File poppler-CVE-2025-11896.patch of Package poppler.41936

From 998c6a79571af968ba90af57a0c5dcbb5a53763c Mon Sep 17 00:00:00 2001
From: Sune Vuorela <sune@vuorela.dk>
Date: Mon, 13 Oct 2025 15:13:14 +0200
Subject: [PATCH] Limit recursion in cmap parsing

fixes #1632
---
 poppler/CMap.cc | 18 +++++++++++-------
 poppler/CMap.h  | 13 +++++++------
 2 files changed, 18 insertions(+), 13 deletions(-)

Index: poppler-24.02.0/poppler/CMap.cc
===================================================================
--- poppler-24.02.0.orig/poppler/CMap.cc
+++ poppler-24.02.0/poppler/CMap.cc
@@ -65,7 +65,7 @@ static int getCharFromStream(void *data)
 
 //------------------------------------------------------------------------
 
-std::shared_ptr<CMap> CMap::parse(CMapCache *cache, const GooString *collectionA, Object *obj)
+std::shared_ptr<CMap> CMap::parse(CMapCache *cache, const GooString *collectionA, Object *obj, int recursion)
 {
     std::shared_ptr<CMap> cMap;
     GooString *cMapNameA;
@@ -77,7 +77,7 @@ std::shared_ptr<CMap> CMap::parse(CMapCa
         }
         delete cMapNameA;
     } else if (obj->isStream()) {
-        if (!(cMap = CMap::parse(nullptr, collectionA, obj->getStream()))) {
+        if (!(cMap = CMap::parse(nullptr, collectionA, obj->getStream(), recursion + 1))) {
             error(errSyntaxError, -1, "Invalid CMap in Type 0 font");
         }
     } else {
@@ -113,12 +113,16 @@ std::shared_ptr<CMap> CMap::parse(CMapCa
     return cMap;
 }
 
-std::shared_ptr<CMap> CMap::parse(CMapCache *cache, const GooString *collectionA, Stream *str)
+std::shared_ptr<CMap> CMap::parse(CMapCache *cache, const GooString *collectionA, Stream *str, int recursion)
 {
     auto cMap = std::shared_ptr<CMap>(new CMap(collectionA->copy(), nullptr));
-    Object obj1 = str->getDict()->lookup("UseCMap");
+    Ref ref;
+    Object obj1 = str->getDict()->lookup("UseCMap", &ref);
+    if (recursion > 50) {
+        return nullptr;
+    }
     if (!obj1.isNull()) {
-        cMap->useCMap(cache, &obj1);
+        cMap->useCMap(cache, &obj1, recursion);
     }
 
     str->reset();
@@ -241,9 +245,9 @@ void CMap::useCMap(CMapCache *cache, con
     }
 }
 
-void CMap::useCMap(CMapCache *cache, Object *obj)
+void CMap::useCMap(CMapCache *cache, Object *obj, int recursion)
 {
-    std::shared_ptr<CMap> subCMap = CMap::parse(cache, collection, obj);
+    std::shared_ptr<CMap> subCMap = CMap::parse(cache, collection, obj, recursion + 1);
     if (!subCMap) {
         return;
     }
Index: poppler-24.02.0/poppler/CMap.h
===================================================================
--- poppler-24.02.0.orig/poppler/CMap.h
+++ poppler-24.02.0/poppler/CMap.h
@@ -30,6 +30,7 @@
 #include <atomic>
 #include <memory>
 
+#include "Object.h"
 #include "poppler-config.h"
 #include "CharTypes.h"
 
@@ -46,7 +47,7 @@ class CMap
 public:
     // Parse a CMap from <obj>, which can be a name or a stream.  Sets
     // the initial reference count to 1.  Returns NULL on failure.
-    static std::shared_ptr<CMap> parse(CMapCache *cache, const GooString *collectionA, Object *obj);
+    static std::shared_ptr<CMap> parse(CMapCache *cache, const GooString *collectionA, Object *obj, int recursion = 0);
 
     // Create the CMap specified by <collection> and <cMapName>.  Sets
     // the initial reference count to 1.  Returns NULL on failure.
@@ -54,7 +55,7 @@ public:
 
     // Parse a CMap from <str>.  Sets the initial reference count to 1.
     // Returns NULL on failure.
-    static std::shared_ptr<CMap> parse(CMapCache *cache, const GooString *collectionA, Stream *str);
+    static std::shared_ptr<CMap> parse(CMapCache *cache, const GooString *collectionA, Stream *str, int recursion);
 
     ~CMap();
 
@@ -85,7 +86,7 @@ private:
     CMap(GooString *collectionA, GooString *cMapNameA);
     CMap(GooString *collectionA, GooString *cMapNameA, int wModeA);
     void useCMap(CMapCache *cache, const char *useName);
-    void useCMap(CMapCache *cache, Object *obj);
+    void useCMap(CMapCache *cache, Object *obj, int recursion);
     void copyVector(CMapVectorEntry *dest, CMapVectorEntry *src);
     void addCIDs(unsigned int start, unsigned int end, unsigned int nBytes, CID firstCID);
     void freeCMapVector(CMapVectorEntry *vec);