[PATCH] Fix integer overflow in SplashClip::clipToPath

Issue #1763

Gbp-Pq: Name CVE-2026-102621.patch

diff --git a/splash/SplashClip.cc b/splash/SplashClip.cc
index 78249652c4df167a08f2908b82835101ce787644..b096beebd7401ca983c1bc824ec2984109ab00f5 100644 (file)
--- a/splash/SplashClip.cc
+++ b/splash/SplashClip.cc
@@ -23,6 +23,8 @@
 #include <config.h>
 
 #include <algorithm>
+#include "goo/GooCheckedOps.h"
+#include "goo/GooLikely.h"
 #include "SplashErrorCodes.h"
 #include "SplashMath.h"
 #include "SplashPath.h"
@@ -211,7 +213,9 @@ SplashError SplashClip::clipToPath(const SplashPath &path, const std::array<doub
     } else {
         if (antialias) {
             xPath.aaScale();
-            yMinAA = yMinI * splashAASize;
+            if (unlikely(checkedMultiply(yMinI, splashAASize, &yMinAA))) {
+                return SplashError::Generic;
+            }
             yMaxAA = (yMaxI + 1) * splashAASize - 1;
         } else {
             yMinAA = yMinI;