Fix stack overflow in object Clone() functions

core/fpdfapi/fpdf_parser/include/cpdf_object.h

 // Copyright 2016 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #ifndef CORE_FPDFAPI_FPDF_PARSER_INCLUDE_CPDF_OBJECT_H_
 #define CORE_FPDFAPI_FPDF_PARSER_INCLUDE_CPDF_OBJECT_H_
 
+#include <set>
+
 #include "core/fxcrt/include/fx_string.h"
 #include "core/fxcrt/include/fx_system.h"
 
 class CPDF_Array;
 class CPDF_Boolean;
 class CPDF_Dictionary;
 class CPDF_Name;
 class CPDF_Null;
 class CPDF_Number;
 class CPDF_Reference;
@@ skipping 12 matching lines @@
     DICTIONARY,
     STREAM,
     NULLOBJ,
     REFERENCE
   };
 
   virtual Type GetType() const = 0;
   uint32_t GetObjNum() const { return m_ObjNum; }
   uint32_t GetGenNum() const { return m_GenNum; }
 
-  virtual CPDF_Object* Clone(FX_BOOL bDirect = FALSE) const = 0;
+  // Create a deep copy of the object.
+  virtual CPDF_Object* Clone() const = 0;
+  // Create a deep copy of the object except any reference object be
+  // copied to the object it points to directly.
+  virtual CPDF_Object* CloneDirectObject() const;
   virtual CPDF_Object* GetDirect() const;
 
   void Release();
 
   virtual CFX_ByteString GetString() const;
   virtual CFX_WideString GetUnicodeText() const;
   virtual FX_FLOAT GetNumber() const;
   virtual int GetInteger() const;
   virtual CPDF_Dictionary* GetDict() const;
 
@@ skipping 19 matching lines @@
   virtual CPDF_Number* AsNumber();
   virtual const CPDF_Number* AsNumber() const;
   virtual CPDF_Reference* AsReference();
   virtual const CPDF_Reference* AsReference() const;
   virtual CPDF_Stream* AsStream();
   virtual const CPDF_Stream* AsStream() const;
   virtual CPDF_String* AsString();
   virtual const CPDF_String* AsString() const;
 
  protected:
+  friend class CPDF_Array;
+  friend class CPDF_Dictionary;
+  friend class CPDF_Document;
+  friend class CPDF_IndirectObjectHolder;
+  friend class CPDF_Parser;
+  friend class CPDF_Reference;
+  friend class CPDF_Stream;
+
   CPDF_Object() : m_ObjNum(0), m_GenNum(0) {}
   virtual ~CPDF_Object();
   void Destroy() { delete this; }
 
+  CPDF_Object* CloneObjectNonCyclic(bool bDirect) const;
+
+  // Create a deep copy of the object with the option to either
+  // copy a reference object or directly copy the object it refers to
+  // when |bDirect| is true.
+  // Also check cyclic reference against |pVisited|, no copy if it is found.
+  // Complex objects should implement their own CloneNonCyclic()
+  // function to properly check for possible loop.
+  virtual CPDF_Object* CloneNonCyclic(
+      bool bDirect,
+      std::set<const CPDF_Object*>* pVisited) const;
+
   uint32_t m_ObjNum;
   uint32_t m_GenNum;
 
-  friend class CPDF_IndirectObjectHolder;
-  friend class CPDF_Parser;
-
  private:
   CPDF_Object(const CPDF_Object& src) {}
 };
 
 inline CPDF_Boolean* ToBoolean(CPDF_Object* obj) {
   return obj ? obj->AsBoolean() : nullptr;
 }
 
 inline const CPDF_Boolean* ToBoolean(const CPDF_Object* obj) {
   return obj ? obj->AsBoolean() : nullptr;
@@ skipping 48 matching lines @@
 
 inline CPDF_Stream* ToStream(CPDF_Object* obj) {
   return obj ? obj->AsStream() : nullptr;
 }
 
 inline const CPDF_Stream* ToStream(const CPDF_Object* obj) {
   return obj ? obj->AsStream() : nullptr;
 }
 
 #endif  // CORE_FPDFAPI_FPDF_PARSER_INCLUDE_CPDF_OBJECT_H_