From cddc1d869d39d1dad64e39e665ec4cde3d2cc519 Mon Sep 17 00:00:00 2001
From: Calixte Denizet <calixte.denizet@gmail.com>
Date: Wed, 9 Jun 2021 18:56:16 +0200
Subject: [PATCH] XFA - Avoid infinite loop when creating some nodes in data

---
 src/core/xfa/bind.js         |  5 ++-
 src/core/xfa/som.js          |  2 +-
 test/unit/xfa_parser_spec.js | 65 ++++++++++++++++++++++++++++++++++++
 3 files changed, 70 insertions(+), 2 deletions(-)

diff --git a/src/core/xfa/bind.js b/src/core/xfa/bind.js
index e5b5a614b..576118f25 100644
--- a/src/core/xfa/bind.js
+++ b/src/core/xfa/bind.js
@@ -526,7 +526,10 @@ class Binder {
           if (this._isConsumeData()) {
             match[$consumed] = true;
           }
-          match = [match];
+
+          // Don't bind the value in newly created node because it's empty.
+          this._bindElement(child, match);
+          continue;
         } else {
           if (this._isConsumeData()) {
             // Filter out consumed nodes.
diff --git a/src/core/xfa/som.js b/src/core/xfa/som.js
index 9c8a8829c..1bc1cd60c 100644
--- a/src/core/xfa/som.js
+++ b/src/core/xfa/som.js
@@ -245,7 +245,7 @@ function searchNode(
 function createNodes(root, path) {
   let node = null;
   for (const { name, index } of path) {
-    for (let i = 0; i <= index; i++) {
+    for (let i = 0, ii = !isFinite(index) ? 0 : index; i <= ii; i++) {
       node = new XmlObject(root[$namespaceId], name);
       root[$appendChild](node);
     }
diff --git a/test/unit/xfa_parser_spec.js b/test/unit/xfa_parser_spec.js
index a0f6f448d..a3736a383 100644
--- a/test/unit/xfa_parser_spec.js
+++ b/test/unit/xfa_parser_spec.js
@@ -1289,5 +1289,70 @@ describe("XFAParser", function () {
         )
       ).toEqual(["item1", "item2", "item1", "item2"]);
     });
+
+    it("should make binding and create nodes in data with some bind tag", function () {
+      const xml = `
+<?xml version="1.0"?>
+<xdp:xdp xmlns:xdp="http://ns.adobe.com/xdp/">
+  <template xmlns="http://www.xfa.org/schema/xfa-template/3.3">
+    <subform name="root" mergeMode="matchTemplate">
+      <subform name="A">
+        <occur max="-1"/>
+        <bind ref="$.root.foo[*]" match="dataRef"/>
+      </subform>
+      <subform name="B">
+        <occur max="2"/>
+        <bind ref="$.root.bar[2]" match="dataRef"/>
+      </subform>
+    </subform>
+  </template>
+  <xfa:datasets xmlns:xfa="http://www.xfa.org/schema/xfa-data/1.0/">
+    <xfa:data>
+      <root>
+      </root>
+    </xfa:data>
+  </xfa:datasets>
+</xdp:xdp>
+      `;
+      const root = new XFAParser().parse(xml);
+      const binder = new Binder(root);
+      binder.bind();
+      const data = binder.getData();
+
+      const expected = {
+        $name: "root",
+        children: [
+          {
+            $name: "root",
+            children: [
+              {
+                $name: "foo",
+                children: [],
+                attributes: {},
+              },
+              {
+                $name: "bar",
+                children: [],
+                attributes: {},
+              },
+              {
+                $name: "bar",
+                children: [],
+                attributes: {},
+              },
+              {
+                $name: "bar",
+                children: [],
+                attributes: {},
+              },
+            ],
+            attributes: {},
+          },
+        ],
+        attributes: {},
+      };
+
+      expect(searchNode(data, data, "root")[0][$dump]()).toEqual(expected);
+    });
   });
 });