new file mode 100644
@@ -0,0 +1,145 @@
+From b8ce8bb5df02fd3a70f4b34f3d64c88df7089409 Mon Sep 17 00:00:00 2001
+From: Albert Astals Cid <aacid@kde.org>
+Date: Sat, 8 Aug 2026 15:30:32 +0200
+Subject: [PATCH] FoFiTrueType::cvtSfnts: Move variables closer to where they
+ are used
+
+(cherry picked from commit 786b06dac87dbe28e85ec7ea3d340810f151c25b)
+
+CVE: CVE-2026-102620
+Upstream-Status: Backport [https://gitlab.freedesktop.org/poppler/poppler/-/commit/786b06dac87dbe28e85ec7ea3d340810f151c25b]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ fofi/FoFiTrueType.cc | 42 +++++++++++++++++++-----------------------
+ 1 file changed, 19 insertions(+), 23 deletions(-)
+
+diff --git a/fofi/FoFiTrueType.cc b/fofi/FoFiTrueType.cc
+index 133fbc45e..e15cfc576 100644
+--- a/fofi/FoFiTrueType.cc
++++ b/fofi/FoFiTrueType.cc
+@@ -1058,9 +1058,6 @@ void FoFiTrueType::cvtSfnts(FoFiOutputFunc outputFunc, void *outputStream, const
+ TrueTypeTable newTables[nT42Tables];
+ unsigned char tableDir[12 + nT42Tables * 16];
+ bool ok;
+- unsigned int checksum;
+- int nNewTables;
+- int glyfTableLen, length, glyfPos, j, k;
+ std::array<unsigned char, 36> vheaTab = {
+ 0, 1, 0, 0, // table version number
+ 0, 0, // ascent
+@@ -1081,8 +1078,6 @@ void FoFiTrueType::cvtSfnts(FoFiOutputFunc outputFunc, void *outputStream, const
+ 0, 1 // number of advance heights in vmtx table
+ };
+ std::vector<unsigned char> vmtxTab;
+- bool needVhea, needVmtx;
+- int advance;
+
+ *maxUsedGlyph = -1;
+
+@@ -1116,7 +1111,7 @@ void FoFiTrueType::cvtSfnts(FoFiOutputFunc outputFunc, void *outputStream, const
+ i = seekTable("loca");
+ pos = tables[i].offset;
+ i = seekTable("glyf");
+- glyfTableLen = tables[i].len;
++ const int glyfTableLen = tables[i].len;
+ ok = true;
+ for (i = 0; i <= nGlyphs; ++i) {
+ locaTable[i].idx = i;
+@@ -1169,16 +1164,16 @@ void FoFiTrueType::cvtSfnts(FoFiOutputFunc outputFunc, void *outputStream, const
+ }
+
+ // count the number of tables
+- nNewTables = 0;
++ int nNewTables = 0;
+ for (i = 0; i < nT42Tables; ++i) {
+ if (t42Tables[i].required || seekTable(t42Tables[i].tag) >= 0) {
+ ++nNewTables;
+ }
+ }
+- advance = 0; // make gcc happy
++ int advance = 0; // make gcc happy
+ if (needVerticalMetrics) {
+- needVhea = seekTable("vhea") < 0;
+- needVmtx = seekTable("vmtx") < 0;
++ const bool needVhea = seekTable("vhea") < 0;
++ const bool needVmtx = seekTable("vmtx") < 0;
+ if (needVhea || needVmtx) {
+ i = seekTable("head");
+ advance = getU16BE(tables[i].offset + 18, &ok); // units per em
+@@ -1194,10 +1189,10 @@ void FoFiTrueType::cvtSfnts(FoFiOutputFunc outputFunc, void *outputStream, const
+ // construct the new table headers, including table checksums
+ // (pad each table out to a multiple of 4 bytes)
+ pos = 12 + nNewTables * 16;
+- k = 0;
++ int k = 0;
+ for (i = 0; i < nT42Tables; ++i) {
+- length = -1;
+- checksum = 0; // make gcc happy
++ int length = -1;
++ unsigned int checksum = 0; // make gcc happy
+ if (i == t42HeadTable) {
+ length = 54;
+ checksum = computeTableChecksum(headData);
+@@ -1207,8 +1202,8 @@ void FoFiTrueType::cvtSfnts(FoFiOutputFunc outputFunc, void *outputStream, const
+ } else if (i == t42GlyfTable) {
+ length = 0;
+ checksum = 0;
+- glyfPos = tables[seekTable("glyf")].offset;
+- for (j = 0; j < nGlyphs; ++j) {
++ const int glyfPos = tables[seekTable("glyf")].offset;
++ for (int j = 0; j < nGlyphs; ++j) {
+ length += locaTable[j].len;
+ if (length & 3) {
+ length += 4 - (length & 3);
+@@ -1218,7 +1213,8 @@ void FoFiTrueType::cvtSfnts(FoFiOutputFunc outputFunc, void *outputStream, const
+ }
+ }
+ } else {
+- if ((j = seekTable(t42Tables[i].tag)) >= 0) {
++ const int j = seekTable(t42Tables[i].tag);
++ if (j >= 0) {
+ length = tables[j].len;
+ if (checkRegion(tables[j].offset, length)) {
+ checksum = computeTableChecksum(std::span(file.data() + tables[j].offset, length));
+@@ -1298,7 +1294,7 @@ void FoFiTrueType::cvtSfnts(FoFiOutputFunc outputFunc, void *outputStream, const
+ }
+
+ // compute the font checksum and store it in the head table
+- checksum = computeTableChecksum(std::span(tableDir, 12 + nNewTables * 16));
++ unsigned int checksum = computeTableChecksum(std::span(tableDir, 12 + nNewTables * 16));
+ for (i = 0; i < nNewTables; ++i) {
+ checksum += newTables[i].checksum;
+ }
+@@ -1325,11 +1321,10 @@ void FoFiTrueType::cvtSfnts(FoFiOutputFunc outputFunc, void *outputStream, const
+ if (i == t42HeadTable) {
+ dumpString(headData, outputFunc, outputStream);
+ } else if (i == t42LocaTable) {
+- length = (nGlyphs + 1) * (locaFmt ? 4 : 2);
+ dumpString(locaData, outputFunc, outputStream);
+ } else if (i == t42GlyfTable) {
+- glyfPos = tables[seekTable("glyf")].offset;
+- for (j = 0; j < nGlyphs; ++j) {
++ const int glyfPos = tables[seekTable("glyf")].offset;
++ for (int j = 0; j < nGlyphs; ++j) {
+ if (locaTable[j].len > 0 && checkRegion(glyfPos + locaTable[j].origOffset, locaTable[j].len)) {
+ dumpString(std::span(file.data() + glyfPos + locaTable[j].origOffset, locaTable[j].len), outputFunc, outputStream);
+ }
+@@ -1338,13 +1333,14 @@ void FoFiTrueType::cvtSfnts(FoFiOutputFunc outputFunc, void *outputStream, const
+ // length == 0 means the table is missing and the error was
+ // already reported during the construction of the table
+ // headers
+- if ((length = newTables[i].len) > 0) {
+- if ((j = seekTable(t42Tables[i].tag)) >= 0 && checkRegion(tables[j].offset, tables[j].len)) {
++ const int length = newTables[i].len;
++ if (length > 0) {
++ const int j = seekTable(t42Tables[i].tag);
++ if (j >= 0 && checkRegion(tables[j].offset, tables[j].len)) {
+ dumpString(std::span(file.data() + tables[j].offset, tables[j].len), outputFunc, outputStream);
+ } else if (needVerticalMetrics && i == t42VheaTable) {
+ if (unlikely(static_cast<size_t>(length) > sizeof(vheaTab))) {
+ error(errSyntaxWarning, -1, "length bigger than vheaTab size");
+- length = sizeof(vheaTab);
+ }
+ dumpString(vheaTab, outputFunc, outputStream);
+ } else if (needVerticalMetrics && i == t42VmtxTable) {
new file mode 100644
@@ -0,0 +1,34 @@
+From ac82c990768a4cb3dd4fd15edb92af97b4ac6589 Mon Sep 17 00:00:00 2001
+From: Albert Astals Cid <aacid@kde.org>
+Date: Sat, 8 Aug 2026 15:47:43 +0200
+Subject: [PATCH] Fix integer overflow in FoFiTrueType::cvtSfnts
+
+Issue #1762
+
+(cherry picked from commit 245d3c6823377755f2c1d5fdddd010279c6ed94d)
+
+CVE: CVE-2026-102620
+Upstream-Status: Backport [https://gitlab.freedesktop.org/poppler/poppler/-/commit/245d3c6823377755f2c1d5fdddd010279c6ed94d]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ fofi/FoFiTrueType.cc | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/fofi/FoFiTrueType.cc b/fofi/FoFiTrueType.cc
+index e15cfc576..9e280fe89 100644
+--- a/fofi/FoFiTrueType.cc
++++ b/fofi/FoFiTrueType.cc
+@@ -1204,7 +1204,11 @@ void FoFiTrueType::cvtSfnts(FoFiOutputFunc outputFunc, void *outputStream, const
+ checksum = 0;
+ const int glyfPos = tables[seekTable("glyf")].offset;
+ for (int j = 0; j < nGlyphs; ++j) {
+- length += locaTable[j].len;
++ if (unlikely(checkedAdd(length, locaTable[j].len, &length))) {
++ error(errSyntaxError, -1, "Integer overflow in glyph table length calculation");
++ ok = false;
++ break;
++ }
+ if (length & 3) {
+ length += 4 - (length & 3);
+ }
@@ -9,6 +9,8 @@ SRC_URI = "http://poppler.freedesktop.org/${BP}.tar.xz \
file://0001-cmake-Do-not-use-isystem.patch \
file://0001-workaround-build-racing.patch \
file://CVE-2026-102621.patch \
+ file://CVE-2026-102620-1.patch \
+ file://CVE-2026-102620-2.patch \
"
SRC_URI[sha256sum] = "dc906e68cea698109706ac6aa3d2c9d4512fcfcac42d90b8afcda486d1b9abd0"