Check object type for objects used in the dictory of 'Index'

core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp

Index: core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp
diff --git a/core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp b/core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp
index 1b62b06749c5d92224e9d484b703b8d985c957eb..c9679b5c57219345f470acca2e27f10b3e55df9f 100644
--- a/core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp
+++ b/core/src/fpdfapi/fpdf_parser/fpdf_parser_parser.cpp
@@ -1034,9 +1034,17 @@ FX_BOOL CPDF_Parser::LoadCrossRefV5(FX_FILESIZE pos, FX_FILESIZE& prev, FX_BOOL
         nSegs = 1;
     } else {
         for (FX_DWORD i = 0; i < pArray->GetCount(); i ++) {
-            IndexArray.Add(pArray->GetInteger(i));
+            CPDF_Object* pObj = pArray->GetElement(i);

[Tom Sepez, 2014/09/09 23:53:46]

Sorry, I'd be happier if you did this two at at time and not inserting either
rather than breaking and removing the last one.

+            if (!pObj || (pObj->GetType() != PDFOBJ_NUMBER)) {
+                break;
+            }
+            IndexArray.Add(pObj->GetInteger());
+        }
+        FX_DWORD nIndexSize = IndexArray.GetSize();
+        if (nIndexSize % 2) {
+            IndexArray.RemoveAt(nIndexSize-1);
         }
-        nSegs = pArray->GetCount() / 2;
+        nSegs = nIndexSize / 2;
     }
     pArray = pStream->GetDict()->GetArray(FX_BSTRC("W"));
     if (pArray == NULL) {