Handle corrupt stream dictionary.

1 files changed, 8 insertions, 3 deletions

diff --git a/mupdf/pdf_stream.c b/mupdf/pdf_stream.c
index 523145da..77ff809a 100644
--- a/mupdf/pdf_stream.c
+++ b/mupdf/pdf_stream.c
@@ -192,9 +192,14 @@ buildrawfilter(fz_filter **filterp, pdf_xref *xref, fz_obj *stmobj, int oid, int
 	int len;
 
 	stmlen = fz_dictgets(stmobj, "Length");
-	error = pdf_resolve(&stmlen, xref);
-	if (error)
-		return fz_rethrow(error, "cannot resolve stream /Length");
+	if (stmlen)
+	{
+		error = pdf_resolve(&stmlen, xref);
+		if (error)
+			return fz_rethrow(error, "cannot resolve stream /Length");
+	}
+	if (!fz_isint(stmlen))
+		return fz_throw("corrupt stream length");
 	len = fz_toint(stmlen);
 	fz_dropobj(stmlen);