Assert objnum non-zero in ReplaceIndirectObjectIfHigherGeneration()

core/fpdfapi/parser/cpdf_parser.cpp

Index: core/fpdfapi/parser/cpdf_parser.cpp
diff --git a/core/fpdfapi/parser/cpdf_parser.cpp b/core/fpdfapi/parser/cpdf_parser.cpp
index cff0f77b3247107d4a33d724480115955f432e67..f578045d0c82feb0875cdbf1e542a45ecc8d528f 100644
--- a/core/fpdfapi/parser/cpdf_parser.cpp
+++ b/core/fpdfapi/parser/cpdf_parser.cpp
@@ -960,14 +960,16 @@ bool CPDF_Parser::LoadCrossRefV5(FX_FILESIZE* pos, bool bMainXRef) {
   if (!pObject)
     return false;
 
-  CPDF_Object* pUnownedObject = pObject.get();
+  uint32_t objnum = pObject->m_ObjNum;
+  if (!objnum)
+    return false;
 
+  CPDF_Object* pUnownedObject = pObject.get();
   if (m_pDocument) {
     CPDF_Dictionary* pRootDict = m_pDocument->GetRoot();
     if (pRootDict && pRootDict->GetObjNum() == pObject->m_ObjNum)

[Lei Zhang, 2016/11/04 00:16:38]

Use |objnum| here as well?

[Tom Sepez, 2016/11/04 17:47:15]

Done.

       return false;
     // Takes ownership of object (std::move someday).
-    uint32_t objnum = pObject->m_ObjNum;
     if (!m_pDocument->ReplaceIndirectObjectIfHigherGeneration(
             objnum, pObject.release())) {
       return false;