Fix infinite loops in FPDF_GetFullName().

core/fpdfdoc/cpdf_formfield.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "core/fpdfdoc/include/cpdf_formfield.h"
 
+#include <set>
+
 #include "core/fpdfapi/fpdf_parser/include/cfdf_document.h"
 #include "core/fpdfapi/fpdf_parser/include/cpdf_array.h"
 #include "core/fpdfapi/fpdf_parser/include/cpdf_document.h"
 #include "core/fpdfapi/fpdf_parser/include/cpdf_number.h"
 #include "core/fpdfapi/fpdf_parser/include/cpdf_simple_parser.h"
 #include "core/fpdfapi/fpdf_parser/include/cpdf_string.h"
 #include "core/fpdfapi/fpdf_parser/include/fpdf_parser_decode.h"
 #include "core/fpdfdoc/cpvt_generateap.h"
 #include "core/fpdfdoc/include/cpdf_formcontrol.h"
 #include "core/fpdfdoc/include/cpdf_interform.h"
+#include "third_party/base/stl_util.h"
 
 namespace {
 
 const int kMaxRecursion = 32;
 
 const int kFormListMultiSelect = 0x100;
 
 const int kFormComboEdit = 0x100;
 
 const int kFormFieldReadOnly = 0x01;
@@ skipping 29 matching lines @@
     return pAttr;
 
   CPDF_Dictionary* pParent = pFieldDict->GetDictBy("Parent");
   if (!pParent)
     return nullptr;
   return FPDF_GetFieldAttr(pParent, name, nLevel + 1);
 }
 
 CFX_WideString FPDF_GetFullName(CPDF_Dictionary* pFieldDict) {
   CFX_WideString full_name;
+  std::set<CPDF_Dictionary*> visited;
   CPDF_Dictionary* pLevel = pFieldDict;
   while (pLevel) {
+    visited.insert(pLevel);
     CFX_WideString short_name = pLevel->GetUnicodeTextBy("T");
-    if (short_name != L"") {
-      if (full_name == L"")
+    if (!short_name.IsEmpty()) {
+      if (full_name.IsEmpty())
         full_name = short_name;
       else
         full_name = short_name + L"." + full_name;
     }
     pLevel = pLevel->GetDictBy("Parent");
+    if (pdfium::ContainsKey(visited, pLevel))
+      break;
   }
   return full_name;
 }
 
 CPDF_FormField::CPDF_FormField(CPDF_InterForm* pForm, CPDF_Dictionary* pDict)
     : m_Type(Unknown),
       m_pForm(pForm),
       m_pDict(pDict),
       m_FontSize(0),
       m_pFont(nullptr) {
@@ skipping 584 matching lines @@
 
   CFX_ByteString csStr =
       PDF_EncodeText(csOptLabel.c_str(), csOptLabel.GetLength());
   CPDF_Object* pValue = FPDF_GetFieldAttr(m_pDict, "Opt");
   CPDF_Array* pOpt = ToArray(pValue);
   if (!pOpt) {
     pOpt = new CPDF_Array;
     m_pDict->SetAt("Opt", pOpt);
   }
 
-  int iCount = (int)pOpt->GetCount();
-  if (index < 0 || index >= iCount) {
+  int iCount = pdfium::base::checked_cast<int, size_t>(pOpt->GetCount());
+  if (index >= iCount) {
     pOpt->AddString(csStr);
     index = iCount;
   } else {
     CPDF_String* pString = new CPDF_String(csStr, FALSE);
     pOpt->InsertAt(index, pString);
   }
 
   if (bNotify)
     NotifyListOrComboBoxAfterChange();
   return index;
@@ skipping 294 matching lines @@
     case ListBox:
       NotifyAfterSelectionChange();
       break;
     case ComboBox:
       NotifyAfterValueChange();
       break;
     default:
       break;
   }
 }