Avoid adding stream objects directly to arrays in CPDF_SyntaxParser

In https://pdfium-review.googlesource.com/115611, CPDF_SyntaxParser
received the same check when adding to dictionaries. Make the behavior
consistent for arrays.

Bug: 324483125,pdfium:2119
Change-Id: I14d54020573ad02470648e14ffb59eac041ebe4b
Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/116531
Reviewed-by: Tom Sepez <tsepez@chromium.org>
Reviewed-by: Thomas Sepez <tsepez@google.com>
Commit-Queue: Lei Zhang <thestig@chromium.org>

core/fpdfapi/parser/cpdf_syntax_parser.cpp

diff --git a/core/fpdfapi/parser/cpdf_syntax_parser.cpp b/core/fpdfapi/parser/cpdf_syntax_parser.cpp
index 7b35697..e72d393 100644
--- a/core/fpdfapi/parser/cpdf_syntax_parser.cpp
+++ b/core/fpdfapi/parser/cpdf_syntax_parser.cpp
@@ -541,7 +541,10 @@
     auto pArray = pdfium::MakeRetain<CPDF_Array>();
     while (RetainPtr<CPDF_Object> pObj =
                GetObjectBodyInternal(pObjList, ParseType::kLoose)) {
-      pArray->Append(std::move(pObj));
+      // `pObj` cannot be a stream, per ISO 32000-1:2008 section 7.3.8.1.
+      if (!pObj->IsStream()) {
+        pArray->Append(std::move(pObj));
+      }
     }
     return (parse_type == ParseType::kLoose || m_WordBuffer[0] == ']')
                ? std::move(pArray)