Fix stack overflow in object Clone() functions

core/fpdfapi/fpdf_parser/cpdf_array.cpp

 // Copyright 2016 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "core/fpdfapi/fpdf_parser/include/cpdf_array.h"
 
 #include "core/fpdfapi/fpdf_parser/include/cpdf_name.h"
 #include "core/fpdfapi/fpdf_parser/include/cpdf_number.h"
 #include "core/fpdfapi/fpdf_parser/include/cpdf_reference.h"
 #include "core/fpdfapi/fpdf_parser/include/cpdf_stream.h"
 #include "core/fpdfapi/fpdf_parser/include/cpdf_string.h"
+#include "third_party/base/stl_util.h"
 
 CPDF_Array::CPDF_Array() {}
 
 CPDF_Array::~CPDF_Array() {
+  // Mark the object as deleted so that it will not be deleted again
+  // in case of cyclic references.
+  m_ObjNum = kInvalidObjNum;
   for (auto& it : m_Objects) {
     if (it)
       it->Release();
   }
 }
 
 CPDF_Object::Type CPDF_Array::GetType() const {
   return ARRAY;
 }
 
 bool CPDF_Array::IsArray() const {
   return true;
 }
 
 CPDF_Array* CPDF_Array::AsArray() {
   return this;
 }
 
 const CPDF_Array* CPDF_Array::AsArray() const {
   return this;
 }
 
-CPDF_Object* CPDF_Array::Clone(FX_BOOL bDirect) const {
+CPDF_Object* CPDF_Array::Clone() const {
+  return CloneObjectNonCyclic(false);
+}
+
+CPDF_Object* CPDF_Array::CloneNonCyclic(
+    bool bDirect,
+    std::set<const CPDF_Object*>* pVisited) const {
+  pVisited->insert(this);
   CPDF_Array* pCopy = new CPDF_Array();
   for (size_t i = 0; i < GetCount(); i++) {
     CPDF_Object* value = m_Objects.at(i);
-    pCopy->m_Objects.push_back(value->Clone(bDirect));
+    if (!pdfium::ContainsKey(*pVisited, value))
+      pCopy->m_Objects.push_back(value->CloneNonCyclic(bDirect, pVisited));
   }
   return pCopy;
 }
 
 CFX_FloatRect CPDF_Array::GetRect() {
   CFX_FloatRect rect;
   if (!IsArray() || m_Objects.size() != 4)
     return rect;
 
   rect.left = GetNumberAt(0);
@@ skipping 136 matching lines @@
   ASSERT(IsArray());
   CPDF_Number* pNumber = new CPDF_Number(f);
   Add(pNumber);
 }
 
 void CPDF_Array::AddReference(CPDF_IndirectObjectHolder* pDoc,
                               uint32_t objnum) {
   ASSERT(IsArray());
   Add(new CPDF_Reference(pDoc, objnum));
 }