Fix a bug that occurs when an object has the same object number with the root object

core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
  
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "../../../include/fpdfapi/fpdf_parser.h"
 #include "../../../include/fpdfapi/fpdf_module.h"
 #include "../../../include/fpdfapi/fpdf_page.h"
 #include "../../../../third_party/numerics/safe_math.h"
@@ skipping 984 matching lines @@
         result = result * 256 + p[i];
     }
     return result;
 }
 FX_BOOL CPDF_Parser::LoadCrossRefV5(FX_FILESIZE pos, FX_FILESIZE& prev, FX_BOOL bMainXRef)
 {
     CPDF_Stream* pStream = (CPDF_Stream*)ParseIndirectObjectAt(m_pDocument, pos, 0, NULL);
     if (!pStream) {
         return FALSE;
     }
-    if (m_pDocument) {
+    if (m_pDocument && m_pDocument->GetRoot()->GetObjNum() != pStream->m_ObjNum) {

[Bo Xu, 2014/12/15 17:49:25]

Could GetRoot() return null?

[jun_fang, 2014/12/15 18:46:48]

m_pRootDict is returned from GetRoot().It's assigned to a root dictionary during
the process of loading documents. If m_pDocument is not NULL, that means the
document is loaded successfully. Otherwise, it can't get here. 

There are two ways to load a document, FPDF_LoadCustomDocument and
FPDFAvail_GetDocument. In both of them, 'm_pDocument->GetRoot() == NULL' is
checked in the functions of CPDF_Parser::StartParse and
CPDF_Parser::StartAsynParse.   

[Tom Sepez, 2014/12/15 19:33:43]

How about returning false if this is the case? Is there a reason to continue?

         m_pDocument->InsertIndirectObject(pStream->m_ObjNum, pStream);
     }
     if (pStream->GetType() != PDFOBJ_STREAM) {
         return FALSE;
     }
     prev = pStream->GetDict()->GetInteger(FX_BSTRC("Prev"));
     FX_INT32 size = pStream->GetDict()->GetInteger(FX_BSTRC("Size"));
     if (size < 0) {
         pStream->Release();
         return FALSE;
@@ skipping 3402 matching lines @@
 {
     FX_INT32 iSize = m_childNode.GetSize();
     for (FX_INT32 i = 0; i < iSize; ++i) {
         CPDF_PageNode *pNode = (CPDF_PageNode*)m_childNode[i];
         if (pNode) {
             delete pNode;
         }
     }
     m_childNode.RemoveAll();
 }