Fix the problem that memory is accessed after released due to invalid type-cast

core/src/fpdfapi/fpdf_parser/fpdf_parser_document.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
  
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "../../../include/fpdfapi/fpdf_parser.h"
 #include "../../../include/fpdfapi/fpdf_module.h"
 extern FX_LPVOID PDFPreviewInitCache(CPDF_Document* pDoc);
 extern void PDFPreviewClearCache(FX_LPVOID pCache);
@@ skipping 174 matching lines @@
             return -1;
         }
         FX_DWORD count = pNode->GetInteger(FX_BSTRC("Count"));
         if (count <= skip_count) {
             skip_count -= count;
             index += count;
             return -1;
         }
         if (count && count == pKidList->GetCount()) {
             for (FX_DWORD i = 0; i < count; i ++) {
-                CPDF_Reference* pKid = (CPDF_Reference*)pKidList->GetElement(i);
+                CPDF_Object* pKid = pKidList->GetElement(i);
                 if (pKid && pKid->GetType() == PDFOBJ_REFERENCE) {
-                    if (pKid->GetRefObjNum() == objnum) {
+                    if (((CPDF_Reference*) pKid)->GetRefObjNum() == objnum) {
                         m_PageList.SetAt(index + i, objnum);
                         return index + i;
                     }
                 }
             }
         }
         for (FX_DWORD i = 0; i < pKidList->GetCount(); i ++) {
             CPDF_Dictionary* pKid = pKidList->GetDict(i);
             if (pKid == NULL) {
                 continue;
@@ skipping 130 matching lines @@
         if (pPageDict == pThisPageDict) {
             continue;
         }
         CPDF_Object* pContents = pPageDict ? pPageDict->GetElement(FX_BSTRC("Contents")) : NULL;
         if (pContents == NULL) {
             continue;
         }
         if (pContents->GetDirectType() == PDFOBJ_ARRAY) {
             CPDF_Array* pArray = (CPDF_Array*)pContents->GetDirect();
             for (FX_DWORD j = 0; j < pArray->GetCount(); j ++) {
-                CPDF_Reference* pRef = (CPDF_Reference*)pArray->GetElement(j);
-                if (pRef->GetRefObjNum() == objnum) {
+                CPDF_Object* pRef = pArray->GetElement(j);
+                if (pRef == NULL || pRef->GetType() != PDFOBJ_REFERENCE) {
+                    continue;
+                }
+                if (((CPDF_Reference*) pRef)->GetRefObjNum() == objnum) {
                     return TRUE;
                 }
             }
         } else if (pContents->GetObjNum() == objnum) {
             return TRUE;
         }
     }
     return FALSE;
 }
 FX_DWORD CPDF_Document::GetUserPermissions(FX_BOOL bCheckRevision) const
@@ skipping 31 matching lines @@
     if (m_pDocPage) {
         CPDF_ModuleMgr::Get()->GetPageModule()->ClearDoc(this);
     }
 }
 void CPDF_Document::ClearRenderData()
 {
     if (m_pDocRender) {
         CPDF_ModuleMgr::Get()->GetRenderModule()->ClearDocData(m_pDocRender);
     }
 }