Coverity ID 380512

We were not using the return value from pdfi_array_get_number(). Since
we're making changes anyway, duplicate the fix in commit
0cbcfd63c0865a8c3a8d9d4bd81ba27cb0432487 to avoid storing the
dereferenced object in the array, in case we end up with a CropBox
where the array contains an indirect reference to the Pages tree.

The earlier commit only updated the array we were using for the canvas
size.

1 files changed, 14 insertions, 5 deletions

diff --git a/pdf/pdf_page.c b/pdf/pdf_page.c
index 2799f86e3..b413b68dc 100644
--- a/pdf/pdf_page.c
+++ b/pdf/pdf_page.c
@@ -295,14 +295,23 @@ static int pdfi_set_media_size(pdf_context *ctx, pdf_dict *page_dict)
     if (a == NULL) {
         code = pdfi_dict_get_type(ctx, page_dict, "CropBox", PDF_ARRAY, (pdf_obj **)&a);
         if (code >= 0 && pdfi_array_size(a) >= 4) {
+            pdf_obj *box_obj = NULL;
+
             for (i=0;i<4;i++) {
-                code = pdfi_array_get_number(ctx, a, i, &d_crop[i]);
-                d_crop[i] *= userunit;
+                code = pdfi_array_get_no_store_R(ctx, a, i, &box_obj);
+                if (code >= 0) {
+                    code = pdfi_obj_to_real(ctx, box_obj, &d_crop[i]);
+                    pdfi_countdown(box_obj);
+                }
+                if (code < 0)
+                    break;
             }
             pdfi_countdown(a);
-            normalize_rectangle(d_crop);
-            memcpy(ctx->page.Crop, d_crop, 4 * sizeof(double));
-            do_crop = true;
+            if (code >= 0) {
+                normalize_rectangle(d_crop);
+                memcpy(ctx->page.Crop, d_crop, 4 * sizeof(double));
+                do_crop = true;
+            }
         }
         a = default_media;
     }