From ec48820c3cf8ead0add464c60f5dddd84ba0097d Mon Sep 17 00:00:00 2001
From: Jay Berkenbilt <ejb@ql.org>
Date: Sun, 4 Apr 2021 17:22:07 -0400
Subject: [PATCH] Fix loop detection in NNTree

---
 libqpdf/NNTree.cc             | 11 +++++++++--
 qpdf/qtest/qpdf/name-tree.pdf | 31 +++++++++++++++++++++----------
 2 files changed, 30 insertions(+), 12 deletions(-)

diff --git a/libqpdf/NNTree.cc b/libqpdf/NNTree.cc
index 2658ffe8..abef2964 100644
--- a/libqpdf/NNTree.cc
+++ b/libqpdf/NNTree.cc
@@ -450,8 +450,8 @@ NNTreeIterator::split(QPDFObjectHandle to_split,
 
     // CURRENT STATE: half the items from the kids or items array in
     // the node being split have been moved into a new node. The new
-    // node is not yet attached to the tree. The iterator have a path
-    // element or leaf node that is out of bounds.
+    // node is not yet attached to the tree. The iterator may have a
+    // path element or leaf node that is out of bounds.
 
     // We need to adjust the parent to add the second node to /Kids
     // and, if needed, update kid_number to traverse through it. We
@@ -748,6 +748,13 @@ NNTreeIterator::deepen(QPDFObjectHandle node, bool first, bool allow_empty)
     bool failed = false;
 
     std::set<QPDFObjGen> seen;
+    for (auto i: this->path)
+    {
+        if (i.node.isIndirect())
+        {
+            seen.insert(i.node.getObjGen());
+        }
+    }
     while (! failed)
     {
         if (node.isIndirect())
diff --git a/qpdf/qtest/qpdf/name-tree.pdf b/qpdf/qtest/qpdf/name-tree.pdf
index 477f6160..72c6899e 100644
--- a/qpdf/qtest/qpdf/name-tree.pdf
+++ b/qpdf/qtest/qpdf/name-tree.pdf
@@ -288,7 +288,8 @@ endobj
 <<
   /Limits [ (E) (Z) ]
   /Kids [
-    30 0 R
+    27 0 R
+    37 0 R
   ]
 >>
 endobj
@@ -350,8 +351,17 @@ endobj
 >>
 endobj
 
+37 0 obj
+<<
+  /Limits [ (E) (Z) ]
+  /Kids [
+    30 0 R
+  ]
+>>
+endobj
+
 xref
-0 37
+0 38
 0000000000 65535 f 
 0000000025 00000 n 
 0000000079 00000 n 
@@ -383,12 +393,13 @@ xref
 0000002282 00000 n 
 0000002341 00000 n 
 0000002413 00000 n 
-0000002483 00000 n 
-0000002531 00000 n 
-0000002634 00000 n 
-0000002718 00000 n 
-0000002790 00000 n 
-0000002862 00000 n 
+0000002494 00000 n 
+0000002542 00000 n 
+0000002645 00000 n 
+0000002729 00000 n 
+0000002801 00000 n 
+0000002873 00000 n 
+0000002943 00000 n 
 trailer <<
   /Root 1 0 R
   /QTest 8 0 R
@@ -400,9 +411,9 @@ trailer <<
   /Bad4 23 0 R
   /Bad5 28 0 R
   /Bad6 31 0 R
-  /Size 37
+  /Size 38
   /ID [<2c3b7a6ec7fc61db8a5db4eebf57f540><2c3b7a6ec7fc61db8a5db4eebf57f540>]
 >>
 startxref
-2932
+3013
 %%EOF