From: Albert Astals Cid <aacid@kde.org>
Date: Thu, 6 Aug 2026 22:36:06 +0000 (+0200)
Subject: [PATCH] Fix integer overflow in JBIG2Stream::readCodeTableSeg
X-Git-Tag: archive/raspbian/26.07.0-3+rpi1^2~2
X-Git-Url: https://dgit.raspbian.org/%22http://www.example.com/cgi/%22/%22http:/www.example.com/cgi/%22?a=commitdiff_plain;h=59dbecfea90b0d7527d56be204b97043a482efd5;p=poppler.git

[PATCH] Fix integer overflow in JBIG2Stream::readCodeTableSeg

Issue #1760

Gbp-Pq: Name CVE-2026-93313.patch
---

diff --git a/poppler/JBIG2Stream.cc b/poppler/JBIG2Stream.cc
index 657c512..a1c6d28 100644
--- a/poppler/JBIG2Stream.cc
+++ b/poppler/JBIG2Stream.cc
@@ -4115,7 +4115,12 @@ bool JBIG2Stream::readCodeTableSeg(unsigned int segNum)
             return false;
         }
     }
-    huffTab[i].val = lowVal - 1;
+    int lowValMinusOne;
+    if (unlikely(checkedSubtraction(lowVal, 1, &lowValMinusOne))) {
+        free(huffTab);
+        return false;
+    }
+    huffTab[i].val = lowValMinusOne;
     huffTab[i].prefixLen = huffDecoder->readBits(prefixBits);
     huffTab[i].rangeLen = jbig2HuffmanLOW;
     ++i;