Fix stack overflow in object Clone() functions

core/fpdfapi/fpdf_parser/cpdf_dictionary.cpp

 // Copyright 2016 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "core/fpdfapi/fpdf_parser/include/cpdf_dictionary.h"
 
 #include "core/fpdfapi/fpdf_parser/cpdf_boolean.h"
 #include "core/fpdfapi/fpdf_parser/include/cpdf_array.h"
 #include "core/fpdfapi/fpdf_parser/include/cpdf_name.h"
 #include "core/fpdfapi/fpdf_parser/include/cpdf_number.h"
 #include "core/fpdfapi/fpdf_parser/include/cpdf_reference.h"
 #include "core/fpdfapi/fpdf_parser/include/cpdf_stream.h"
 #include "core/fpdfapi/fpdf_parser/include/cpdf_string.h"
 #include "third_party/base/stl_util.h"
 
 CPDF_Dictionary::CPDF_Dictionary() {}
 
 CPDF_Dictionary::~CPDF_Dictionary() {
+  m_ObjNum = kInvalidObjNum;
   for (const auto& it : m_Map)
     it.second->Release();
 }
 
 CPDF_Object::Type CPDF_Dictionary::GetType() const {
   return DICTIONARY;
 }
 
 CPDF_Dictionary* CPDF_Dictionary::GetDict() const {
   // The method should be made non-const if we want to not be const.
   // See bug #234.
   return const_cast<CPDF_Dictionary*>(this);
 }
 
 bool CPDF_Dictionary::IsDictionary() const {
   return true;
 }
 
 CPDF_Dictionary* CPDF_Dictionary::AsDictionary() {
   return this;
 }
 
 const CPDF_Dictionary* CPDF_Dictionary::AsDictionary() const {
   return this;
 }
 
-CPDF_Object* CPDF_Dictionary::Clone(FX_BOOL bDirect) const {
+CPDF_Object* CPDF_Dictionary::Clone() const {
+  return CloneObjectNonCyclic(false);
+}
+
+CPDF_Object* CPDF_Dictionary::CloneNonCyclic(
+    bool bDirect,
+    std::set<const CPDF_Object*>* pVisited) const {
+  pVisited->insert(this);
   CPDF_Dictionary* pCopy = new CPDF_Dictionary();
-  for (const auto& it : *this)
-    pCopy->m_Map.insert(std::make_pair(it.first, it.second->Clone(bDirect)));
+  for (const auto& it : *this) {
+    CPDF_Object* value = it.second;
+    if (!pdfium::ContainsKey(*pVisited, value)) {
+      pCopy->m_Map.insert(
+          std::make_pair(it.first, value->CloneNonCyclic(bDirect, pVisited)));
+    }
+  }
   return pCopy;
 }
 
 CPDF_Object* CPDF_Dictionary::GetObjectBy(const CFX_ByteString& key) const {
   auto it = m_Map.find(key);
   return it != m_Map.end() ? it->second : nullptr;
 }
 
 CPDF_Object* CPDF_Dictionary::GetDirectObjectBy(
     const CFX_ByteString& key) const {
@@ skipping 175 matching lines @@
                                   const CFX_Matrix& matrix) {
   CPDF_Array* pArray = new CPDF_Array;
   pArray->AddNumber(matrix.a);
   pArray->AddNumber(matrix.b);
   pArray->AddNumber(matrix.c);
   pArray->AddNumber(matrix.d);
   pArray->AddNumber(matrix.e);
   pArray->AddNumber(matrix.f);
   SetAt(key, pArray);
 }