JBIG2Stream::readTextRegion: Fix yet another potential integer overflow

oss-fuzz/27783

1 files changed, 3 insertions, 1 deletions

diff --git a/poppler/JBIG2Stream.cc b/poppler/JBIG2Stream.cc
index db46b1ae..111fac02 100644
--- a/poppler/JBIG2Stream.cc
+++ b/poppler/JBIG2Stream.cc
@@ -2316,7 +2316,9 @@ std::unique_ptr<JBIG2Bitmap> JBIG2Stream::readTextRegion(bool huff, bool refine,
 
                     if (decodeSuccess && syms[symID]) {
                         refDX = ((rdw >= 0) ? rdw : rdw - 1) / 2 + rdx;
-                        refDY = ((rdh >= 0) ? rdh : rdh - 1) / 2 + rdy;
+                        if (checkedAdd(((rdh >= 0) ? rdh : rdh - 1) / 2, rdy, &refDY)) {
+                            return nullptr;
+                        }
 
                         symbolBitmap = readGenericRefinementRegion(rdw + syms[symID]->getWidth(), rdh + syms[symID]->getHeight(), templ, false, syms[symID], refDX, refDY, atx, aty).release();
                     }