Fix a bug that occurs when an object has the same object number with the root object

core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
  
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "../../../include/fpdfapi/fpdf_parser.h"
 #include "../../../include/fpdfapi/fpdf_module.h"
 #include "../../../include/fpdfapi/fpdf_page.h"
 #include "../../../../third_party/numerics/safe_math.h"
@@ skipping 984 matching lines @@
         result = result * 256 + p[i];
     }
     return result;
 }
 FX_BOOL CPDF_Parser::LoadCrossRefV5(FX_FILESIZE pos, FX_FILESIZE& prev, FX_BOOL bMainXRef)
 {
     CPDF_Stream* pStream = (CPDF_Stream*)ParseIndirectObjectAt(m_pDocument, pos, 0, NULL);
     if (!pStream) {
         return FALSE;
     }
-    if (m_pDocument) {
+    if (m_pDocument && m_pDocument->GetRoot()->GetObjNum() != pStream->m_ObjNum) {

[Tom Sepez, 2014/12/17 18:20:10]

If there's no document, we now fail instead of just continuing.  I think you
need a nested if here.

[jun_fang, 2014/12/17 19:55:53]

I thought that it should return if there was no document. I checked the related
logic again and think that it shall keep the original logic unchanged.

         m_pDocument->InsertIndirectObject(pStream->m_ObjNum, pStream);
+    } else {
+        if (pStream->GetType() == PDFOBJ_STREAM) {
+            pStream->Release();
+        }
+        return FALSE;
     }
     if (pStream->GetType() != PDFOBJ_STREAM) {

[Tom Sepez, 2014/12/17 18:20:10]

can this test move to after line 1004?  Then when you fail at line 1008, there's
no need to release.

[Tom Sepez, 2014/12/17 18:21:28]

Rather, there's no need to check before calling release.  You can avoid an if
block, thats all. Sorry about confusion.

[jun_fang, 2014/12/17 19:55:53]

Before this fix, release is only called when pStream's type is PDFOBJ_STREAM. So
I add the check before calling release.

         return FALSE;
     }
     prev = pStream->GetDict()->GetInteger(FX_BSTRC("Prev"));
     FX_INT32 size = pStream->GetDict()->GetInteger(FX_BSTRC("Size"));
     if (size < 0) {
         pStream->Release();
         return FALSE;
     }
     if (bMainXRef) {
         m_pTrailer = (CPDF_Dictionary*)pStream->GetDict()->Clone();
@@ skipping 3399 matching lines @@
 {
     FX_INT32 iSize = m_childNode.GetSize();
     for (FX_INT32 i = 0; i < iSize; ++i) {
         CPDF_PageNode *pNode = (CPDF_PageNode*)m_childNode[i];
         if (pNode) {
             delete pNode;
         }
     }
     m_childNode.RemoveAll();
 }