From 3e78f34c9bc72f5d0a12bf8ed5bab3c9b0802791 Mon Sep 17 00:00:00 2001 From: Ankur Tyagi Date: Sun, 18 Oct 2026 13:31:17 +1300 Subject: [PATCH] poppler: patch CVE-2026-102620 Also backport commit[1] to allow cherry-pick of the commit fixing the CVE. Details: https://nvd.nist.gov/vuln/detail/cve-2026-102620 [1]https://gitlab.freedesktop.org/poppler/poppler/-/commit/786b06dac87dbe28e85ec7ea3d340810f151c25b Signed-off-by: Ankur Tyagi --- .../poppler/poppler/CVE-2026-102620-1.patch | 145 ++++++++++++++++++ .../poppler/poppler/CVE-2026-102620-2.patch | 34 ++++ .../poppler/poppler_26.08.0.bb | 2 + 3 files changed, 181 insertions(+) create mode 100644 meta-oe/recipes-support/poppler/poppler/CVE-2026-102620-1.patch create mode 100644 meta-oe/recipes-support/poppler/poppler/CVE-2026-102620-2.patch diff --git a/meta-oe/recipes-support/poppler/poppler/CVE-2026-102620-1.patch b/meta-oe/recipes-support/poppler/poppler/CVE-2026-102620-1.patch new file mode 100644 index 0000000000..e85866eddf --- /dev/null +++ b/meta-oe/recipes-support/poppler/poppler/CVE-2026-102620-1.patch @@ -0,0 +1,145 @@ +From b8ce8bb5df02fd3a70f4b34f3d64c88df7089409 Mon Sep 17 00:00:00 2001 +From: Albert Astals Cid +Date: Sat, 8 Aug 2026 15:30:32 +0200 +Subject: [PATCH] FoFiTrueType::cvtSfnts: Move variables closer to where they + are used + +(cherry picked from commit 786b06dac87dbe28e85ec7ea3d340810f151c25b) + +CVE: CVE-2026-102620 +Upstream-Status: Backport [https://gitlab.freedesktop.org/poppler/poppler/-/commit/786b06dac87dbe28e85ec7ea3d340810f151c25b] + +Signed-off-by: Ankur Tyagi +--- + fofi/FoFiTrueType.cc | 42 +++++++++++++++++++----------------------- + 1 file changed, 19 insertions(+), 23 deletions(-) + +diff --git a/fofi/FoFiTrueType.cc b/fofi/FoFiTrueType.cc +index 133fbc45e..e15cfc576 100644 +--- a/fofi/FoFiTrueType.cc ++++ b/fofi/FoFiTrueType.cc +@@ -1058,9 +1058,6 @@ void FoFiTrueType::cvtSfnts(FoFiOutputFunc outputFunc, void *outputStream, const + TrueTypeTable newTables[nT42Tables]; + unsigned char tableDir[12 + nT42Tables * 16]; + bool ok; +- unsigned int checksum; +- int nNewTables; +- int glyfTableLen, length, glyfPos, j, k; + std::array vheaTab = { + 0, 1, 0, 0, // table version number + 0, 0, // ascent +@@ -1081,8 +1078,6 @@ void FoFiTrueType::cvtSfnts(FoFiOutputFunc outputFunc, void *outputStream, const + 0, 1 // number of advance heights in vmtx table + }; + std::vector vmtxTab; +- bool needVhea, needVmtx; +- int advance; + + *maxUsedGlyph = -1; + +@@ -1116,7 +1111,7 @@ void FoFiTrueType::cvtSfnts(FoFiOutputFunc outputFunc, void *outputStream, const + i = seekTable("loca"); + pos = tables[i].offset; + i = seekTable("glyf"); +- glyfTableLen = tables[i].len; ++ const int glyfTableLen = tables[i].len; + ok = true; + for (i = 0; i <= nGlyphs; ++i) { + locaTable[i].idx = i; +@@ -1169,16 +1164,16 @@ void FoFiTrueType::cvtSfnts(FoFiOutputFunc outputFunc, void *outputStream, const + } + + // count the number of tables +- nNewTables = 0; ++ int nNewTables = 0; + for (i = 0; i < nT42Tables; ++i) { + if (t42Tables[i].required || seekTable(t42Tables[i].tag) >= 0) { + ++nNewTables; + } + } +- advance = 0; // make gcc happy ++ int advance = 0; // make gcc happy + if (needVerticalMetrics) { +- needVhea = seekTable("vhea") < 0; +- needVmtx = seekTable("vmtx") < 0; ++ const bool needVhea = seekTable("vhea") < 0; ++ const bool needVmtx = seekTable("vmtx") < 0; + if (needVhea || needVmtx) { + i = seekTable("head"); + advance = getU16BE(tables[i].offset + 18, &ok); // units per em +@@ -1194,10 +1189,10 @@ void FoFiTrueType::cvtSfnts(FoFiOutputFunc outputFunc, void *outputStream, const + // construct the new table headers, including table checksums + // (pad each table out to a multiple of 4 bytes) + pos = 12 + nNewTables * 16; +- k = 0; ++ int k = 0; + for (i = 0; i < nT42Tables; ++i) { +- length = -1; +- checksum = 0; // make gcc happy ++ int length = -1; ++ unsigned int checksum = 0; // make gcc happy + if (i == t42HeadTable) { + length = 54; + checksum = computeTableChecksum(headData); +@@ -1207,8 +1202,8 @@ void FoFiTrueType::cvtSfnts(FoFiOutputFunc outputFunc, void *outputStream, const + } else if (i == t42GlyfTable) { + length = 0; + checksum = 0; +- glyfPos = tables[seekTable("glyf")].offset; +- for (j = 0; j < nGlyphs; ++j) { ++ const int glyfPos = tables[seekTable("glyf")].offset; ++ for (int j = 0; j < nGlyphs; ++j) { + length += locaTable[j].len; + if (length & 3) { + length += 4 - (length & 3); +@@ -1218,7 +1213,8 @@ void FoFiTrueType::cvtSfnts(FoFiOutputFunc outputFunc, void *outputStream, const + } + } + } else { +- if ((j = seekTable(t42Tables[i].tag)) >= 0) { ++ const int j = seekTable(t42Tables[i].tag); ++ if (j >= 0) { + length = tables[j].len; + if (checkRegion(tables[j].offset, length)) { + checksum = computeTableChecksum(std::span(file.data() + tables[j].offset, length)); +@@ -1298,7 +1294,7 @@ void FoFiTrueType::cvtSfnts(FoFiOutputFunc outputFunc, void *outputStream, const + } + + // compute the font checksum and store it in the head table +- checksum = computeTableChecksum(std::span(tableDir, 12 + nNewTables * 16)); ++ unsigned int checksum = computeTableChecksum(std::span(tableDir, 12 + nNewTables * 16)); + for (i = 0; i < nNewTables; ++i) { + checksum += newTables[i].checksum; + } +@@ -1325,11 +1321,10 @@ void FoFiTrueType::cvtSfnts(FoFiOutputFunc outputFunc, void *outputStream, const + if (i == t42HeadTable) { + dumpString(headData, outputFunc, outputStream); + } else if (i == t42LocaTable) { +- length = (nGlyphs + 1) * (locaFmt ? 4 : 2); + dumpString(locaData, outputFunc, outputStream); + } else if (i == t42GlyfTable) { +- glyfPos = tables[seekTable("glyf")].offset; +- for (j = 0; j < nGlyphs; ++j) { ++ const int glyfPos = tables[seekTable("glyf")].offset; ++ for (int j = 0; j < nGlyphs; ++j) { + if (locaTable[j].len > 0 && checkRegion(glyfPos + locaTable[j].origOffset, locaTable[j].len)) { + dumpString(std::span(file.data() + glyfPos + locaTable[j].origOffset, locaTable[j].len), outputFunc, outputStream); + } +@@ -1338,13 +1333,14 @@ void FoFiTrueType::cvtSfnts(FoFiOutputFunc outputFunc, void *outputStream, const + // length == 0 means the table is missing and the error was + // already reported during the construction of the table + // headers +- if ((length = newTables[i].len) > 0) { +- if ((j = seekTable(t42Tables[i].tag)) >= 0 && checkRegion(tables[j].offset, tables[j].len)) { ++ const int length = newTables[i].len; ++ if (length > 0) { ++ const int j = seekTable(t42Tables[i].tag); ++ if (j >= 0 && checkRegion(tables[j].offset, tables[j].len)) { + dumpString(std::span(file.data() + tables[j].offset, tables[j].len), outputFunc, outputStream); + } else if (needVerticalMetrics && i == t42VheaTable) { + if (unlikely(static_cast(length) > sizeof(vheaTab))) { + error(errSyntaxWarning, -1, "length bigger than vheaTab size"); +- length = sizeof(vheaTab); + } + dumpString(vheaTab, outputFunc, outputStream); + } else if (needVerticalMetrics && i == t42VmtxTable) { diff --git a/meta-oe/recipes-support/poppler/poppler/CVE-2026-102620-2.patch b/meta-oe/recipes-support/poppler/poppler/CVE-2026-102620-2.patch new file mode 100644 index 0000000000..e41e65ffd9 --- /dev/null +++ b/meta-oe/recipes-support/poppler/poppler/CVE-2026-102620-2.patch @@ -0,0 +1,34 @@ +From ac82c990768a4cb3dd4fd15edb92af97b4ac6589 Mon Sep 17 00:00:00 2001 +From: Albert Astals Cid +Date: Sat, 8 Aug 2026 15:47:43 +0200 +Subject: [PATCH] Fix integer overflow in FoFiTrueType::cvtSfnts + +Issue #1762 + +(cherry picked from commit 245d3c6823377755f2c1d5fdddd010279c6ed94d) + +CVE: CVE-2026-102620 +Upstream-Status: Backport [https://gitlab.freedesktop.org/poppler/poppler/-/commit/245d3c6823377755f2c1d5fdddd010279c6ed94d] + +Signed-off-by: Ankur Tyagi +--- + fofi/FoFiTrueType.cc | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/fofi/FoFiTrueType.cc b/fofi/FoFiTrueType.cc +index e15cfc576..9e280fe89 100644 +--- a/fofi/FoFiTrueType.cc ++++ b/fofi/FoFiTrueType.cc +@@ -1204,7 +1204,11 @@ void FoFiTrueType::cvtSfnts(FoFiOutputFunc outputFunc, void *outputStream, const + checksum = 0; + const int glyfPos = tables[seekTable("glyf")].offset; + for (int j = 0; j < nGlyphs; ++j) { +- length += locaTable[j].len; ++ if (unlikely(checkedAdd(length, locaTable[j].len, &length))) { ++ error(errSyntaxError, -1, "Integer overflow in glyph table length calculation"); ++ ok = false; ++ break; ++ } + if (length & 3) { + length += 4 - (length & 3); + } diff --git a/meta-oe/recipes-support/poppler/poppler_26.08.0.bb b/meta-oe/recipes-support/poppler/poppler_26.08.0.bb index f24ca34366..6cfcf3cf0f 100644 --- a/meta-oe/recipes-support/poppler/poppler_26.08.0.bb +++ b/meta-oe/recipes-support/poppler/poppler_26.08.0.bb @@ -9,6 +9,8 @@ SRC_URI = "http://poppler.freedesktop.org/${BP}.tar.xz \ file://0001-cmake-Do-not-use-isystem.patch \ file://0001-workaround-build-racing.patch \ file://CVE-2026-102621.patch \ + file://CVE-2026-102620-1.patch \ + file://CVE-2026-102620-2.patch \ " SRC_URI[sha256sum] = "dc906e68cea698109706ac6aa3d2c9d4512fcfcac42d90b8afcda486d1b9abd0"