Merge to XFA: Type check the m_pShadingObj before assuming it's a stream.

The m_pShadingObj can be a stream or a dictionary depending on how it's used.
This CL adds some simple type checking to make sure that the type of the
object matches what we expect.

BUG=chromium:547706
TBR=tsepez@chromium.org

Review URL: https://codereview.chromium.org/1421973004 .

(cherry picked from commit 4ef782ab57979add3e3910d6bcfde6ef59f65724)

Review URL: https://codereview.chromium.org/1422253002 .

2 files changed, 21 insertions, 0 deletions

diff --git a/core/src/fpdfapi/fpdf_page/fpdf_page_pattern.cpp b/core/src/fpdfapi/fpdf_page/fpdf_page_pattern.cpp
index 7b04d8cd33..ded6c878ea 100644
--- a/core/src/fpdfapi/fpdf_page/fpdf_page_pattern.cpp
+++ b/core/src/fpdfapi/fpdf_page/fpdf_page_pattern.cpp
@@ -140,6 +140,11 @@ FX_BOOL CPDF_ShadingPattern::Load() {
     m_pCountedCS = pDocPageData->FindColorSpacePtr(m_pCS->GetArray());
   }
   m_ShadingType = pShadingDict->GetInteger(FX_BSTRC("ShadingType"));
+
+  // We expect to have a stream if our shading type is a mesh.
+  if (m_ShadingType >= 4 && !ToStream(m_pShadingObj))
+    return FALSE;
+
   return TRUE;
 }
 FX_BOOL CPDF_ShadingPattern::Reload() {
diff --git a/core/src/fpdfapi/fpdf_render/fpdf_render_pattern_embeddertest.cpp b/core/src/fpdfapi/fpdf_render/fpdf_render_pattern_embeddertest.cpp
new file mode 100644
index 0000000000..30d7a416be
--- /dev/null
+++ b/core/src/fpdfapi/fpdf_render/fpdf_render_pattern_embeddertest.cpp
@@ -0,0 +1,16 @@
+// Copyright 2015 PDFium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "../../../testing/embedder_test.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+class FPDFRenderPatternEmbeddertest : public EmbedderTest {};
+
+TEST_F(FPDFRenderPatternEmbeddertest, LoadError_547706) {
+  // Test shading where object is a dictionary instead of a stream.
+  EXPECT_TRUE(OpenDocument("testing/resources/bug_547706.pdf"));
+  FPDF_PAGE page = LoadPage(0);
+  RenderPage(page);
+  UnloadPage(page);
+}