CVE-2026-102620

Backport of:

Backport of:

From 245d3c6823377755f2c1d5fdddd010279c6ed94d Mon Sep 17 00:00:00 2001
From: Albert Astals Cid <aacid@kde.org>
Date: Sat, 8 Aug 2026 15:47:43 +0200
Subject: [PATCH] Fix integer overflow in FoFiTrueType::cvtSfnts

Issue #1762

Gbp-Pq: Name CVE-2026-102620.patch

diff --git a/fofi/FoFiTrueType.cc b/fofi/FoFiTrueType.cc
index a5d16d145bcbb30b5e814781eab1de32702927a7..fa9e7b2148cec0c94099307321af22ae606c39bb 100644 (file)
--- a/fofi/FoFiTrueType.cc
+++ b/fofi/FoFiTrueType.cc
@@ -1207,7 +1207,11 @@ void FoFiTrueType::cvtSfnts(FoFiOutputFunc outputFunc, void *outputStream, const
             checksum = 0;
             glyfPos = tables[seekTable("glyf")].offset;
             for (j = 0; j < nGlyphs; ++j) {
-                length += locaTable[j].len;
+                if (unlikely(checkedAdd(length, locaTable[j].len, &length))) {
+                    error(errSyntaxError, -1, "Integer overflow in glyph table length calculation");
+                    ok = false;
+                    break;
+                }
                 if (length & 3) {
                     length += 4 - (length & 3);
                 }