[rpms/mupdf] f43: fix CVE-2026-7233 (rhbz#2463402)

[Michael J Gruber <mjg@fedoraproject.org>]

A new commit has been pushed.

Repo   : rpms/mupdf
Branch : f43
Commit : 92991ae4935d70613b86cf1cc8f8c68ccd3d1659
Author : Michael J Gruber <mjg@fedoraproject.org>
Date   : 2026-07-16T09:59:32+02:00
Stats  : +41/-1 in 2 file(s)
URL    : https://src.fedoraproject.org/rpms/mupdf/c/92991ae4935d70613b86cf1cc8f8c68ccd3d1659?branch=f43

Log:
fix CVE-2026-7233 (rhbz#2463402)

---
diff --git a/0001-Bug-709364-Fix-missing-bounds-checks-in-CFF-subsetti.patch b/0001-Bug-709364-Fix-missing-bounds-checks-in-CFF-subsetti.patch
new file mode 100644
index 0000000..8d5063f
--- /dev/null
+++ b/0001-Bug-709364-Fix-missing-bounds-checks-in-CFF-subsetti.patch
@@ -0,0 +1,38 @@
+From 7da80849dccb7108a0a732d3c0392a2b575aac6d Mon Sep 17 00:00:00 2001
+Message-ID: <7da80849dccb7108a0a732d3c0392a2b575aac6d.1784187361.git.mjg@fedoraproject.org>
+From: Robin Watts <Robin.Watts@artifex.com>
+Date: Wed, 13 May 2026 14:57:47 +0100
+Subject: [PATCH] Bug 709364: Fix missing bounds checks in CFF subsetting
+
+Thanks to Jenny Guanni Qu for the report and original patch.
+
+(cherry picked from commit 611f75f0c8657b92460554009196c5ac4b68d909)
+---
+ source/fitz/subset-cff.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/source/fitz/subset-cff.c b/source/fitz/subset-cff.c
+index 65cf1564d..38eabcd90 100644
+--- a/source/fitz/subset-cff.c
++++ b/source/fitz/subset-cff.c
+@@ -311,7 +311,7 @@ index_load(fz_context *ctx, index_t *index, const uint8_t *base, uint32_t len, u
+ 	data_offset = 3 + (index->count+1) * os - 1;
+ 	index->data_offset = data_offset + offset;
+ 
+-	if (data_offset > len)
++	if (index->data_offset > len)
+ 		fz_throw(ctx, FZ_ERROR_FORMAT, "Truncated index");
+ 
+ 	data += 3;
+@@ -327,7 +327,7 @@ index_load(fz_context *ctx, index_t *index, const uint8_t *base, uint32_t len, u
+ 			fz_throw(ctx, FZ_ERROR_FORMAT, "Index not monotonic");
+ 		prev = v;
+ 	}
+-	if (v > len)
++	if (index->data_offset + v > len)
+ 		fz_throw(ctx, FZ_ERROR_FORMAT, "Truncated index");
+ 
+ 	data += prev - 1;
+-- 
+2.55.0.349.g25e4f52c35
+

diff --git a/mupdf.spec b/mupdf.spec
index c557016..4d3df7b 100644
--- a/mupdf.spec
+++ b/mupdf.spec
@@ -25,12 +25,14 @@ Source2:	%{name}-gl.desktop
 # Upstream patches from master branch:
 # rhbz#2454361 and siblings
 Patch:		0001-Bug-708990-Avoid-overflow-src_stride-calculation-in-.patch
+# rhbz#2463402
+Patch:		0001-Bug-709364-Fix-missing-bounds-checks-in-CFF-subsetti.patch
 # Fedora specific patches:
 # Do not bug me if Artifex relies on local fork
 Patch:		0001-Do-not-complain-to-your-friendly-local-distribution-.patch
 # Do not generate wrong form of dependencies
 Patch:		0001-setup.py-do-not-require-libclang-and-swig.patch
-# Do install shared libraries in the python tree
+# Do not install shared libraries in the python tree
 Patch:		0001-setup.py-do-not-bundle-c-and-c-libs-in-wheel.patch
 # Suggested upstream:
 # Avoid core dump of python bindings with gcc15