From 004e3c10df0abda214f0c293f9e269fdd979c5ee Mon Sep 17 00:00:00 2001
From: Albert Astals Cid <aacid@kde.org>
Date: Wed, 18 Jul 2018 20:31:27 +0200
Subject: Fix crash when Object has negative number

Spec says object number has to be > 0 and gen has to be >= 0

Reported by email

Modified by Marek Kasik for older release

diff --git a/poppler/Parser.cc b/poppler/Parser.cc
index 39c9a967..8b0093e3 100644
--- a/poppler/Parser.cc
+++ b/poppler/Parser.cc
@@ -154,9 +154,14 @@ Object Parser::getObj(GBool simpleOnly,
     num = buf1.getInt();
     shift();
     if (buf1.isInt() && buf2.isCmd("R")) {
+      const int gen = buf1.getInt();
-      obj->initRef(num, buf1.getInt());
+      obj->initRef(num, gen);
       shift();
       shift();
+
+      if (unlikely(num <= 0 || gen < 0)) {
+          obj->free();
+      }
     } else {
       obj->initInt(num);
     }