Backport of:

From 2c92c7b6a828c9db8a38f079ea7a3d51c12a481d Mon Sep 17 00:00:00 2001
From: Albert Astals Cid <aacid@kde.org>
Date: Mon, 25 Sep 2017 19:33:44 +0200
Subject: Fix infinite recursion on broken files

Bug #102969
Index: poppler-0.41.0/poppler/Gfx.cc
===================================================================
--- poppler-0.41.0.orig/poppler/Gfx.cc
+++ poppler-0.41.0/poppler/Gfx.cc
@@ -465,11 +465,19 @@ GfxPattern *GfxResources::lookupPattern(
   GfxResources *resPtr;
   GfxPattern *pattern;
   Object obj;
+  Object obj2;
 
   for (resPtr = this; resPtr; resPtr = resPtr->next) {
     if (resPtr->patternDict.isDict()) {
-      if (!resPtr->patternDict.dictLookup(name, &obj)->isNull()) {
-	pattern = GfxPattern::parse(resPtr, &obj, out, state);
+      if (!resPtr->patternDict.dictLookupNF(name, &obj)->isNull()) {
+	Ref patternRef = { -1, -1 };
+	if (obj.isRef()) {
+	  patternRef = obj.getRef();
+	  obj.fetch(resPtr->patternDict.getDict()->getXRef(), &obj2);
+	}
+
+	pattern = GfxPattern::parse(resPtr, &obj2, out, state, patternRef.num);
+	obj2.free();
 	obj.free();
 	return pattern;
       }
@@ -2283,18 +2291,34 @@ void Gfx::doTilingPatternFill(GfxTilingP
 		       xi0, yi0, xi1, yi1, xstep, ystep)) {
     goto restore;
   } else {
-    out->updatePatternOpacity(state);
-    for (yi = yi0; yi < yi1; ++yi) {
-      for (xi = xi0; xi < xi1; ++xi) {
-        x = xi * xstep;
-        y = yi * ystep;
-        m1[4] = x * m[0] + y * m[2] + m[4];
-        m1[5] = x * m[1] + y * m[3] + m[5];
-        drawForm(tPat->getContentStream(), tPat->getResDict(),
-        	  m1, tPat->getBBox());
+    bool shouldDrawForm = gTrue;
+    std::set<int>::iterator patternRefIt;
+    const int patternRefNum = tPat->getPatternRefNum();
+    if (patternRefNum != -1) {
+      if (formsDrawing.find(patternRefNum) == formsDrawing.end()) {
+	patternRefIt = formsDrawing.insert(patternRefNum).first;
+      } else {
+	shouldDrawForm = gFalse;
+      }
+    }
+
+    if (shouldDrawForm) {
+      out->updatePatternOpacity(state);
+      for (yi = yi0; yi < yi1; ++yi) {
+	for (xi = xi0; xi < xi1; ++xi) {
+	  x = xi * xstep;
+	  y = yi * ystep;
+	  m1[4] = x * m[0] + y * m[2] + m[4];
+	  m1[5] = x * m[1] + y * m[3] + m[5];
+	  drawForm(tPat->getContentStream(), tPat->getResDict(),
+		  m1, tPat->getBBox());
+	}
+     }
+      out->clearPatternOpacity(state);
+      if (patternRefNum != -1) {
+	formsDrawing.erase(patternRefIt);
       }
     }
-    out->clearPatternOpacity(state);
   }
 
   // restore graphics state
Index: poppler-0.41.0/poppler/GfxState.cc
===================================================================
--- poppler-0.41.0.orig/poppler/GfxState.cc
+++ poppler-0.41.0/poppler/GfxState.cc
@@ -3429,14 +3429,17 @@ void GfxPatternColorSpace::getDefaultCol
 // Pattern
 //------------------------------------------------------------------------
 
-GfxPattern::GfxPattern(int typeA) {
-  type = typeA;
+GfxPattern::GfxPattern(int typeA, int patternRefNumA)
+ : type(typeA)
+ , patternRefNum(patternRefNumA)
+{
+
 }
 
 GfxPattern::~GfxPattern() {
 }
 
-GfxPattern *GfxPattern::parse(GfxResources *res, Object *obj, OutputDev *out, GfxState *state) {
+GfxPattern *GfxPattern::parse(GfxResources *res, Object *obj, OutputDev *out, GfxState *state, int patternRefNum) {
   GfxPattern *pattern;
   Object obj1;
 
@@ -3449,9 +3452,9 @@ GfxPattern *GfxPattern::parse(GfxResourc
   }
   pattern = NULL;
   if (obj1.isInt() && obj1.getInt() == 1) {
-    pattern = GfxTilingPattern::parse(obj);
+    pattern = GfxTilingPattern::parse(obj, patternRefNum);
   } else if (obj1.isInt() && obj1.getInt() == 2) {
-    pattern = GfxShadingPattern::parse(res, obj, out, state);
+    pattern = GfxShadingPattern::parse(res, obj, out, state, patternRefNum);
   }
   obj1.free();
   return pattern;
@@ -3461,7 +3464,7 @@ GfxPattern *GfxPattern::parse(GfxResourc
 // GfxTilingPattern
 //------------------------------------------------------------------------
 
-GfxTilingPattern *GfxTilingPattern::parse(Object *patObj) {
+GfxTilingPattern *GfxTilingPattern::parse(Object *patObj, int patternRefNum) {
   GfxTilingPattern *pat;
   Dict *dict;
   int paintTypeA, tilingTypeA;
@@ -3538,7 +3541,7 @@ GfxTilingPattern *GfxTilingPattern::pars
   obj1.free();
 
   pat = new GfxTilingPattern(paintTypeA, tilingTypeA, bboxA, xStepA, yStepA,
-			     &resDictA, matrixA, patObj);
+			     &resDictA, matrixA, patObj, patternRefNum);
   resDictA.free();
   return pat;
 }
@@ -3546,8 +3549,8 @@ GfxTilingPattern *GfxTilingPattern::pars
 GfxTilingPattern::GfxTilingPattern(int paintTypeA, int tilingTypeA,
 				   double *bboxA, double xStepA, double yStepA,
 				   Object *resDictA, double *matrixA,
-				   Object *contentStreamA):
-  GfxPattern(1)
+				   Object *contentStreamA, int patternRefNumA) :
+  GfxPattern(1, patternRefNumA)
 {
   int i;
 
@@ -3572,14 +3575,14 @@ GfxTilingPattern::~GfxTilingPattern() {
 
 GfxPattern *GfxTilingPattern::copy() {
   return new GfxTilingPattern(paintType, tilingType, bbox, xStep, yStep,
-			      &resDict, matrix, &contentStream);
+			      &resDict, matrix, &contentStream, getPatternRefNum());
 }
 
 //------------------------------------------------------------------------
 // GfxShadingPattern
 //------------------------------------------------------------------------
 
-GfxShadingPattern *GfxShadingPattern::parse(GfxResources *res, Object *patObj, OutputDev *out, GfxState *state) {
+GfxShadingPattern *GfxShadingPattern::parse(GfxResources *res, Object *patObj, OutputDev *out, GfxState *state, int patternRefNum) {
   Dict *dict;
   GfxShading *shadingA;
   double matrixA[6];
@@ -3612,11 +3615,11 @@ GfxShadingPattern *GfxShadingPattern::pa
   }
   obj1.free();
 
-  return new GfxShadingPattern(shadingA, matrixA);
+  return new GfxShadingPattern(shadingA, matrixA, patternRefNum);
 }
 
-GfxShadingPattern::GfxShadingPattern(GfxShading *shadingA, double *matrixA):
-  GfxPattern(2)
+GfxShadingPattern::GfxShadingPattern(GfxShading *shadingA, double *matrixA, int patternRefNumA):
+  GfxPattern(2, patternRefNumA)
 {
   int i;
 
@@ -3631,7 +3634,7 @@ GfxShadingPattern::~GfxShadingPattern()
 }
 
 GfxPattern *GfxShadingPattern::copy() {
-  return new GfxShadingPattern(shading->copy(), matrix);
+  return new GfxShadingPattern(shading->copy(), matrix, getPatternRefNum());
 }
 
 //------------------------------------------------------------------------
Index: poppler-0.41.0/poppler/GfxState.h
===================================================================
--- poppler-0.41.0.orig/poppler/GfxState.h
+++ poppler-0.41.0/poppler/GfxState.h
@@ -758,18 +758,21 @@ private:
 class GfxPattern {
 public:
 
-  GfxPattern(int typeA);
+  GfxPattern(int typeA, int patternRefNumA);
   virtual ~GfxPattern();
 
-  static GfxPattern *parse(GfxResources *res, Object *obj, OutputDev *out, GfxState *state);
+  static GfxPattern *parse(GfxResources *res, Object *obj, OutputDev *out, GfxState *state, int patternRefNum);
 
   virtual GfxPattern *copy() = 0;
 
   int getType() { return type; }
 
+  int getPatternRefNum() const { return patternRefNum; }
+
 private:
 
   int type;
+  int patternRefNum;
 };
 
 //------------------------------------------------------------------------
@@ -779,7 +782,7 @@ private:
 class GfxTilingPattern: public GfxPattern {
 public:
 
-  static GfxTilingPattern *parse(Object *patObj);
+  static GfxTilingPattern *parse(Object *patObj, int patternRefNum);
   virtual ~GfxTilingPattern();
 
   virtual GfxPattern *copy();
@@ -799,7 +802,7 @@ private:
   GfxTilingPattern(int paintTypeA, int tilingTypeA,
 		   double *bboxA, double xStepA, double yStepA,
 		   Object *resDictA, double *matrixA,
-		   Object *contentStreamA);
+		   Object *contentStreamA, int patternRefNumA);
 
   int paintType;
   int tilingType;
@@ -817,7 +820,7 @@ private:
 class GfxShadingPattern: public GfxPattern {
 public:
 
-  static GfxShadingPattern *parse(GfxResources *res, Object *patObj, OutputDev *out, GfxState *state);
+  static GfxShadingPattern *parse(GfxResources *res, Object *patObj, OutputDev *out, GfxState *state, int patternRefNum);
   virtual ~GfxShadingPattern();
 
   virtual GfxPattern *copy();
@@ -827,7 +830,7 @@ public:
 
 private:
 
-  GfxShadingPattern(GfxShading *shadingA, double *matrixA);
+  GfxShadingPattern(GfxShading *shadingA, double *matrixA, int patternRefNumA);
 
   GfxShading *shading;
   double matrix[6];