Merge pull request #8824 from Snuffleupagus/bug-1393476

Prevent an infinite loop in `XRef.readXRef` by keeping track of already parsed tables (bug 1393476)

src/core/obj.js

@@ -1186,11 +1186,22 @@ var XRef = (function XRefClosure() {
 
  readXRef: function XRef_readXRef(recoveryMode) {
  var stream = this.stream;
+ // Keep track of already parsed XRef tables, to prevent an infinite loop
+ // when parsing corrupt PDF files where e.g. the /Prev entries create a
+ // circular dependency between tables (fixes bug1393476.pdf).
+ let startXRefParsedCache = Object.create(null);
 
  try {
  while (this.startXRefQueue.length) {
  var startXRef = this.startXRefQueue[0];
 
+ if (startXRefParsedCache[startXRef]) {
+ warn('readXRef - skipping XRef table since it was already parsed.');
+ this.startXRefQueue.shift();
+ continue;
+ }
+ startXRefParsedCache[startXRef] = true;
+
  stream.pos = startXRef + stream.start;
 
  var parser = new Parser(new Lexer(stream), true, this);

test/pdfs/bug1393476.pdf.link

@@ -0,0 +1 @@
+https://bugzilla.mozilla.org/attachment.cgi?id=8900754

test/test_manifest.json

@@ -820,6 +820,13 @@
  "link": false,
  "type": "eq"
  },
+ { "id": "bug1393476",
+ "file": "pdfs/bug1393476.pdf",
+ "md5": "163ee8727c77f27ee651eec777bb20a9",
+ "rounds": 1,
+ "link": true,
+ "type": "eq"
+ },
  { "id": "bug1252420",
  "file": "pdfs/bug1252420.pdf",
  "md5": "f21c911b9b655972b06ef782a1fa6a17",