From: Albert Astals Cid <aacid@kde.org>
Date: Sat, 8 Aug 2026 13:02:27 +0000 (+0200)
Subject: [PATCH] Fix integer overflow in SplashClip::clipToPath
X-Git-Tag: archive/raspbian/26.07.0-3+rpi1^2~4
X-Git-Url: https://dgit.raspbian.org/%22http://www.example.com/cgi/%22/%22http:/www.example.com/cgi/%22?a=commitdiff_plain;h=0f729e1e7e018276add64121558e352dd32f98ff;p=poppler.git

[PATCH] Fix integer overflow in SplashClip::clipToPath

Issue #1763

Gbp-Pq: Name CVE-2026-102621.patch
---

diff --git a/splash/SplashClip.cc b/splash/SplashClip.cc
index 7824965..b096bee 100644
--- a/splash/SplashClip.cc
+++ b/splash/SplashClip.cc
@@ -23,6 +23,8 @@
 #include <config.h>
 
 #include <algorithm>
+#include "goo/GooCheckedOps.h"
+#include "goo/GooLikely.h"
 #include "SplashErrorCodes.h"
 #include "SplashMath.h"
 #include "SplashPath.h"
@@ -211,7 +213,9 @@ SplashError SplashClip::clipToPath(const SplashPath &path, const std::array<doub
     } else {
         if (antialias) {
             xPath.aaScale();
-            yMinAA = yMinI * splashAASize;
+            if (unlikely(checkedMultiply(yMinI, splashAASize, &yMinAA))) {
+                return SplashError::Generic;
+            }
             yMaxAA = (yMaxI + 1) * splashAASize - 1;
         } else {
             yMinAA = yMinI;