[poppler] Branch 'poppler-0.6' - poppler/Form.cc

[Carlos Garcia Campos]

 poppler/Form.cc |    9 +++++++++
 1 file changed, 9 insertions(+)

New commits:
diff-tree 528152159c2d9bde40114be57743f2e10a8dac8d (from abe0ba6684e2b7d37382d31c98cd55bde289f764)
Author: Carlos Garcia Campos <carlosgc at gnome.org>
Date:   Fri Oct 5 11:34:01 2007 +0200

    Fix a crash when Form Fields array contains references
    to non existent objects. Fixes bug #11865

diff --git a/poppler/Form.cc b/poppler/Form.cc
index c01e99a..c145ae7 100644
--- a/poppler/Form.cc
+++ b/poppler/Form.cc
@@ -1087,9 +1087,18 @@ Form::Form(XRef *xrefA, Object* acroForm
       array->getNF(i, &oref);
       if (!oref.isRef()) {
         error(-1, "Direct object in rootFields");
+	obj1.free();
+	oref.free();
         continue;
       }
 
+      if (!obj1.isDict()) {
+        error(-1, "Reference in Fields array to an invalid or non existant object");
+	obj1.free();
+	oref.free();
+	continue;
+      }
+
       if (numFields >= size) {
         size += 16;
         rootFields = (FormField**)greallocn(rootFields,size,sizeof(FormField*));