Out-of-bounds array write in Xpdf 4.05 and earlier, due to missing object type check in AcroForm field reference.