From 59dbecfea90b0d7527d56be204b97043a482efd5 Mon Sep 17 00:00:00 2001
From: Albert Astals Cid <aacid@kde.org>
Date: Fri, 7 Aug 2026 00:36:06 +0200
Subject: [PATCH] [PATCH] Fix integer overflow in JBIG2Stream::readCodeTableSeg

Issue #1760

Gbp-Pq: Name CVE-2026-93313.patch
---
 poppler/JBIG2Stream.cc | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/poppler/JBIG2Stream.cc b/poppler/JBIG2Stream.cc
index 657c512..a1c6d28 100644
--- a/poppler/JBIG2Stream.cc
+++ b/poppler/JBIG2Stream.cc
@@ -4115,7 +4115,12 @@ bool JBIG2Stream::readCodeTableSeg(unsigned int segNum)
             return false;
         }
     }
-    huffTab[i].val = lowVal - 1;
+    int lowValMinusOne;
+    if (unlikely(checkedSubtraction(lowVal, 1, &lowValMinusOne))) {
+        free(huffTab);
+        return false;
+    }
+    huffTab[i].val = lowValMinusOne;
     huffTab[i].prefixLen = huffDecoder->readBits(prefixBits);
     huffTab[i].rangeLen = jbig2HuffmanLOW;
     ++i;
-- 
2.39.5