Detect resursive loading of type3 font char to avoid infinite loop

core/fpdfapi/fpdf_page/cpdf_textobject.cpp

 // Copyright 2016 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "core/fpdfapi/fpdf_page/cpdf_textobject.h"
 
 #include "core/fpdfapi/fpdf_font/cpdf_cidfont.h"
 #include "core/fpdfapi/fpdf_font/cpdf_font.h"
@@ skipping 199 matching lines @@
 
 FX_FLOAT CPDF_TextObject::GetCharWidth(uint32_t charcode) const {
   FX_FLOAT fontsize = m_TextState.GetFontSize() / 1000;
   CPDF_Font* pFont = m_TextState.GetFont();
   FX_BOOL bVertWriting = FALSE;
   CPDF_CIDFont* pCIDFont = pFont->AsCIDFont();
   if (pCIDFont) {
     bVertWriting = pCIDFont->IsVertWriting();
   }
   if (!bVertWriting)
-    return pFont->GetCharWidthF(charcode, 0) * fontsize;
+    return pFont->GetCharWidthF(charcode) * fontsize;
 
   uint16_t CID = pCIDFont->CIDFromCharCode(charcode);
   return pCIDFont->GetVertWidth(CID) * fontsize;
 }
 
 FX_FLOAT CPDF_TextObject::GetPosX() const {
   return m_PosX;
 }
 
 FX_FLOAT CPDF_TextObject::GetPosY() const {
   return m_PosY;
 }
 
 CPDF_Font* CPDF_TextObject::GetFont() const {
   return m_TextState.GetFont();
 }
 
 FX_FLOAT CPDF_TextObject::GetFontSize() const {
   return m_TextState.GetFontSize();
 }
 
 void CPDF_TextObject::CalcPositionData(FX_FLOAT* pTextAdvanceX,
                                        FX_FLOAT* pTextAdvanceY,
-                                       FX_FLOAT horz_scale,
-                                       int level) {
+                                       FX_FLOAT horz_scale) {
   FX_FLOAT curpos = 0;
   FX_FLOAT min_x = 10000 * 1.0f;
   FX_FLOAT max_x = -10000 * 1.0f;
   FX_FLOAT min_y = 10000 * 1.0f;
   FX_FLOAT max_y = -10000 * 1.0f;
   CPDF_Font* pFont = m_TextState.GetFont();
   FX_BOOL bVertWriting = FALSE;
   CPDF_CIDFont* pCIDFont = pFont->AsCIDFont();
   if (pCIDFont) {
     bVertWriting = pCIDFont->IsVertWriting();
   }
   FX_FLOAT fontsize = m_TextState.GetFontSize();
   for (int i = 0; i < m_nChars; ++i) {
     uint32_t charcode =
         m_nChars == 1 ? (uint32_t)(uintptr_t)m_pCharCodes : m_pCharCodes[i];
     if (i > 0) {
       if (charcode == CPDF_Font::kInvalidCharCode) {
         curpos -= (m_pCharPos[i - 1] * fontsize) / 1000;
         continue;
       }
       m_pCharPos[i - 1] = curpos;
     }
-    FX_RECT char_rect = pFont->GetCharBBox(charcode, level);
+    FX_RECT char_rect = pFont->GetCharBBox(charcode);
     FX_FLOAT charwidth;
     if (!bVertWriting) {
       if (min_y > char_rect.top) {
         min_y = (FX_FLOAT)char_rect.top;
       }
       if (max_y < char_rect.top) {
         max_y = (FX_FLOAT)char_rect.top;
       }
       if (min_y > char_rect.bottom) {
         min_y = (FX_FLOAT)char_rect.bottom;
       }
       if (max_y < char_rect.bottom) {
         max_y = (FX_FLOAT)char_rect.bottom;
       }
       FX_FLOAT char_left = curpos + char_rect.left * fontsize / 1000;
       FX_FLOAT char_right = curpos + char_rect.right * fontsize / 1000;
       if (min_x > char_left) {
         min_x = char_left;
       }
       if (max_x < char_left) {
         max_x = char_left;
       }
       if (min_x > char_right) {
         min_x = char_right;
       }
       if (max_x < char_right) {
         max_x = char_right;
       }
-      charwidth = pFont->GetCharWidthF(charcode, level) * fontsize / 1000;
+      charwidth = pFont->GetCharWidthF(charcode) * fontsize / 1000;
     } else {
       uint16_t CID = pCIDFont->CIDFromCharCode(charcode);
       short vx;
       short vy;
       pCIDFont->GetVertOrigin(CID, vx, vy);
       char_rect.left -= vx;
       char_rect.right -= vx;
       char_rect.top -= vy;
       char_rect.bottom -= vy;
       if (min_x > char_rect.left) {
@@ skipping 72 matching lines @@
   m_PosY = y;
   m_Left += dx;
   m_Right += dx;
   m_Top += dy;
   m_Bottom += dy;
 }
 
 void CPDF_TextObject::RecalcPositionData() {
   CalcPositionData(nullptr, nullptr, 1);
 }