Fix infinite recursion in CPDF_Parser::ParseIndirectObjectAt().

core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
  
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "../../../include/fpdfapi/fpdf_parser.h"
 #include "../../../include/fpdfapi/fpdf_module.h"
 #include "../../../include/fpdfapi/fpdf_page.h"
 #include "../../../../third_party/numerics/safe_math.h"
 #include "../fpdf_page/pageint.h"
 #include <utility>
 #include <vector>
 
-#define _PARSER_OBJECT_LEVLE_           64
 extern const FX_LPCSTR _PDF_CharType;
 FX_BOOL IsSignatureDict(const CPDF_Dictionary* pDict)
 {
     CPDF_Object* pType = pDict->GetElementValue(FX_BSTRC("Type"));
     if (!pType) {
         pType = pDict->GetElementValue(FX_BSTRC("FT"));
         if (!pType) {
             return FALSE;
         }
     }
     if (pType->GetString() == FX_BSTRC("Sig")) {
         return TRUE;
     }
     return FALSE;
 }
 static int _CompareFileSize(const void* p1, const void* p2)
 {
     FX_FILESIZE ret = (*(FX_FILESIZE*)p1) - (*(FX_FILESIZE*)p2);
     if (ret > 0) {
         return 1;
     }
     if (ret < 0) {
         return -1;
     }
     return 0;
 }
+
 CPDF_Parser::CPDF_Parser()
 {
     m_pDocument = NULL;
     m_pTrailer = NULL;
     m_pEncryptDict = NULL;
     m_pSecurityHandler = NULL;
     m_pLinearized = NULL;
     m_dwFirstPageNo = 0;
     m_dwXrefStartObjNum = 0;
     m_bOwnFileRead = TRUE;
@@ skipping 1158 matching lines @@
         FX_INT32 offset = pObjStream->GetDict()->GetInteger(FX_BSTRC("First"));
         CPDF_SyntaxParser syntax;
         CFX_SmartPointer<IFX_FileStream> file(FX_CreateMemoryStream((FX_LPBYTE)pObjStream->GetData(), (size_t)pObjStream->GetSize(), FALSE));
         syntax.InitParser((IFX_FileStream*)file, 0);
         CPDF_Object* pRet = NULL;
         while (n) {
             FX_DWORD thisnum = syntax.GetDirectNum();
             FX_DWORD thisoff = syntax.GetDirectNum();
             if (thisnum == objnum) {
                 syntax.RestorePos(offset + thisoff);
-                pRet = syntax.GetObject(pObjList, 0, 0, 0, pContext);
+                pRet = syntax.GetObject(pObjList, 0, 0, pContext);
                 break;
             }
             n --;
         }
         return pRet;
     }
     return NULL;
 }
 CPDF_StreamAcc* CPDF_Parser::GetObjectStream(FX_DWORD objnum)
 {
@@ skipping 158 matching lines @@
     word = m_Syntax.GetNextWord(bIsNumber);
     if (!bIsNumber) {
         m_Syntax.RestorePos(SavedPos);
         return NULL;
     }
     FX_DWORD parser_gennum = FXSYS_atoi(word);
     if (m_Syntax.GetKeyword() != FX_BSTRC("obj")) {
         m_Syntax.RestorePos(SavedPos);
         return NULL;
     }
-    CPDF_Object* pObj = m_Syntax.GetObject(pObjList, objnum, parser_gennum, 0, pContext);
+    CPDF_Object* pObj = m_Syntax.GetObject(pObjList, objnum, parser_gennum, pContext);
     FX_FILESIZE endOffset = m_Syntax.SavePos();
     CFX_ByteString bsWord = m_Syntax.GetKeyword();
     if (bsWord == FX_BSTRC("endobj")) {
         endOffset = m_Syntax.SavePos();
     }
     m_Syntax.RestorePos(SavedPos);
     if (pObj) {
         if (!objnum) {
             pObj->m_ObjNum = parser_objnum;
         }
@@ skipping 20 matching lines @@
     word = m_Syntax.GetNextWord(bIsNumber);
     if (!bIsNumber) {
         m_Syntax.RestorePos(SavedPos);
         return NULL;
     }
     FX_DWORD gennum = FXSYS_atoi(word);
     if (m_Syntax.GetKeyword() != FX_BSTRC("obj")) {
         m_Syntax.RestorePos(SavedPos);
         return NULL;
     }
-    CPDF_Object* pObj = m_Syntax.GetObjectByStrict(pObjList, objnum, gennum, 0, pContext);
+    CPDF_Object* pObj = m_Syntax.GetObjectByStrict(pObjList, objnum, gennum, pContext);
     if (pResultPos) {
         *pResultPos = m_Syntax.m_Pos;
     }
     m_Syntax.RestorePos(SavedPos);
     return pObj;
 }
 CPDF_Dictionary* CPDF_Parser::LoadTrailerV4()
 {
     if (m_Syntax.GetKeyword() != FX_BSTRC("trailer")) {
         return NULL;
@@ skipping 218 matching lines @@
     m_ObjectStreamMap.RemoveAll();
     if (!LoadLinearizedAllCrossRefV4(m_LastXRefOffset, m_dwXrefStartObjNum) && !LoadLinearizedAllCrossRefV5(m_LastXRefOffset)) {
         m_LastXRefOffset = 0;
         m_Syntax.m_MetadataObjnum = dwSaveMetadataObjnum;
         return PDFPARSE_ERROR_FORMAT;
     }
     FXSYS_qsort(m_SortedOffset.GetData(), m_SortedOffset.GetSize(), sizeof(FX_FILESIZE), _CompareFileSize);
     m_Syntax.m_MetadataObjnum = dwSaveMetadataObjnum;
     return PDFPARSE_ERROR_SUCCESS;
 }
+
+// static
+int CPDF_SyntaxParser::s_CurrentRecursionDepth = 0;
+
 CPDF_SyntaxParser::CPDF_SyntaxParser()
 {
     m_pFileAccess = NULL;
     m_pCryptoHandler = NULL;
     m_pFileBuf = NULL;
     m_BufSize = CPDF_ModuleMgr::Get()->m_FileBufSize;
     m_pFileBuf = NULL;
     m_MetadataObjnum = 0;
     m_dwWordPos = 0;
     m_bFileStream = FALSE;
@@ skipping 353 matching lines @@
 {
     GetNextWord();
     bIsNumber = m_bIsNumber;
     return CFX_ByteString((FX_LPCSTR)m_WordBuffer, m_WordSize);
 }
 CFX_ByteString CPDF_SyntaxParser::GetKeyword()
 {
     GetNextWord();
     return CFX_ByteString((FX_LPCSTR)m_WordBuffer, m_WordSize);
 }
-CPDF_Object* CPDF_SyntaxParser::GetObject(CPDF_IndirectObjects* pObjList, FX_DWORD objnum, FX_DWORD gennum, FX_INT32 level, PARSE_CONTEXT* pContext, FX_BOOL bDecrypt)
+CPDF_Object* CPDF_SyntaxParser::GetObject(CPDF_IndirectObjects* pObjList, FX_DWORD objnum, FX_DWORD gennum, PARSE_CONTEXT* pContext, FX_BOOL bDecrypt)
 {
-    if (level > _PARSER_OBJECT_LEVLE_) {
+    CFX_AutoRestorer<int> restorer(&s_CurrentRecursionDepth);
+    if (++s_CurrentRecursionDepth > kParserMaxRecursionDepth) {
         return NULL;
     }
     FX_FILESIZE SavedPos = m_Pos;
     FX_BOOL bTypeOnly = pContext && (pContext->m_Flags & PDFPARSE_TYPEONLY);
     FX_BOOL bIsNumber;
     CFX_ByteString word = GetNextWord(bIsNumber);
     CPDF_Object* pRet = NULL;
     if (word.GetLength() == 0) {
         if (bTypeOnly) {
             return (CPDF_Object*)PDFOBJ_INVALID;
@@ skipping 64 matching lines @@
         }
         pRet = CPDF_String::Create(str, TRUE);
         return pRet;
     }
     if (word == FX_BSTRC("[")) {
         if (bTypeOnly) {
             return (CPDF_Object*)PDFOBJ_ARRAY;
         }
         CPDF_Array* pArray = CPDF_Array::Create();
         while (1) {
-            CPDF_Object* pObj = GetObject(pObjList, objnum, gennum, level + 1);
+            CPDF_Object* pObj = GetObject(pObjList, objnum, gennum);
             if (pObj == NULL) {
                 return pArray;
             }
             pArray->Add(pObj);
         }
     }
     if (word[0] == '/') {
         if (bTypeOnly) {
             return (CPDF_Object*)PDFOBJ_NAME;
         }
@@ skipping 31 matching lines @@
                 break;
             }
             if (key[0] != '/') {
                 continue;
             }
             nKeys ++;
             key = PDF_NameDecode(key);
             if (key == FX_BSTRC("/Contents")) {
                 dwSignValuePos = m_Pos;
             }
-            CPDF_Object* pObj = GetObject(pObjList, objnum, gennum, level + 1);
+            CPDF_Object* pObj = GetObject(pObjList, objnum, gennum);
             if (pObj == NULL) {
                 continue;
             }
             if (key.GetLength() >= 1) {
                 if (nKeys < 32) {
                     pDict->SetAt(CFX_ByteStringC(key.c_str() + 1, key.GetLength() - 1), pObj);
                 } else {
                     pDict->AddValue(CFX_ByteStringC(key.c_str() + 1, key.GetLength() - 1), pObj);
                 }
             }
         }
         if (IsSignatureDict(pDict)) {
             FX_FILESIZE dwSavePos = m_Pos;
             m_Pos = dwSignValuePos;
-            CPDF_Object* pObj = GetObject(pObjList, objnum, gennum, level + 1, NULL, FALSE);
+            CPDF_Object* pObj = GetObject(pObjList, objnum, gennum, NULL, FALSE);
             pDict->SetAt(FX_BSTRC("Contents"), pObj);
             m_Pos = dwSavePos;
         }
         if (pContext) {
             pContext->m_DictEnd = m_Pos;
             if (pContext->m_Flags & PDFPARSE_NOSTREAM) {
                 return pDict;
             }
         }
         FX_FILESIZE SavedPos = m_Pos;
@@ skipping 14 matching lines @@
     }
     if (word == FX_BSTRC(">>")) {
         m_Pos = SavedPos;
         return NULL;
     }
     if (bTypeOnly) {
         return (CPDF_Object*)PDFOBJ_INVALID;
     }
     return NULL;
 }
-CPDF_Object* CPDF_SyntaxParser::GetObjectByStrict(CPDF_IndirectObjects* pObjList, FX_DWORD objnum, FX_DWORD gennum,
-        FX_INT32 level, struct PARSE_CONTEXT* pContext)
+CPDF_Object* CPDF_SyntaxParser::GetObjectByStrict(CPDF_IndirectObjects* pObjList, FX_DWORD objnum, FX_DWORD gennum, struct PARSE_CONTEXT* pContext)
 {
-    if (level > _PARSER_OBJECT_LEVLE_) {
+    CFX_AutoRestorer<int> restorer(&s_CurrentRecursionDepth);
+    if (++s_CurrentRecursionDepth > kParserMaxRecursionDepth) {
         return NULL;
     }
     FX_FILESIZE SavedPos = m_Pos;
     FX_BOOL bTypeOnly = pContext && (pContext->m_Flags & PDFPARSE_TYPEONLY);
     FX_BOOL bIsNumber;
     CFX_ByteString word = GetNextWord(bIsNumber);
     if (word.GetLength() == 0) {
         if (bTypeOnly) {
             return (CPDF_Object*)PDFOBJ_INVALID;
         }
@@ skipping 56 matching lines @@
             m_pCryptoHandler->Decrypt(objnum, gennum, str);
         }
         return CPDF_String::Create(str, TRUE);
     }
     if (word == FX_BSTRC("[")) {
         if (bTypeOnly) {
             return (CPDF_Object*)PDFOBJ_ARRAY;
         }
         CPDF_Array* pArray = CPDF_Array::Create();
         while (1) {
-            CPDF_Object* pObj = GetObject(pObjList, objnum, gennum, level + 1);
+            CPDF_Object* pObj = GetObject(pObjList, objnum, gennum);
             if (pObj == NULL) {
                 if (m_WordBuffer[0] == ']') {
                     return pArray;
                 }
                 if (pArray)
                     pArray->Release();
                 return NULL;
             }
             pArray->Add(pObj);
         }
@@ skipping 25 matching lines @@
                 break;
             }
             if (key == FX_BSTRC("endobj")) {
                 m_Pos = SavedPos;
                 break;
             }
             if (key[0] != '/') {
                 continue;
             }
             key = PDF_NameDecode(key);
-            CPDF_Object* pObj = GetObject(pObjList, objnum, gennum, level + 1);
+            CPDF_Object* pObj = GetObject(pObjList, objnum, gennum);
             if (pObj == NULL) {
                 if (pDict)
                     pDict->Release();
                 FX_BYTE ch;
                 while (1) {
                     if (!GetNextChar(ch)) {
                         break;
                     }
                     if (ch == 0x0A || ch == 0x0D) {
                         break;
@@ skipping 2246 matching lines @@
 {
     FX_INT32 iSize = m_childNode.GetSize();
     for (FX_INT32 i = 0; i < iSize; ++i) {
         CPDF_PageNode *pNode = (CPDF_PageNode*)m_childNode[i];
         if (pNode) {
             delete pNode;
         }
     }
     m_childNode.RemoveAll();
 }