From ac5cddc7c228966d4defb78923896cf9f5b5d63a Mon Sep 17 00:00:00 2001
From: Marek Kasik <mkasik@redhat.com>
Date: Fri, 9 Jun 2023 16:04:03 +0200
Subject: [PATCH] Check isDict before calling getDict 2

Resolves: #2189841
---
 poppler-21.01.0-check-isDict.patch | 34 ++++++++++++++++++++++++++++++
 poppler.spec                       |  9 +++++++-
 2 files changed, 42 insertions(+), 1 deletion(-)
 create mode 100644 poppler-21.01.0-check-isDict.patch

diff --git a/poppler-21.01.0-check-isDict.patch b/poppler-21.01.0-check-isDict.patch
new file mode 100644
index 0000000..22c4090
--- /dev/null
+++ b/poppler-21.01.0-check-isDict.patch
@@ -0,0 +1,34 @@
+--- a/poppler/PDFDoc.cc
++++ b/poppler/PDFDoc.cc
+@@ -1757,6 +1757,9 @@ void PDFDoc::replacePageDict(int pageNo,
+ {
+     Ref *refPage = getCatalog()->getPageRef(pageNo);
+     Object page = getXRef()->fetch(*refPage);
++    if (!page.isDict()) {
++        return;
++    }
+     Dict *pageDict = page.getDict();
+     pageDict->remove("MediaBoxssdf");
+     pageDict->remove("MediaBox");
+--- a/utils/pdfunite.cc
++++ b/utils/pdfunite.cc
+@@ -293,9 +293,18 @@ int main(int argc, char *argv[])
+             const PDFRectangle *cropBox = nullptr;
+             if (docs[i]->getCatalog()->getPage(j)->isCropped())
+                 cropBox = docs[i]->getCatalog()->getPage(j)->getCropBox();
+-            docs[i]->replacePageDict(j, docs[i]->getCatalog()->getPage(j)->getRotate(), docs[i]->getCatalog()->getPage(j)->getMediaBox(), cropBox);
+             Ref *refPage = docs[i]->getCatalog()->getPageRef(j);
+             Object page = docs[i]->getXRef()->fetch(*refPage);
++            if (!page.isDict()) {
++                fclose(f);
++                delete yRef;
++                delete countRef;
++                delete outStr;
++                error(errSyntaxError, -1, "PDFDoc::replacePageDict failed.");
++                return -1;
++            } else {
++              docs[i]->replacePageDict(j, docs[i]->getCatalog()->getPage(j)->getRotate(), docs[i]->getCatalog()->getPage(j)->getMediaBox(), cropBox);
++            }
+             Dict *pageDict = page.getDict();
+             Object *resDict = docs[i]->getCatalog()->getPage(j)->getResourceDictObject();
+             if (resDict->isDict()) {
diff --git a/poppler.spec b/poppler.spec
index dbcf888..f68b0cc 100644
--- a/poppler.spec
+++ b/poppler.spec
@@ -3,7 +3,7 @@
 Summary: PDF rendering library
 Name:    poppler
 Version: 21.01.0
-Release: 16%{?dist}
+Release: 17%{?dist}
 License: (GPLv2 or GPLv3) and GPLv2+ and LGPLv2+ and MIT
 URL:     http://poppler.freedesktop.org/
 Source0: http://poppler.freedesktop.org/poppler-%{version}.tar.xz
@@ -41,6 +41,9 @@ Patch9:  poppler-21.01.0-pdfunite-broken-document.patch
 # https://bugzilla.redhat.com/show_bug.cgi?id=2189811
 Patch10: poppler-21.01.0-pdfunite-check-isDict.patch
 
+# https://bugzilla.redhat.com/show_bug.cgi?id=2189814
+Patch11: poppler-21.01.0-check-isDict.patch
+
 BuildRequires: make
 BuildRequires: cmake
 BuildRequires: gcc-c++
@@ -234,6 +237,10 @@ test "$(pkg-config --modversion poppler-qt5)" = "%{version}"
 %{_mandir}/man1/*
 
 %changelog
+* Fri Jun  9 2023 Marek Kasik <mkasik@redhat.com> - 21.01.0-17
+- Check isDict before calling getDict 2
+- Resolves: #2189841
+
 * Fri Jun  9 2023 Marek Kasik <mkasik@redhat.com> - 21.01.0-16
 - Check isDict before calling getDict
 - Resolves: #2189827