[PATCH] Fix integer overflow in JBIG2Stream::readCodeTableSeg

Issue #1760

Gbp-Pq: Name CVE-2026-93313.patch

diff --git a/poppler/JBIG2Stream.cc b/poppler/JBIG2Stream.cc
index 657c512cfa2247d25375ac9637e95eb687f3e28d..a1c6d28b711f3d65014c091b0e5e149867faa80e 100644 (file)
--- a/poppler/JBIG2Stream.cc
+++ b/poppler/JBIG2Stream.cc
@@ -4115,7 +4115,12 @@ bool JBIG2Stream::readCodeTableSeg(unsigned int segNum)
             return false;
         }
     }
-    huffTab[i].val = lowVal - 1;
+    int lowValMinusOne;
+    if (unlikely(checkedSubtraction(lowVal, 1, &lowValMinusOne))) {
+        free(huffTab);
+        return false;
+    }
+    huffTab[i].val = lowValMinusOne;
     huffTab[i].prefixLen = huffDecoder->readBits(prefixBits);
     huffTab[i].rangeLen = jbig2HuffmanLOW;
     ++i;