Fix stack overflow in object Clone() functions

core/fpdfapi/fpdf_parser/cpdf_array.cpp

Index: core/fpdfapi/fpdf_parser/cpdf_array.cpp
diff --git a/core/fpdfapi/fpdf_parser/cpdf_array.cpp b/core/fpdfapi/fpdf_parser/cpdf_array.cpp
index a047b3af7ba20cc4984179acdaaaec29807b6d9b..20d6b3e2fca4b34278ebb6a7474b8d5060a9010e 100644
--- a/core/fpdfapi/fpdf_parser/cpdf_array.cpp
+++ b/core/fpdfapi/fpdf_parser/cpdf_array.cpp
@@ -11,6 +11,7 @@
 #include "core/fpdfapi/fpdf_parser/include/cpdf_reference.h"
 #include "core/fpdfapi/fpdf_parser/include/cpdf_stream.h"
 #include "core/fpdfapi/fpdf_parser/include/cpdf_string.h"
+#include "third_party/base/stl_util.h"
 
 CPDF_Array::CPDF_Array() {}
 
@@ -37,11 +38,19 @@ const CPDF_Array* CPDF_Array::AsArray() const {
   return this;
 }
 
-CPDF_Object* CPDF_Array::Clone(FX_BOOL bDirect) const {
+CPDF_Object* CPDF_Array::Clone() const {
+  return CloneDeRef(false);
+}
+
+CPDF_Object* CPDF_Array::CloneWithCheck(

[dsinclair, 2016/08/18 14:04:31]

Not a huge fan of the name as WithCheck doesn't tell me anything. CloneNonCyclic
(which is terrible, but I can't think of anything better)

[Wei Li, 2016/08/18 22:02:30]

Couldn't think a better one, go with yours :)

+    bool bDirect,
+    std::set<const CPDF_Object*>* pVisited) const {
+  pVisited->insert(this);
   CPDF_Array* pCopy = new CPDF_Array();
   for (size_t i = 0; i < GetCount(); i++) {
     CPDF_Object* value = m_Objects.at(i);
-    pCopy->m_Objects.push_back(value->Clone(bDirect));
+    if (!pdfium::ContainsKey(*pVisited, value))
+      pCopy->m_Objects.push_back(value->CloneWithCheck(bDirect, pVisited));
   }
   return pCopy;
 }