_parser/include/cpdf_dictionary.h"
 #include "core/fpdfapi/fpdf_parser/include/cpdf_indirect_object_holder.h"
 #include "core/fpdfapi/fpdf_parser/include/cpdf_parser.h"
 #include "core/fpdfapi/fpdf_parser/include/fpdf_parser_decode.h"
 #include "core/fxcrt/include/fx_string.h"
 #include "third_party/base/stl_util.h"
 
 CPDF_Object::~CPDF_Object() {}
 
 CPDF_Object* CPDF_Object::GetDirect() const {
   return const_cast<CPDF_Object*>(this);
 }
 
+CPDF_Object* CPDF_Object::CloneDeRef(bool bDirect) const {

[dsinclair, 2016/08/18 14:04:31]

Oh, I though this was clone dereference. I think this one should be renamed too.

Can this be the public CloneNonCyclic and then CloneWithCheck becomes protected
CloneNOnCyclicInternal? or something?

[Wei Li, 2016/08/18 22:02:30]

CloneWithCheck() was originally set to public to avoid the needs to have friend
classes.
Since exposing it seems confusing, put it back to protected section.

+  std::set<const CPDF_Object*> visited_objs;
+  return CloneWithCheck(bDirect, &visited_objs);
+}
+
+CPDF_Object* CPDF_Object::CloneWithCheck(
+    bool bDirect,
+    std::set<const CPDF_Object*>* pVisited) const {
+  return Clone();
+}
+
 void CPDF_Object::Release() {
   if (m_ObjNum)
     return;
 
+  m_ObjNum = kInvalidObjNum;

[dsinclair, 2016/08/18 14:04:31]

The Destroy() call is going to delete the object so no need to reset the
m_ObjNum

[Wei Li, 2016/08/18 22:02:30]

Moved to each complex class's dtor to avoid double free for cyclic references.

   Destroy();
 }
 
 CFX_ByteString CPDF_Object::GetString() const {
   return CFX_ByteString();
 }
 
 CFX_WideString CPDF_Object::GetUnicodeText() const {
   return CFX_WideString();
 }
@@ skipping 102 matching lines @@
   return nullptr;
 }
 
 CPDF_String* CPDF_Object::AsString() {
   return nullptr;
 }
 
 const CPDF_String* CPDF_Object::AsString() const {
   return nullptr;
 }