#130 [podofo-0.9.7]Stack-Overflow in src/base/PdfTokenizer.cpp

[treebacker]

In source codesrc/base/PdfTokenizer.cpp，there is a Recursive call among three functions.

As below code shows:

void PdfTokenizer::ReadArray( PdfVariant& rVariant, PdfEncrypt* pEncrypt )
{
    for( ;; )
    {
        .....
        this->GetNextVariant( pszToken, eType, var, pEncrypt );// a -> b
        array.push_back( var );
    }

    rVariant = array;
}


void PdfTokenizer::GetNextVariant( const char* pszToken, EPdfTokenType eType, PdfVariant& rVariant, PdfEncrypt* pEncrypt )
{
    EPdfDataType eDataType = this->DetermineDataType( pszToken, eType, rVariant );
    .....
    this->ReadDataType( eDataType, rVariant, pEncrypt );        //b -> c
}

void PdfTokenizer::ReadDataType( EPdfDataType eDataType, PdfVariant& rVariant, PdfEncrypt* pEncrypt )
{
    switch( eDataType )
    {
         ...
        case ePdfDataType_Array:
            this->ReadArray( rVariant, pEncrypt );              //c -> a
            break;
     }
 ....
}

Above three functions make a Recursive call，with a crafted pdf, it will raise a stack overflow .

Crash state， run command : podofopdfinfo/podofopdfinfo bug2

The crafted file is attached.

[Mattia Rizzolo]

This is CVE-2021-30470