Fix pdftops recursion problem (STR #2293)

git-svn-id: svn+ssh://src.apple.com/svn/cups/cups.org/trunk@6350 7a7537e8-13f0-0310-91df-b6672ffda945

diff --git a/pdftops/Catalog.cxx b/pdftops/Catalog.cxx
index d1ff4cb8e7d078108d917000e4e2fe03717899bd..4fa6e8e9120eeda45ad736c152dc9078ce688142 100644 (file)
--- a/pdftops/Catalog.cxx
+++ b/pdftops/Catalog.cxx
@@ -23,6 +23,12 @@
 #include "Link.h"
 #include "Catalog.h"
 
+// This define is used to limit the depth of recursive readPageTree calls
+// This is needed because the page tree nodes can reference their parents
+// leaving us in an infinite loop
+// Most sane pdf documents don't have a call depth higher than 10
+#define MAX_CALL_DEPTH 1000
+
 //------------------------------------------------------------------------
 // Catalog
 //------------------------------------------------------------------------
@@ -71,7 +77,7 @@ Catalog::Catalog(XRef *xrefA) {
     pageRefs[i].num = -1;
     pageRefs[i].gen = -1;
   }
-  numPages = readPageTree(pagesDict.getDict(), NULL, 0);
+  numPages = readPageTree(pagesDict.getDict(), NULL, 0, 0);
   if (numPages != numPages0) {
     error(-1, "Page count in top-level pages object is incorrect");
   }
@@ -169,7 +175,7 @@ GString *Catalog::readMetadata() {
   return s;
 }
 
-int Catalog::readPageTree(Dict *pagesDict, PageAttrs *attrs, int start) {
+int Catalog::readPageTree(Dict *pagesDict, PageAttrs *attrs, int start, int callDepth) {
   Object kids;
   Object kid;
   Object kidRef;
@@ -214,9 +220,13 @@ int Catalog::readPageTree(Dict *pagesDict, PageAttrs *attrs, int start) {
     // This should really be isDict("Pages"), but I've seen at least one
     // PDF file where the /Type entry is missing.
     } else if (kid.isDict()) {
-      if ((start = readPageTree(kid.getDict(), attrs1, start))
-         < 0)
-       goto err2;
+      if (callDepth > MAX_CALL_DEPTH) {
+        error(-1, "Limit of %d recursive calls reached while reading the page tree. If your document is correct and not a test to try to force a crash, please report a bug.", MAX_CALL_DEPTH);
+      } else {
+        if ((start = readPageTree(kid.getDict(), attrs1, start, callDepth + 1))
+           < 0)
+         goto err2;
+      }
     } else {
       error(-1, "Kid object (page %d) is wrong type (%s)",
            start+1, kid.getTypeName());

diff --git a/pdftops/Catalog.h b/pdftops/Catalog.h
index 08e50cae0cfe2b038571481854ac725b4e8e3388..8cef948180c37714a33841872af826edd71b5f1e 100644 (file)
--- a/pdftops/Catalog.h
+++ b/pdftops/Catalog.h
@@ -85,7 +85,7 @@ private:
   Object acroForm;             // AcroForm dictionary
   GBool ok;                    // true if catalog is valid
 
-  int readPageTree(Dict *pages, PageAttrs *attrs, int start);
+  int readPageTree(Dict *pages, PageAttrs *attrs, int start, int callDepth);
   Object *findDestInTree(Object *tree, GString *name, Object *obj);
 };