[poppler] poppler/GfxState.cc

[Albert Astals Cid]

 poppler/GfxState.cc |    9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

New commits:
commit b5e9941c145fc99e03a28d92a50840638895908d
Author: Albert Astals Cid <aacid at kde.org>
Date:   Mon Jul 1 00:32:51 2013 +0200

    Fix crash on malformed doc
    
    Where the Colorants dictionary values are not arrays
    Document can be found on KDE bug #319925

diff --git a/poppler/GfxState.cc b/poppler/GfxState.cc
index ea79465..0bafb6d 100644
--- a/poppler/GfxState.cc
+++ b/poppler/GfxState.cc
@@ -2534,7 +2534,14 @@ GfxColorSpace *GfxDeviceNColorSpace::parse(Array *arr, OutputDev *out, int recur
       for (i = 0; i < colorants->getLength(); i++) {
         Object obj3;
         colorants->getVal(i, &obj3);
-        separationList->append(GfxSeparationColorSpace::parse(obj3.getArray(), out, recursion));
+        if (obj3.isArray()) {
+          separationList->append(GfxSeparationColorSpace::parse(obj3.getArray(), out, recursion));
+        } else {
+          obj3.free();
+          obj2.free();
+          error(errSyntaxWarning, -1, "Bad DeviceN color space (colorant value entry is not an Array)");
+          goto err4;
+        }
         obj3.free();
       }
     }