Fix stack overflow in object Clone() functions

core/fpdfapi/fpdf_parser/cpdf_object_unittest.cpp

Index: core/fpdfapi/fpdf_parser/cpdf_object_unittest.cpp
diff --git a/core/fpdfapi/fpdf_parser/cpdf_object_unittest.cpp b/core/fpdfapi/fpdf_parser/cpdf_object_unittest.cpp
index 8fbaa482bff9df99a6f087ae7d175bc354383a55..427fa487ff8147ce7af8738e6269662bde339ee5 100644
--- a/core/fpdfapi/fpdf_parser/cpdf_object_unittest.cpp
+++ b/core/fpdfapi/fpdf_parser/cpdf_object_unittest.cpp
@@ -23,6 +23,8 @@
 namespace {
 
 using ScopedArray = std::unique_ptr<CPDF_Array, ReleaseDeleter<CPDF_Array>>;
+using ScopedDict =
+    std::unique_ptr<CPDF_Dictionary, ReleaseDeleter<CPDF_Dictionary>>;
 
 void TestArrayAccessors(const CPDF_Array* arr,
                         size_t index,
@@ -744,3 +746,46 @@ TEST(PDFArrayTest, AddReferenceAndGetObjectAt) {
     EXPECT_EQ(indirect_objs[i], arr1->GetDirectObjectAt(i));
   }
 }
+
+TEST_F(PDFObjectsTest, CloneCheckLoop) {
+  {
+    // Create an object with a reference loop.
+    ScopedArray arr_obj(new CPDF_Array);
+    // Dictionary object.
+    CPDF_Dictionary* dict_obj = new CPDF_Dictionary;
+    dict_obj->SetAt("arr", arr_obj.get());
+    arr_obj->InsertAt(0, dict_obj);
+
+    // Clone this object to see whether stack overflow will be triggered.
+    ScopedArray cloned_array(arr_obj->Clone()->AsArray());
+    // Cloned object should be the same as the original.
+    EXPECT_EQ(1u, cloned_array->GetCount());

[Lei Zhang, 2016/08/18 15:16:44]

ASSERT_TRUE(cloned_array); ditto below with |cloned_dict|

[Wei Li, 2016/08/18 22:02:30]

Done.

+    CPDF_Object* cloned_dict = cloned_array->GetObjectAt(0);
+    ASSERT_TRUE(cloned_dict->IsDictionary());
+    // Recursively referenced object is not cloned.
+    EXPECT_EQ(nullptr, cloned_dict->AsDictionary()->GetObjectBy("arr"));

[Lei Zhang, 2016/08/18 15:16:44]

Or just EXPECT_FALSE(...);

[Wei Li, 2016/08/18 22:02:30]

Yes, that would work too. Will keep "EXPECT_EQ(nullptr" to be explicit
about the type and value.

+  }
+  {
+    m_ObjHolder.reset(new CPDF_IndirectObjectHolder());
+    // Create an object with a reference loop.
+    CPDF_Dictionary* dict_obj = new CPDF_Dictionary;
+    CPDF_Array* arr_obj = new CPDF_Array;
+    m_ObjHolder->AddIndirectObject(dict_obj);
+    EXPECT_EQ(1u, dict_obj->GetObjNum());
+    m_ObjHolder->AddIndirectObject(arr_obj);
+    dict_obj->SetAt("arr", arr_obj);
+    arr_obj->InsertAt(0, dict_obj, m_ObjHolder.get());
+    EXPECT_TRUE(arr_obj->GetObjectAt(0)->IsReference());
+    EXPECT_EQ(1u, arr_obj->GetObjectAt(0)->AsReference()->GetRefObjNum());
+    EXPECT_EQ(dict_obj, arr_obj->GetObjectAt(0)->AsReference()->GetDirect());
+
+    // Clone this object to see whether stack overflow will be triggered.
+    ScopedDict cloned_dict(dict_obj->CloneDeRef(true)->AsDictionary());
+    // Cloned object should be the same as the original.
+    CPDF_Object* cloned_arr = cloned_dict->GetObjectBy("arr");
+    ASSERT_TRUE(cloned_arr->IsArray());
+    EXPECT_EQ(1u, cloned_arr->AsArray()->GetCount());
+    // Recursively referenced object is not cloned.
+    EXPECT_EQ(nullptr, cloned_arr->AsArray()->GetObjectAt(0));
+  }
+}