commit 7c2daec0a5f5d5e0f442db7946e9356daa7c55b2
author Henrique Nakashima <hnakashima@chromium.org> Tue Oct 17 16:00:23 2017 -0400
committer Chromium commit bot <commit-bot@chromium.org> Tue Oct 17 20:52:18 2017 +0000
tree da027ac8fea5854b0bc3cda3336dbe7970e511cd
parent 6dc4fb899acfee6261a44cde8015b5c8f3eb75a3

Fix loading mutually referencing colorspaces.

CPDF_DeviceNCS and CPDF_SeparationCS can load other colorspaces and
their v_Load() needs to pass around a set of visited spaces to avoid
stack overflows if that other colorspace references the first one.

Bug: chromium:773095
Change-Id: Idae26c95a8034c3ded70f70e20ae1c414d7b29c3
Reviewed-on: https://pdfium-review.googlesource.com/16250
Reviewed-by: Ryan Harrison <rharrison@chromium.org>
Commit-Queue: Henrique Nakashima <hnakashima@chromium.org>

core/fpdfapi/page/cpdf_colorspace.cpp

diff --git a/core/fpdfapi/page/cpdf_colorspace.cpp b/core/fpdfapi/page/cpdf_colorspace.cpp
index 97a0c15..dd13bf5 100644
--- a/core/fpdfapi/page/cpdf_colorspace.cpp
+++ b/core/fpdfapi/page/cpdf_colorspace.cpp
@@ -1091,7 +1091,7 @@
   if (pAltCS == m_pArray)
     return false;
 
-  m_pAltCS = Load(pDoc, pAltCS);
+  m_pAltCS = Load(pDoc, pAltCS, pVisited);
   if (!m_pAltCS)
     return false;
 
@@ -1169,7 +1169,7 @@
   if (!pAltCS || pAltCS == m_pArray)
     return false;
 
-  m_pAltCS = Load(pDoc, pAltCS);
+  m_pAltCS = Load(pDoc, pAltCS, pVisited);
   m_pFunc = CPDF_Function::Load(pArray->GetDirectObjectAt(3));
   if (!m_pAltCS || !m_pFunc)
     return false;