Fix a bug that occurs when an object has the same object number with the root object

core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp

Index: core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp
diff --git a/core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp b/core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp
index 2f834ea400b8f3be2e1f3a313dabf30676746180..c49f8001e30fc699fcf61050b81f2ae303c4ee89 100644
--- a/core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp
+++ b/core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp
@@ -1002,8 +1002,13 @@ FX_BOOL CPDF_Parser::LoadCrossRefV5(FX_FILESIZE pos, FX_FILESIZE& prev, FX_BOOL
     if (!pStream) {
         return FALSE;
     }
-    if (m_pDocument) {
+    if (m_pDocument && m_pDocument->GetRoot()->GetObjNum() != pStream->m_ObjNum) {

[Tom Sepez, 2014/12/17 18:20:10]

If there's no document, we now fail instead of just continuing.  I think you
need a nested if here.

[jun_fang, 2014/12/17 19:55:53]

I thought that it should return if there was no document. I checked the related
logic again and think that it shall keep the original logic unchanged.

         m_pDocument->InsertIndirectObject(pStream->m_ObjNum, pStream);
+    } else {
+        if (pStream->GetType() == PDFOBJ_STREAM) {
+            pStream->Release();
+        }
+        return FALSE;
     }
     if (pStream->GetType() != PDFOBJ_STREAM) {

[Tom Sepez, 2014/12/17 18:20:10]

can this test move to after line 1004?  Then when you fail at line 1008, there's
no need to release.

[Tom Sepez, 2014/12/17 18:21:28]

Rather, there's no need to check before calling release.  You can avoid an if
block, thats all. Sorry about confusion.

[jun_fang, 2014/12/17 19:55:53]

Before this fix, release is only called when pStream's type is PDFOBJ_STREAM. So
I add the check before calling release.

         return FALSE;