File poppler-CVE-2025-3154.patch of Package poppler.41250
Index: poppler-0.43.0/poppler/GfxState.cc
===================================================================
--- poppler-0.43.0.orig/poppler/GfxState.cc
+++ poppler-0.43.0/poppler/GfxState.cc
@@ -5098,8 +5098,14 @@ GfxGouraudTriangleShading *GfxGouraudTri
}
}
delete bitBuf;
- if (typeA == 5 && nVerticesA > 0) {
+ if (typeA == 5 && nVerticesA > 0 && vertsPerRow > 0) {
nRows = nVerticesA / vertsPerRow;
+ if (nRows == 0) {
+ error(errSyntaxError, -1,
+ "Invalid VerticesPerRow in shading dictionary");
+ gfree(verticesA);
+ goto err1;
+ }
nTrianglesA = (nRows - 1) * 2 * (vertsPerRow - 1);
trianglesA = (int (*)[3])gmallocn(nTrianglesA * 3, sizeof(int));
k = 0;