commit d6ea8acbb348fdb43601a963ba5407e933565003
Author: Adrian Johnson <ajohnson@redneon.com>
Date:   Mon Nov 3 19:11:25 2014 +0100

    fix crash in Xref::getEntry
    
    Bug 85234

diff --git a/poppler/XRef.cc b/poppler/XRef.cc
index 2560e3d..333f5ec 100644
--- a/poppler/XRef.cc
+++ b/poppler/XRef.cc
@@ -1568,7 +1568,7 @@ GBool XRef::parseEntry(Goffset offset, XRefEntry *entry)
 void XRef::readXRefUntil(int untilEntryNum, std::vector<int> *xrefStreamObjsNum)
 {
   std::vector<Goffset> followedPrev;
-  while (prevXRefOffset && (untilEntryNum == -1 || entries[untilEntryNum].type == xrefEntryNone)) {
+  while (prevXRefOffset && (untilEntryNum == -1 || (untilEntryNum < size && entries[untilEntryNum].type == xrefEntryNone))) {
     bool followed = false;
     for (size_t j = 0; j < followedPrev.size(); j++) {
       if (followedPrev.at(j) == prevXRefOffset) {
@@ -1606,7 +1606,7 @@ void XRef::readXRefUntil(int untilEntryNum, std::vector<int> *xrefStreamObjsNum)
 
 XRefEntry *XRef::getEntry(int i, GBool complainIfMissing)
 {
-  if (entries[i].type == xrefEntryNone) {
+  if (i >= size || entries[i].type == xrefEntryNone) {
 
     if ((!xRefStream) && mainXRefEntriesOffset) {
       if (!parseEntry(mainXRefEntriesOffset + 20*i, &entries[i])) {