Fix stack overflow in object Clone() functions

core/fpdfapi/fpdf_parser/cpdf_reference.cpp

 // Copyright 2016 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "core/fpdfapi/fpdf_parser/include/cpdf_reference.h"
 
 #include "core/fpdfapi/fpdf_parser/include/cpdf_indirect_object_holder.h"
+#include "third_party/base/stl_util.h"
 
 CPDF_Reference::CPDF_Reference(CPDF_IndirectObjectHolder* pDoc, int objnum)
     : m_pObjList(pDoc), m_RefObjNum(objnum) {}
 
 CPDF_Reference::~CPDF_Reference() {}
 
 CPDF_Object::Type CPDF_Reference::GetType() const {
   return REFERENCE;
 }
 
@@ skipping 22 matching lines @@
 }
 
 CPDF_Reference* CPDF_Reference::AsReference() {
   return this;
 }
 
 const CPDF_Reference* CPDF_Reference::AsReference() const {
   return this;
 }
 
-CPDF_Object* CPDF_Reference::Clone(FX_BOOL bDirect) const {
+CPDF_Object* CPDF_Reference::Clone() const {
+  return CloneObjectNonCyclic(false);
+}
+
+CPDF_Object* CPDF_Reference::CloneNonCyclic(
+    bool bDirect,
+    std::set<const CPDF_Object*>* pVisited) const {
+  pVisited->insert(this);
   if (bDirect) {
     auto* pDirect = GetDirect();
-    return pDirect ? pDirect->Clone(TRUE) : nullptr;
+    return pDirect && !pdfium::ContainsKey(*pVisited, pDirect)
+               ? pDirect->CloneNonCyclic(true, pVisited)
+               : nullptr;
   }
   return new CPDF_Reference(m_pObjList, m_RefObjNum);
 }
 
 void CPDF_Reference::SetRef(CPDF_IndirectObjectHolder* pDoc, uint32_t objnum) {
   m_pObjList = pDoc;
   m_RefObjNum = objnum;
 }
 
 CPDF_Object* CPDF_Reference::GetDirect() const {
   return m_pObjList ? m_pObjList->GetOrParseIndirectObject(m_RefObjNum)
                     : nullptr;
 }