From: Albert Astals Cid <aacid@kde.org>
Date: Sun, 26 Jul 2026 14:49:00 +0000 (+0200)
Subject: [PATCH] FoFiTrueType::mapCodeToGID: Improve b*12 overflow check
X-Git-Tag: archive/raspbian/26.07.0-3+rpi1^2~1
X-Git-Url: https://dgit.raspbian.org/%22http://www.example.com/cgi/%22/%22http:/www.example.com/cgi/%22?a=commitdiff_plain;h=654e465157fbe7b1632c6be477f583f052b3b3e0;p=poppler.git

[PATCH] FoFiTrueType::mapCodeToGID: Improve b*12 overflow check

Issue #1761

Gbp-Pq: Name CVE-2026-93314.patch
---

diff --git a/fofi/FoFiTrueType.cc b/fofi/FoFiTrueType.cc
index fa9e7b2..4c56228 100644
--- a/fofi/FoFiTrueType.cc
+++ b/fofi/FoFiTrueType.cc
@@ -598,14 +598,15 @@ int FoFiTrueType::mapCodeToGID(int i, unsigned int c) const
         gid = getU16BE(pos + 10 + 2 * (c - cmapFirst), &ok);
         break;
     case 12:
-    case 13:
+    case 13: {
         segCnt = getU32BE(pos + 12, &ok);
         a = -1;
         b = segCnt - 1;
-        if (b > std::numeric_limits<int>::max() / 12) {
+        int b12;
+        if (checkedMultiply(b, 12, &b12)) {
             return 0;
         }
-        segEnd = getU32BE(pos + 16 + 12 * b + 4, &ok);
+        segEnd = getU32BE(pos + 16 + b12 + 4, &ok);
         if (c > segEnd) {
             return 0;
         }
@@ -629,6 +630,7 @@ int FoFiTrueType::mapCodeToGID(int i, unsigned int c) const
         // for an entire segment.
         gid = segDelta + (cmaps[i].fmt == 12 ? (c - segStart) : 0);
         break;
+    }
     default:
         return 0;
     }