Fix stack exhaustion in CPDF_DataAvail::HaveResourceAncestor()

core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
  
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "../../../include/fpdfapi/fpdf_parser.h"
 #include "../../../include/fpdfapi/fpdf_module.h"
 #include "../../../include/fpdfapi/fpdf_page.h"
 #include "../../../../third_party/numerics/safe_math.h"
@@ skipping 2725 matching lines @@
     virtual FX_INT32                    IsFormAvail(IFX_DownloadHints *pHints)  FX_OVERRIDE;
 
     virtual FX_INT32                    IsLinearizedPDF()  FX_OVERRIDE;
 
     virtual FX_BOOL                     IsLinearized()  FX_OVERRIDE
     {
         return m_bLinearized;
     }
 
     virtual void                        GetLinearizedMainXRefInfo(FX_FILESIZE *pPos, FX_DWORD *pSize)  FX_OVERRIDE;
+
 protected:
+    static const int kMaxDataAvailRecursionDepth = 64;
+    static int s_CurrentDataAvailRecursionDepth;
+
     FX_DWORD                            GetObjectSize(FX_DWORD objnum, FX_FILESIZE& offset);
     FX_BOOL                             IsObjectsAvail(CFX_PtrArray& obj_array, FX_BOOL bParsePage, IFX_DownloadHints* pHints, CFX_PtrArray &ret_array);
     FX_BOOL                             CheckDocStatus(IFX_DownloadHints *pHints);
     FX_BOOL                             CheckHeader(IFX_DownloadHints* pHints);
     FX_BOOL                             CheckFirstPage(IFX_DownloadHints *pHints);
     FX_BOOL                             CheckEnd(IFX_DownloadHints *pHints);
     FX_BOOL                             CheckCrossRef(IFX_DownloadHints* pHints);
     FX_BOOL                             CheckCrossRefItem(IFX_DownloadHints *pHints);
     FX_BOOL                             CheckTrailer(IFX_DownloadHints* pHints);
     FX_BOOL                             CheckRoot(IFX_DownloadHints* pHints);
@@ skipping 155 matching lines @@
     m_pFileAvail(pFileAvail),
     m_pFileRead(pFileRead) {
 }
 
 // static
 IPDF_DataAvail* IPDF_DataAvail::Create(IFX_FileAvail* pFileAvail, IFX_FileRead* pFileRead)
 {
   return FX_NEW CPDF_DataAvail(pFileAvail, pFileRead);
 }
 
+// static
+int CPDF_DataAvail::s_CurrentDataAvailRecursionDepth = 0;
+
 CPDF_DataAvail::CPDF_DataAvail(IFX_FileAvail* pFileAvail, IFX_FileRead* pFileRead)
     : IPDF_DataAvail(pFileAvail, pFileRead)
 {
     m_Pos = 0;
     m_dwFileLen = 0;
     if (m_pFileRead) {
         m_dwFileLen = (FX_DWORD)m_pFileRead->GetSize();
     }
     m_dwCurrentOffset = 0;
     m_WordSize = 0;
@@ skipping 1456 matching lines @@
     }
     if (m_bAnnotsLoad)
         if (!CheckLinearizedData(pHints)) {
             return FALSE;
         }
     m_bPageLoadedOK = FALSE;
     return TRUE;
 }
 FX_BOOL CPDF_DataAvail::HaveResourceAncestor(CPDF_Dictionary *pDict)
 {
+    CFX_AutoRestorer<int> restorer(&s_CurrentDataAvailRecursionDepth);
+    if (++s_CurrentDataAvailRecursionDepth > kMaxDataAvailRecursionDepth) {
+        return FALSE;
+    }
     CPDF_Object *pParent = pDict->GetElement("Parent");
     if (!pParent) {
         return FALSE;
     }
     CPDF_Dictionary *pParentDict = pParent->GetDict();
     if (!pParentDict) {
         return FALSE;
     }
     CPDF_Object *pRet = pParentDict->GetElement("Resources");
     if (pRet) {
         m_pPageResource = pRet;
         return TRUE;
-    } else {
-        return HaveResourceAncestor(pParentDict);
     }
+    return HaveResourceAncestor(pParentDict);
 }
 FX_BOOL CPDF_DataAvail::IsPageAvail(FX_INT32 iPage, IFX_DownloadHints* pHints)
 {
     if (!m_pDocument) {
         return FALSE;
     }
     if (IsFirstCheck(iPage)) {
         m_bCurPageDictLoadOK = FALSE;
         m_bPageLoadedOK = FALSE;
         m_bAnnotsLoad = FALSE;
@@ skipping 205 matching lines @@
 {
     FX_INT32 iSize = m_childNode.GetSize();
     for (FX_INT32 i = 0; i < iSize; ++i) {
         CPDF_PageNode *pNode = (CPDF_PageNode*)m_childNode[i];
         if (pNode) {
             delete pNode;
         }
     }
     m_childNode.RemoveAll();
 }