commit 00fc829352716b04d9ab59552daefffed20e2852
author Thomas Freitag <Thomas.Freitag@alfa.de> Thu Dec 28 00:55:00 2017 +0100
committer Albert Astals Cid <aacid@kde.org> Thu Dec 28 00:55:00 2017 +0100
tree 5bf884acff314d75e2805280d8a75cab4237f2f3
parent e41ce80a27b735df8e2ccc17e15adea012543712

Break loop if recursionLimit is reached

poppler/Parser.cc

diff --git a/poppler/Parser.cc b/poppler/Parser.cc
index 4b39902..3aee5f0 100644
--- a/poppler/Parser.cc
+++ b/poppler/Parser.cc
@@ -89,10 +89,11 @@
   if (!simpleOnly && buf1.isCmd("[")) {
     shift();
     obj = Object(new Array(xref));
-    while (!buf1.isCmd("]") && !buf1.isEOF()) {
+    while (!buf1.isCmd("]") && !buf1.isEOF() && recursion + 1 < recursionLimit) {
       Object obj2 = getObj(gFalse, fileKey, encAlgorithm, keyLength, objNum, objGen, recursion + 1);
       obj.arrayAdd(std::move(obj2));
     }
+    if (recursion + 1 >= recursionLimit && strict) goto err;
     if (buf1.isEOF()) {
       error(errSyntaxError, getPos(), "End of file inside array");
       if (strict) goto err;