Fix stack overflow in object Clone() functions

core/fpdfapi/fpdf_parser/cpdf_stream.cpp

 // Copyright 2016 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "core/fpdfapi/fpdf_parser/include/cpdf_stream.h"
 
 #include "core/fpdfapi/fpdf_parser/include/cpdf_dictionary.h"
 #include "core/fpdfapi/fpdf_parser/include/cpdf_stream_acc.h"
 #include "core/fpdfapi/fpdf_parser/include/fpdf_parser_decode.h"
+#include "third_party/base/stl_util.h"
 
 CPDF_Stream::CPDF_Stream(uint8_t* pData, uint32_t size, CPDF_Dictionary* pDict)
     : m_pDict(pDict),
       m_dwSize(size),
       m_GenNum(kMemoryBasedGenNum),
       m_pDataBuf(pData) {}
 
 CPDF_Stream::~CPDF_Stream() {
   if (IsMemoryBased())
     FX_Free(m_pDataBuf);
@@ skipping 42 matching lines @@
   m_GenNum = kMemoryBasedGenNum;
   m_pDataBuf = FX_Alloc(uint8_t, size);
   if (pData)
     FXSYS_memcpy(m_pDataBuf, pData, size);
 
   m_dwSize = size;
   if (m_pDict)
     m_pDict->SetAtInteger("Length", size);
 }
 
-CPDF_Object* CPDF_Stream::Clone(FX_BOOL bDirect) const {
+CPDF_Object* CPDF_Stream::Clone() const {
+  return CloneDeRef(false);
+}
+
+CPDF_Object* CPDF_Stream::CloneWithCheck(
+    bool bDirect,
+    std::set<const CPDF_Object*>* pVisited) const {
+  pVisited->insert(this);
   CPDF_StreamAcc acc;
   acc.LoadAllData(this, TRUE);
   uint32_t streamSize = acc.GetSize();
   CPDF_Dictionary* pDict = GetDict();
-  if (pDict)
-    pDict = ToDictionary(pDict->Clone(bDirect));
+  if (pDict && !pdfium::ContainsKey(*pVisited, pDict))

[dsinclair, 2016/08/18 14:04:31]

nit: {}'s

[Wei Li, 2016/08/18 22:02:30]

Done.

+    pDict = ToDictionary(static_cast<const CPDF_Object*>(pDict)->CloneWithCheck(

[dsinclair, 2016/08/18 14:04:31]

Why static_cast to Object?

[Wei Li, 2016/08/18 22:02:30]

Original, I only expose CPDF_Object::CloneWithCheck() as public. Now we expose
friend classes thru CPDF_Object also.

+        bDirect, pVisited));
 
   return new CPDF_Stream(acc.DetachData(), streamSize, pDict);
 }
 
 void CPDF_Stream::SetData(const uint8_t* pData,
                           uint32_t size,
                           FX_BOOL bCompressed,
                           FX_BOOL bKeepBuf) {
   if (IsMemoryBased())
     FX_Free(m_pDataBuf);
@@ skipping 37 matching lines @@
   if (m_pDict)
     m_pDict->SetAtInteger("Length", m_dwSize);
 }
 
 CFX_WideString CPDF_Stream::GetUnicodeText() const {
   CPDF_StreamAcc stream;
   stream.LoadAllData(this, FALSE);
   return PDF_DecodeText(stream.GetData(), stream.GetSize());
 }