From 94527d5a61eb3402b49436b978bad69f71884051 Mon Sep 17 00:00:00 2001
From: Adam Reichold <adam.reichold@t-online.de>
Date: Sat, 15 Sep 2018 09:31:37 +0200
Subject: [PATCH 2/2] Check for Ref type before unwrapping Object as such

oss-fuzz/10359
---
 poppler/OptionalContent.cc | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/poppler/OptionalContent.cc b/poppler/OptionalContent.cc
index 8376a0e4..3f0ef264 100644
--- a/poppler/OptionalContent.cc
+++ b/poppler/OptionalContent.cc
@@ -7,6 +7,7 @@
 // Copyright 2008, 2010 Carlos Garcia Campos <carlosgc@gnome.org>
 // Copyright 2008, 2010, 2011, 2017, 2018 Albert Astals Cid <aacid@kde.org>
 // Copyright 2008 Mark Kaplan <mkaplan@finjan.com>
+// Copyright 2018 Adam Reichold <adam.reichold@t-online.de>
 //
 // Released under the GPL (version 2, or later, at your option)
 //
@@ -22,7 +23,6 @@
 #include "goo/GooString.h"
 #include "goo/GooList.h"
 #include "Error.h"
-// #include "PDFDocEncoding.h"
 #include "OptionalContent.h"
 
 // Max depth of nested visibility expressions.  This is used to catch
@@ -184,7 +184,6 @@ bool OCGs::optContentIsVisible( Object *dictRef )
     return result;
   }
   dict = dictObj.getDict();
-  // printf("checking if optContent is visible\n");
   Object dictType = dict->lookup("Type");
   if (dictType.isName("OCMD")) {
     Object ve = dict->lookup("VE");
@@ -213,13 +212,12 @@ bool OCGs::optContentIsVisible( Object *dictRef )
         }
       }
     }
-  } else if ( dictType.isName("OCG") ) {
+  } else if ( dictType.isName("OCG") && dictRef->isRef() ) {
     OptionalContentGroup* oc = findOcgByRef( dictRef->getRef() );
     if ( oc && oc->getState() == OptionalContentGroup::Off ) {
       result=false;
     }
   }
-  // printf("visibility: %s\n", result? "on" : "off");
   return result;
 }
 
-- 
2.20.1