commit 9a56ec0d2bb4b6b1d7682bb6601737803fadeda2
Author: Even Rouault <even.rouault@spatialys.com>
Date:   Sat Jun 10 01:06:14 2017 +0200

    SplashOutputDev::type3D1(): fix null pointer dereference on corrupted file
    
    Fixes https://bugs.freedesktop.org/show_bug.cgi?id=101366

diff --git a/poppler/SplashOutputDev.cc b/poppler/SplashOutputDev.cc
index b9fa6cb..6973dea 100644
--- a/poppler/SplashOutputDev.cc
+++ b/poppler/SplashOutputDev.cc
@@ -2725,7 +2725,7 @@ void SplashOutputDev::type3D1(GfxState *state, double wx, double wy,
   int i, j;
 
   // ignore multiple d0/d1 operators
-  if (t3GlyphStack->haveDx) {
+  if (t3GlyphStack == NULL || t3GlyphStack->haveDx) {
     return;
   }
   t3GlyphStack->haveDx = gTrue;