Check object type for objects used in the dictory of 'Index'

core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
  
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "../../../include/fpdfapi/fpdf_parser.h"
 #include "../../../include/fpdfapi/fpdf_module.h"
 #include "../../../include/fpdfapi/fpdf_page.h"
 #include "../../../../third_party/numerics/safe_math.h"
@@ skipping 1016 matching lines @@
     }
     CFX_DWordArray IndexArray, WidthArray;
     FX_DWORD nSegs = 0;
     CPDF_Array* pArray = pStream->GetDict()->GetArray(FX_BSTRC("Index"));
     if (pArray == NULL) {
         IndexArray.Add(0);
         IndexArray.Add(size);
         nSegs = 1;
     } else {
         for (FX_DWORD i = 0; i < pArray->GetCount(); i ++) {
-            IndexArray.Add(pArray->GetInteger(i));
+            CPDF_Object* pObj = pArray->GetElement(i);

[Tom Sepez, 2014/09/09 23:53:46]

Sorry, I'd be happier if you did this two at at time and not inserting either
rather than breaking and removing the last one.

+            if (!pObj || (pObj->GetType() != PDFOBJ_NUMBER)) {
+                break;
+            }
+            IndexArray.Add(pObj->GetInteger());
         }
-        nSegs = pArray->GetCount() / 2;
+        FX_DWORD nIndexSize = IndexArray.GetSize();
+        if (nIndexSize % 2) {
+            IndexArray.RemoveAt(nIndexSize-1);
+        }
+        nSegs = nIndexSize / 2;
     }
     pArray = pStream->GetDict()->GetArray(FX_BSTRC("W"));
     if (pArray == NULL) {
         pStream->Release();
         return FALSE;
     }
     FX_DWORD totalwidth = 0;
     FX_DWORD i;
     for (i = 0; i < pArray->GetCount(); i ++) {
         WidthArray.Add(pArray->GetInteger(i));
@@ skipping 3375 matching lines @@
 {
     FX_INT32 iSize = m_childNode.GetSize();
     for (FX_INT32 i = 0; i < iSize; ++i) {
         CPDF_PageNode *pNode = (CPDF_PageNode*)m_childNode[i];
         if (pNode) {
             delete pNode;
         }
     }
     m_childNode.RemoveAll();
 }