Index: poppler/CairoFontEngine.cc
===================================================================
RCS file: /cvs/poppler/poppler/poppler/CairoFontEngine.cc,v
retrieving revision 1.23
diff -u -r1.23 CairoFontEngine.cc
--- poppler/CairoFontEngine.cc	29 May 2006 18:44:17 -0000	1.23
+++ poppler/CairoFontEngine.cc	19 Aug 2006 20:26:15 -0000
@@ -79,6 +79,13 @@
     refObj.initRef(embRef.num, embRef.gen);
     refObj.fetch(xref, &strObj);
     refObj.free();
+
+    if(!strObj.isStream()) {
+      strObj.free();
+      error(-1, "Not a stream (%s)!\n", strObj.getTypeName());
+      goto err2;
+    }
+
     strObj.streamReset();
     while ((c = strObj.streamGetChar()) != EOF) {
       fputc(c, tmpFile);
Index: poppler/GfxFont.cc
===================================================================
RCS file: /cvs/poppler/poppler/poppler/GfxFont.cc,v
retrieving revision 1.9
diff -u -r1.9 GfxFont.cc
--- poppler/GfxFont.cc	2 May 2006 04:38:39 -0000	1.9
+++ poppler/GfxFont.cc	19 Aug 2006 20:26:15 -0000
@@ -1615,8 +1615,11 @@
 				   r, obj2.getDict());
       delete[] aux;
       if (fonts[i] && !fonts[i]->isOk()) {
 	delete fonts[i];
 	fonts[i] = NULL;
+      }
+      if (fonts[i]) {
+	fonts[i]->incRefCnt();
       }
     } else {
       error(-1, "font resource is not a dictionary");