Type check the m_pShadingObj before assuming it's a stream.

core/src/fpdfapi/fpdf_page/fpdf_page_pattern.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "../../../include/fpdfapi/fpdf_page.h"
 #include "pageint.h"
 
 CPDF_Pattern::CPDF_Pattern(const CFX_AffineMatrix* pParentMatrix)
@@ skipping 122 matching lines @@
   CPDF_Object* pCSObj = pShadingDict->GetElementValue(FX_BSTRC("ColorSpace"));
   if (pCSObj == NULL) {
     return FALSE;
   }
   CPDF_DocPageData* pDocPageData = m_pDocument->GetPageData();
   m_pCS = pDocPageData->GetColorSpace(pCSObj, NULL);
   if (m_pCS) {
     m_pCountedCS = pDocPageData->FindColorSpacePtr(m_pCS->GetArray());
   }
   m_ShadingType = pShadingDict->GetInteger(FX_BSTRC("ShadingType"));
+
+  // We expect to have a stream if our shading type is a mesh.
+  if (m_ShadingType >= 4 && !ToStream(m_pShadingObj))
+    return FALSE;
+
   return TRUE;
 }
 FX_BOOL CPDF_ShadingPattern::Reload() {
   Clear();
   return Load();
 }
 FX_BOOL CPDF_MeshStream::Load(CPDF_Stream* pShadingStream,
                               CPDF_Function** pFuncs,
                               int nFuncs,
                               CPDF_ColorSpace* pCS) {
@@ skipping 134 matching lines @@
       }
     }
     stream.m_BitStream.SkipBits(stream.m_nComps * stream.m_nCompBits *
                                 color_count);
     if (bGouraud)
       stream.m_BitStream.ByteAlign();
   }
   rect.Transform(pMatrix);
   return rect;
 }