Fix stack overflow in object Clone() functions

core/fpdfapi/fpdf_parser/cpdf_object_unittest.cpp

 // Copyright 2016 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/fpdfapi/fpdf_parser/cpdf_boolean.h"
 #include "core/fpdfapi/fpdf_parser/cpdf_null.h"
 #include "core/fpdfapi/fpdf_parser/include/cpdf_array.h"
 #include "core/fpdfapi/fpdf_parser/include/cpdf_dictionary.h"
 #include "core/fpdfapi/fpdf_parser/include/cpdf_name.h"
 #include "core/fpdfapi/fpdf_parser/include/cpdf_number.h"
 #include "core/fpdfapi/fpdf_parser/include/cpdf_reference.h"
 #include "core/fpdfapi/fpdf_parser/include/cpdf_stream.h"
 #include "core/fpdfapi/fpdf_parser/include/cpdf_string.h"
 
 #include <memory>
 #include <string>
 #include <vector>
 
 #include "core/fpdfapi/fpdf_parser/include/cpdf_indirect_object_holder.h"
 #include "core/fxcrt/include/fx_basic.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 namespace {
 
 using ScopedArray = std::unique_ptr<CPDF_Array, ReleaseDeleter<CPDF_Array>>;
+using ScopedDict =
+    std::unique_ptr<CPDF_Dictionary, ReleaseDeleter<CPDF_Dictionary>>;
 
 void TestArrayAccessors(const CPDF_Array* arr,
                         size_t index,
                         const char* str_val,
                         const char* const_str_val,
                         int int_val,
                         float float_val,
                         CPDF_Array* arr_val,
                         CPDF_Dictionary* dict_val,
                         CPDF_Stream* stream_val) {
@@ skipping 701 matching lines @@
   EXPECT_EQ(arr->GetCount(), arr1->GetCount());
   for (size_t i = 0; i < arr->GetCount(); ++i) {
     EXPECT_EQ(CPDF_Object::REFERENCE, arr->GetObjectAt(i)->GetType());
     EXPECT_EQ(indirect_objs[i], arr->GetObjectAt(i)->GetDirect());
     EXPECT_EQ(indirect_objs[i], arr->GetDirectObjectAt(i));
     EXPECT_EQ(CPDF_Object::REFERENCE, arr1->GetObjectAt(i)->GetType());
     EXPECT_EQ(indirect_objs[i], arr1->GetObjectAt(i)->GetDirect());
     EXPECT_EQ(indirect_objs[i], arr1->GetDirectObjectAt(i));
   }
 }
+
+TEST(PDFObjectTest, CloneCheckLoop) {
+  {
+    // Create an object with a reference loop.
+    ScopedArray arr_obj(new CPDF_Array);
+    // Dictionary object.
+    CPDF_Dictionary* dict_obj = new CPDF_Dictionary;
+    dict_obj->SetAt("arr", arr_obj.get());
+    arr_obj->InsertAt(0, dict_obj);
+
+    // Clone this object to see whether stack overflow will be triggered.
+    ScopedArray cloned_array(arr_obj->Clone()->AsArray());
+    // Cloned object should be the same as the original.
+    ASSERT_TRUE(cloned_array);
+    EXPECT_EQ(1u, cloned_array->GetCount());
+    CPDF_Object* cloned_dict = cloned_array->GetObjectAt(0);
+    ASSERT_TRUE(cloned_dict);
+    ASSERT_TRUE(cloned_dict->IsDictionary());
+    // Recursively referenced object is not cloned.
+    EXPECT_EQ(nullptr, cloned_dict->AsDictionary()->GetObjectBy("arr"));
+  }
+  {
+    std::unique_ptr<CPDF_IndirectObjectHolder> m_ObjHolder(
+        new CPDF_IndirectObjectHolder(nullptr));
+    // Create an object with a reference loop.
+    CPDF_Dictionary* dict_obj = new CPDF_Dictionary;
+    CPDF_Array* arr_obj = new CPDF_Array;
+    m_ObjHolder->AddIndirectObject(dict_obj);
+    EXPECT_EQ(1u, dict_obj->GetObjNum());
+    dict_obj->SetAt("arr", arr_obj);
+    arr_obj->InsertAt(0, dict_obj, m_ObjHolder.get());
+    CPDF_Object* elem0 = arr_obj->GetObjectAt(0);
+    ASSERT_TRUE(elem0);
+    ASSERT_TRUE(elem0->IsReference());
+    EXPECT_EQ(1u, elem0->AsReference()->GetRefObjNum());
+    EXPECT_EQ(dict_obj, elem0->AsReference()->GetDirect());
+
+    // Clone this object to see whether stack overflow will be triggered.
+    ScopedDict cloned_dict(ToDictionary(dict_obj->CloneDirectObject()));
+    // Cloned object should be the same as the original.
+    ASSERT_TRUE(cloned_dict);
+    CPDF_Object* cloned_arr = cloned_dict->GetObjectBy("arr");
+    ASSERT_TRUE(cloned_arr);
+    ASSERT_TRUE(cloned_arr->IsArray());
+    EXPECT_EQ(1u, cloned_arr->AsArray()->GetCount());
+    // Recursively referenced object is not cloned.
+    EXPECT_EQ(nullptr, cloned_arr->AsArray()->GetObjectAt(0));
+  }
+}