topIdx can't be negative

Fixes crash on broken files. Issue #1303

1 files changed, 4 insertions, 0 deletions

diff --git a/poppler/Form.cc b/poppler/Form.cc
index 4dfba6dd..d33160b3 100644
--- a/poppler/Form.cc
+++ b/poppler/Form.cc
@@ -1845,6 +1845,10 @@ FormFieldChoice::FormFieldChoice(PDFDoc *docA, Object &&aobj, const Ref refA, Fo
     obj1 = dict->lookup("TI");
     if (obj1.isInt()) {
         topIdx = obj1.getInt();
+        if (topIdx < 0) {
+            error(errSyntaxError, -1, "FormFieldChoice:: invalid topIdx entry\n");
+            topIdx = 0;
+        }
     }
 
     obj1 = Form::fieldLookup(dict, "Opt");