XPDF commit ffaf11c exists to contain a global-buffer overflow via Lexer::getObj(Object*) at /xpdf/Lexer.cc.
xpdf project xpdf 3.04