Fix for crash in FPDF_GetNamedDest().

fpdfsdk/src/fpdfview.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
  
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "../include/fsdk_define.h"
 #include "../include/fsdk_mgr.h"
 #include "../include/fpdfview.h"
 #include "../include/fsdk_rendercontext.h"
@@ skipping 832 matching lines @@
             if (!pDestObj) continue;
             if (i == index) break;
             i++;
         }
     } else {
         pDestObj = nameTree.LookupValue(index, bsName);
     }
     if (!pDestObj) return NULL;
     if (pDestObj->GetType() == PDFOBJ_DICTIONARY)
         pDestObj = ((CPDF_Dictionary*)pDestObj)->GetArray(FX_BSTRC("D"));
-    if (pDestObj->GetType() != PDFOBJ_ARRAY) return NULL;
+    if (!pDestObj || pDestObj->GetType() != PDFOBJ_ARRAY) return NULL;
     CFX_WideString wsName = PDF_DecodeText(bsName);
     CFX_ByteString utf16Name = wsName.UTF16LE_Encode();
     unsigned int len = utf16Name.GetLength();
     if (!buffer) {
         buflen = len + 2;
     } else if (buflen >= len + 2) {
         memcpy(buffer, utf16Name.c_str(), len);
         ((FX_BYTE*)buffer)[len] = 0;
         ((FX_BYTE*)buffer)[len + 1] = 0;
     } else {
         len = -1;

[Tom Sepez, 2015/01/20 18:42:28]

nit: Bo, this looks wrong.  Did you want to set buflen (returned) to -1?

[Bo Xu, 2015/01/20 18:45:56]

Yep, should be buflen = -1;

     }
     return (FPDF_DEST)pDestObj;
 }