commit 0c9f1d8f6dd6bb8b9c3eba73e4ffd0bb2ca4fd97
author Lei Zhang <thestig@chromium.org> Sun Aug 30 22:45:08 2015 -0700
committer Lei Zhang <thestig@chromium.org> Sun Aug 30 22:45:08 2015 -0700
tree 4b59250ccc60afd100a0a32b0c70ea7b0c894d92
parent 5e4a5cc9ad76dc08d62fb1e10bdfb811f3720c43

Fix infinite loop for objects that reference themselves.

BUG=pdfium:193
R=jun_fang@foxitsoftware.com

Review URL: https://codereview.chromium.org/1306793002 .

core/src/fpdfapi/fpdf_parser/fpdf_parser_objects.cpp

diff --git a/core/src/fpdfapi/fpdf_parser/fpdf_parser_objects.cpp b/core/src/fpdfapi/fpdf_parser/fpdf_parser_objects.cpp
index 592a7b1..e1e821c 100644
--- a/core/src/fpdfapi/fpdf_parser/fpdf_parser_objects.cpp
+++ b/core/src/fpdfapi/fpdf_parser/fpdf_parser_objects.cpp
@@ -53,7 +53,7 @@
         break;
       }
       CPDF_Object* pObj =
-          pRef->m_pObjList->GetIndirectObject(pRef->m_RefObjNum);
+          pRef->m_pObjList->GetIndirectObject(pRef->GetRefObjNum());
       if (pObj == NULL) {
         return CFX_ByteString();
       }
@@ -76,7 +76,7 @@
         break;
       }
       CPDF_Object* pObj =
-          pRef->m_pObjList->GetIndirectObject(pRef->m_RefObjNum);
+          pRef->m_pObjList->GetIndirectObject(pRef->GetRefObjNum());
       if (pObj == NULL) {
         return CFX_ByteStringC();
       }
@@ -95,7 +95,7 @@
         break;
       }
       CPDF_Object* pObj =
-          pRef->m_pObjList->GetIndirectObject(pRef->m_RefObjNum);
+          pRef->m_pObjList->GetIndirectObject(pRef->GetRefObjNum());
       if (pObj == NULL) {
         return 0;
       }
@@ -125,7 +125,7 @@
         return 0;
       }
       CPDF_Object* pObj =
-          pRef->m_pObjList->GetIndirectObject(pRef->m_RefObjNum, &context);
+          pRef->m_pObjList->GetIndirectObject(pRef->GetRefObjNum(), &context);
       if (pObj == NULL) {
         return 0;
       }
@@ -134,6 +134,7 @@
   }
   return 0;
 }
+
 CPDF_Dictionary* CPDF_Object::GetDict() const {
   switch (m_Type) {
     case PDFOBJ_DICTIONARY:
@@ -142,19 +143,19 @@
       return ((CPDF_Stream*)this)->GetDict();
     case PDFOBJ_REFERENCE: {
       CPDF_Reference* pRef = (CPDF_Reference*)this;
-      if (pRef->m_pObjList == NULL) {
-        break;
-      }
-      CPDF_Object* pObj =
-          pRef->m_pObjList->GetIndirectObject(pRef->m_RefObjNum);
-      if (pObj == NULL) {
-        return NULL;
-      }
+      CPDF_IndirectObjects* pIndirect = pRef->GetObjList();
+      if (!pIndirect)
+        return nullptr;
+      CPDF_Object* pObj = pIndirect->GetIndirectObject(pRef->GetRefObjNum());
+      if (!pObj || (pObj == this))
+        return nullptr;
       return pObj->GetDict();
     }
+    default:
+      return nullptr;
   }
-  return NULL;
 }
+
 CPDF_Array* CPDF_Object::GetArray() const {
   if (m_Type == PDFOBJ_ARRAY)
     return (CPDF_Array*)this;
@@ -184,7 +185,7 @@
     return m_Type;
   }
   CPDF_Reference* pRef = (CPDF_Reference*)this;
-  return pRef->m_pObjList->GetIndirectType(pRef->m_RefObjNum);
+  return pRef->m_pObjList->GetIndirectType(pRef->GetRefObjNum());
 }
 FX_BOOL CPDF_Object::IsIdentical(CPDF_Object* pOther) const {
   if (this == pOther) {
@@ -232,7 +233,7 @@
   if (pRef->m_pObjList == NULL) {
     return NULL;
   }
-  return pRef->m_pObjList->GetIndirectObject(pRef->m_RefObjNum);
+  return pRef->m_pObjList->GetIndirectObject(pRef->GetRefObjNum());
 }
 CPDF_Object* CPDF_Object::Clone(FX_BOOL bDirect) const {
   CFX_MapPtrToPtr visited;
@@ -289,7 +290,7 @@
     }
     case PDFOBJ_REFERENCE: {
       CPDF_Reference* pRef = (CPDF_Reference*)this;
-      FX_DWORD obj_num = pRef->m_RefObjNum;
+      FX_DWORD obj_num = pRef->GetRefObjNum();
       if (bDirect && !visited->GetValueAt((void*)(uintptr_t)obj_num)) {
         visited->SetAt((void*)(uintptr_t)obj_num, (void*)1);
         if (!pRef->GetDirect())