From: Debian freedesktop.org maintainers <pkg-freedesktop-maintainers@lists.alioth.debian.org>
Date: Tue, 6 Oct 2026 15:58:35 +0000 (+0200)
Subject: CVE-2026-102620
X-Git-Tag: archive/raspbian/26.07.0-3+rpi1^2~5
X-Git-Url: https://dgit.raspbian.org/%22http://www.example.com/cgi/%22/%22http:/www.example.com/cgi/%22?a=commitdiff_plain;h=0c1ae5d50b920431cee3733f8e29440e02144851;p=poppler.git

CVE-2026-102620

Backport of:

Backport of:

From 245d3c6823377755f2c1d5fdddd010279c6ed94d Mon Sep 17 00:00:00 2001
From: Albert Astals Cid <aacid@kde.org>
Date: Sat, 8 Aug 2026 15:47:43 +0200
Subject: [PATCH] Fix integer overflow in FoFiTrueType::cvtSfnts

Issue #1762

Gbp-Pq: Name CVE-2026-102620.patch
---

diff --git a/fofi/FoFiTrueType.cc b/fofi/FoFiTrueType.cc
index a5d16d1..fa9e7b2 100644
--- a/fofi/FoFiTrueType.cc
+++ b/fofi/FoFiTrueType.cc
@@ -1207,7 +1207,11 @@ void FoFiTrueType::cvtSfnts(FoFiOutputFunc outputFunc, void *outputStream, const
             checksum = 0;
             glyfPos = tables[seekTable("glyf")].offset;
             for (j = 0; j < nGlyphs; ++j) {
-                length += locaTable[j].len;
+                if (unlikely(checkedAdd(length, locaTable[j].len, &length))) {
+                    error(errSyntaxError, -1, "Integer overflow in glyph table length calculation");
+                    ok = false;
+                    break;
+                }
                 if (length & 3) {
                     length += 4 - (length & 3);
                 }