Check obj2 is a num before reading it

1 files changed, 7 insertions, 1 deletions

diff --git a/poppler/Gfx.cc b/poppler/Gfx.cc
index 4eb8c54d..408dab5f 100644
--- a/poppler/Gfx.cc
+++ b/poppler/Gfx.cc
@@ -1252,7 +1252,13 @@ void Gfx::doSoftMask(Object *str, GBool alpha,
   }
   for (i = 0; i < 4; ++i) {
     obj1.arrayGet(i, &obj2);
-    bbox[i] = obj2.getNum();
+    if (likely(obj2.isNum())) bbox[i] = obj2.getNum();
+    else {
+      obj2.free();
+      obj1.free();
+      error(getPos(), "Bad form bounding box (non number)");
+      return;
+    }
     obj2.free();
   }
   obj1.free();