[M57] Limit parsing recursion levels in CPDF_StreamParser

core/fpdfapi/page/cpdf_streamparser.cpp

 // Copyright 2016 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "core/fpdfapi/page/cpdf_streamparser.h"
 
 #include <limits.h>
 
@@ skipping 11 matching lines @@
 #include "core/fpdfapi/parser/cpdf_number.h"
 #include "core/fpdfapi/parser/cpdf_stream.h"
 #include "core/fpdfapi/parser/cpdf_string.h"
 #include "core/fpdfapi/parser/fpdf_parser_decode.h"
 #include "core/fpdfapi/parser/fpdf_parser_utility.h"
 #include "core/fxcodec/fx_codec.h"
 #include "core/fxcrt/fx_ext.h"
 
 namespace {
 
-const uint32_t kMaxNestedArrayLevel = 512;
+const uint32_t kMaxNestedParsingLevel = 512;
 const uint32_t kMaxWordBuffer = 256;
 const FX_STRSIZE kMaxStringLength = 32767;
 
 uint32_t DecodeAllScanlines(std::unique_ptr<CCodec_ScanlineDecoder> pDecoder,
                             uint8_t*& dest_buf,
                             uint32_t& dest_size) {
   if (!pDecoder)
     return FX_INVALID_OFFSET;
   int ncomps = pDecoder->CountComps();
   int bpc = pDecoder->GetBPC();
@@ skipping 206 matching lines @@
         return EndOfData;
 
       ch = m_pBuf[m_Pos++];
       if (PDFCharIsLineEnding(ch))
         break;
     }
   }
 
   if (PDFCharIsDelimiter(ch) && ch != '/') {
     m_Pos--;
-    m_pLastObj = ReadNextObject(false, 0);
+    m_pLastObj = ReadNextObject(false, false, 0);
     return Others;
   }
 
   bool bIsNumber = true;
   while (1) {
     if (m_WordSize < kMaxWordBuffer)
       m_WordBuffer[m_WordSize++] = ch;
 
     if (!PDFCharIsNumeric(ch))
       bIsNumber = false;
@@ skipping 29 matching lines @@
     if (memcmp(m_WordBuffer, "false", 5) == 0) {
       m_pLastObj = pdfium::MakeUnique<CPDF_Boolean>(false);
       return Others;
     }
   }
   return Keyword;
 }
 
 std::unique_ptr<CPDF_Object> CPDF_StreamParser::ReadNextObject(
     bool bAllowNestedArray,
-    uint32_t dwInArrayLevel) {
+    bool bInArray,
+    uint32_t dwRecursionLevel) {
   bool bIsNumber;
+  // Must get the next word before returning to avoid infinite loops.
   GetNextWord(bIsNumber);
-  if (!m_WordSize)
+  if (!m_WordSize || dwRecursionLevel > kMaxNestedParsingLevel)
     return nullptr;
 
   if (bIsNumber) {
     m_WordBuffer[m_WordSize] = 0;
     return pdfium::MakeUnique<CPDF_Number>(
         CFX_ByteStringC(m_WordBuffer, m_WordSize));
   }
 
   int first_char = m_WordBuffer[0];
   if (first_char == '/') {
@@ skipping 15 matching lines @@
     while (1) {
       GetNextWord(bIsNumber);
       if (m_WordSize == 2 && m_WordBuffer[0] == '>')
         break;
 
       if (!m_WordSize || m_WordBuffer[0] != '/')
         return nullptr;
 
       CFX_ByteString key =
           PDF_NameDecode(CFX_ByteStringC(m_WordBuffer + 1, m_WordSize - 1));
-      std::unique_ptr<CPDF_Object> pObj = ReadNextObject(true, 0);
+      std::unique_ptr<CPDF_Object> pObj =
+          ReadNextObject(true, bInArray, dwRecursionLevel + 1);
       if (!pObj)
         return nullptr;
 
       if (!key.IsEmpty())
         pDict->SetFor(key, std::move(pObj));
     }
     return std::move(pDict);
   }
 
   if (first_char == '[') {
-    if ((!bAllowNestedArray && dwInArrayLevel) ||
-        dwInArrayLevel > kMaxNestedArrayLevel) {
+    if ((!bAllowNestedArray && bInArray))
       return nullptr;
-    }
 
     auto pArray = pdfium::MakeUnique<CPDF_Array>();
     while (1) {
       std::unique_ptr<CPDF_Object> pObj =
-          ReadNextObject(bAllowNestedArray, dwInArrayLevel + 1);
+          ReadNextObject(bAllowNestedArray, true, dwRecursionLevel + 1);
       if (pObj) {
         pArray->Add(std::move(pObj));
         continue;
       }
       if (!m_WordSize || m_WordBuffer[0] == ']')
         break;
     }
     return std::move(pArray);
   }
 
@@ skipping 219 matching lines @@
 
   if (buf.GetLength() > kMaxStringLength)
     return CFX_ByteString(buf.GetBuffer(), kMaxStringLength);
 
   return buf.MakeString();
 }
 
 bool CPDF_StreamParser::PositionIsInBounds() const {
   return m_Pos < m_Size;
 }