Out-of-bounds array write in Xpdf 4.05 and previous versions, triggered by negative object number in indirect reference in the input PDF file.