Fix stack exhaustion in CPDF_PSProc::Parse()

core/fpdfapi/fpdf_page/fpdf_page_func.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "core/fpdfapi/fpdf_page/pageint.h"
 
 #include <limits.h>
 
@@ skipping 121 matching lines @@
                      {"pop", PSOP_POP},         {"exch", PSOP_EXCH},
                      {"dup", PSOP_DUP},         {"copy", PSOP_COPY},
                      {"index", PSOP_INDEX},     {"roll", PSOP_ROLL}};
 
 FX_BOOL CPDF_PSEngine::Parse(const FX_CHAR* str, int size) {
   CPDF_SimpleParser parser((uint8_t*)str, size);
   CFX_ByteStringC word = parser.GetWord();
   if (word != "{") {
     return FALSE;
   }
-  return m_MainProc.Parse(&parser);
+  return m_MainProc.Parse(&parser, 0);
 }
-FX_BOOL CPDF_PSProc::Parse(CPDF_SimpleParser* parser) {
+
+FX_BOOL CPDF_PSProc::Parse(CPDF_SimpleParser* parser, int depth) {
+  if (depth > kMaxDepth)
+    return FALSE;
+
   while (1) {
     CFX_ByteStringC word = parser->GetWord();
     if (word.IsEmpty()) {
       return FALSE;
     }
     if (word == "}") {
       return TRUE;
     }
     if (word == "{") {
       std::unique_ptr<CPDF_PSProc> proc(new CPDF_PSProc);
       std::unique_ptr<CPDF_PSOP> op(new CPDF_PSOP(std::move(proc)));
       m_Operators.push_back(std::move(op));
-      if (!m_Operators.back()->GetProc()->Parse(parser)) {
+      if (!m_Operators.back()->GetProc()->Parse(parser, depth + 1)) {
         return FALSE;
       }
     } else {
       bool found = false;
       for (const PDF_PSOpName& op_name : PDF_PSOpNames) {
         if (word == CFX_ByteStringC(op_name.name)) {
           std::unique_ptr<CPDF_PSOP> op(new CPDF_PSOP(op_name.op));
           m_Operators.push_back(std::move(op));
           found = true;
           break;
@@ skipping 665 matching lines @@
   return m_Type == Type::kType2ExpotentialInterpolation
              ? static_cast<const CPDF_ExpIntFunc*>(this)
              : nullptr;
 }
 
 const CPDF_StitchFunc* CPDF_Function::ToStitchFunc() const {
   return m_Type == Type::kType3Stitching
              ? static_cast<const CPDF_StitchFunc*>(this)
              : nullptr;
 }