commit 3d7b555aa843b026c9dcb6b0f855af1d358ef2ba
author Henrique Nakashima <hnakashima@chromium.org> Tue Jul 17 20:47:27 2018 +0000
committer Chromium commit bot <commit-bot@chromium.org> Tue Jul 17 20:47:27 2018 +0000
tree 66a3e9b7bfe0d640ac70a5af1a4401c64d242ab2
parent d563855ac72ba9dcec7f111587d6efaafc715b0d

Limit recursion depth for CXFA_DocumentParser::NormalLoader().

Bug: chromium:849143
Change-Id: I973bb3be6151ac3afad850533cb735c03e9f3d2c
Reviewed-on: https://pdfium-review.googlesource.com/38210
Reviewed-by: Ryan Harrison <rharrison@chromium.org>
Commit-Queue: Henrique Nakashima <hnakashima@chromium.org>

xfa/fxfa/parser/cxfa_document_parser.cpp

diff --git a/xfa/fxfa/parser/cxfa_document_parser.cpp b/xfa/fxfa/parser/cxfa_document_parser.cpp
index 599662a..8e5ff9f 100644
--- a/xfa/fxfa/parser/cxfa_document_parser.cpp
+++ b/xfa/fxfa/parser/cxfa_document_parser.cpp
@@ -9,6 +9,7 @@
 #include <utility>
 #include <vector>
 
+#include "core/fxcrt/autorestorer.h"
 #include "core/fxcrt/cfx_memorystream.h"
 #include "core/fxcrt/cfx_widetextbuf.h"
 #include "core/fxcrt/fx_codepage.h"
@@ -768,6 +769,12 @@
                                              CFX_XMLNode* pXMLDoc,
                                              XFA_PacketType ePacketID,
                                              bool bUseAttribute) {
+  constexpr const unsigned long kMaxExecuteRecursion = 1000;
+  if (m_ExecuteRecursionDepth > kMaxExecuteRecursion)
+    return nullptr;
+  AutoRestorer<unsigned long> restorer(&m_ExecuteRecursionDepth);
+  ++m_ExecuteRecursionDepth;
+
   bool bOneOfPropertyFound = false;
   for (CFX_XMLNode* pXMLChild = pXMLDoc->GetFirstChild(); pXMLChild;
        pXMLChild = pXMLChild->GetNextSibling()) {

xfa/fxfa/parser/cxfa_document_parser.h

diff --git a/xfa/fxfa/parser/cxfa_document_parser.h b/xfa/fxfa/parser/cxfa_document_parser.h
index 04ed5ab..4e75db9 100644
--- a/xfa/fxfa/parser/cxfa_document_parser.h
+++ b/xfa/fxfa/parser/cxfa_document_parser.h
@@ -75,6 +75,7 @@
   std::unique_ptr<CFX_XMLDocument> xml_doc_;
   // TODO(dsinclair): Figure out who owns this.
   CXFA_Node* m_pRootNode = nullptr;
+  unsigned long m_ExecuteRecursionDepth = 0;
 };
 
 #endif  // XFA_FXFA_PARSER_CXFA_DOCUMENT_PARSER_H_