commit 7831f57f04ad3f581222b0a23eeb736601f98e96
author Lei Zhang <thestig@chromium.org> Fri Apr 28 11:51:08 2017 -0700
committer Chromium commit bot <commit-bot@chromium.org> Fri Apr 28 19:06:30 2017 +0000
tree 98e12dd2169dfceda9bf3450ff3e0ae9ef46dc1c
parent 66568bcd683dd7b18672cb3aebca4487e9203519

Fix stack overflow in CFieldTree::Node::GetFieldInternal().

Limit recursion depth, just like in CountFieldsInternal().

BUG=chromium:716523

Change-Id: I70c052347a1d8fb9a4dbc065a1c9af55c02818f2
Reviewed-on: https://pdfium-review.googlesource.com/4612
Reviewed-by: Tom Sepez <tsepez@chromium.org>
Commit-Queue: Lei Zhang <thestig@chromium.org>

core/fpdfdoc/cpdf_interform.cpp

diff --git a/core/fpdfdoc/cpdf_interform.cpp b/core/fpdfdoc/cpdf_interform.cpp
index f498617..5fbb395 100644
--- a/core/fpdfdoc/cpdf_interform.cpp
+++ b/core/fpdfdoc/cpdf_interform.cpp
@@ -408,7 +408,7 @@
 
     CPDF_FormField* GetFieldAtIndex(size_t index) {
       size_t nFieldsToGo = index;
-      return GetFieldInternal(&nFieldsToGo);
+      return GetFieldInternal(&nFieldsToGo, 0);
     }
 
     size_t CountFields() const { return CountFieldsInternal(0); }
@@ -422,7 +422,10 @@
     const CFX_WideString& GetShortName() const { return m_ShortName; }
 
    private:
-    CPDF_FormField* GetFieldInternal(size_t* pFieldsToGo) {
+    CPDF_FormField* GetFieldInternal(size_t* pFieldsToGo, int nLevel) {
+      if (nLevel > nMaxRecursion)
+        return nullptr;
+
       if (m_pField) {
         if (*pFieldsToGo == 0)
           return m_pField.get();
@@ -430,7 +433,8 @@
         --*pFieldsToGo;
       }
       for (size_t i = 0; i < GetChildrenCount(); ++i) {
-        CPDF_FormField* pField = GetChildAt(i)->GetFieldInternal(pFieldsToGo);
+        CPDF_FormField* pField =
+            GetChildAt(i)->GetFieldInternal(pFieldsToGo, nLevel + 1);
         if (pField)
           return pField;
       }