Backport of:

From 2532df6060092e9fab7f041ae9598aff9cdd94bb Mon Sep 17 00:00:00 2001
From: Albert Astals Cid <aacid@kde.org>
Date: Fri, 8 Sep 2017 18:28:15 +0200
Subject: Annot: Fix crash on broken files

Bug #102601

Index: poppler-0.41.0/poppler/Annot.cc
===================================================================
--- poppler-0.41.0.orig/poppler/Annot.cc
+++ poppler-0.41.0/poppler/Annot.cc
@@ -6862,13 +6862,13 @@ AnnotRichMedia::Content::Content(Dict *d
       assets = (Asset **)gmallocn(nAssets, sizeof(Asset *));
 
       int counter = 0;
-      for (int i = 0; i < obj2.arrayGetLength(); i += 2) {
+      for (int i = 0; i < nAssets; ++i) {
         Object objKey;
 
         assets[counter] = new AnnotRichMedia::Asset;
 
-        obj2.arrayGet(i, &objKey);
-        obj2.arrayGet(i + 1, &assets[counter]->fileSpec);
+        obj2.arrayGet(i * 2, &objKey);
+        obj2.arrayGet(i * 2 + 1, &assets[counter]->fileSpec);
 
         assets[counter]->name = new GooString( objKey.getString() );
         ++counter;