git: 37d1fc9366fd - 2026Q3 - graphics/poppler: Fix CVE-2026-10118

The branch 2026Q3 has been updated by mce:

URL: https://cgit.FreeBSD.org/ports/commit/?id=37d1fc9366fd2ea23fe5e58b8f81d9b182d59734

commit 37d1fc9366fd2ea23fe5e58b8f81d9b182d59734
Author:     Kousuke Kannagi <mce@FreeBSD.org>
AuthorDate: 2026-07-14 07:26:45 +0000
Commit:     Kousuke Kannagi <mce@FreeBSD.org>
CommitDate: 2026-07-14 13:18:55 +0000

    graphics/poppler: Fix CVE-2026-10118
    
    PR:             296769
    Security:       CVE-2026-10118
    Approved by:    desktop (arrowd)
    Approved by:    osa (mentor)
    MFH:            2026Q3
    
    (cherry picked from commit fcafe0397f536499c548605740b9ef7ed62b1cbf)
---
 graphics/poppler/Makefile                          |  1 +
 .../poppler/files/patch-poppler_SplashOutputDev.cc | 32 ++++++++++++++++++++++
 2 files changed, 33 insertions(+)

diff --git a/graphics/poppler/Makefile b/graphics/poppler/Makefile
index ca2f49415d8e..8366752962d9 100644
--- a/graphics/poppler/Makefile
+++ b/graphics/poppler/Makefile
@@ -1,5 +1,6 @@
 PORTNAME=	poppler
 DISTVERSION=	26.04.0
+PORTREVISION=	1
 CATEGORIES=	graphics print
 MASTER_SITES=	https://poppler.freedesktop.org/
 DISTFILES=	${DISTNAME}${EXTRACT_SUFX}
diff --git a/graphics/poppler/files/patch-poppler_SplashOutputDev.cc b/graphics/poppler/files/patch-poppler_SplashOutputDev.cc
new file mode 100644
index 000000000000..270a3bd1c34c
--- /dev/null
+++ b/graphics/poppler/files/patch-poppler_SplashOutputDev.cc
@@ -0,0 +1,32 @@
+Fix integer overflow in tilingPatternFill
+
+https://gitlab.freedesktop.org/poppler/poppler/-/commit/8352264766652b98336e92359a70b3161a9ab97a
+
+--- poppler/SplashOutputDev.cc.orig	2026-07-14 05:03:29 UTC
++++ poppler/SplashOutputDev.cc
+@@ -45,6 +45,7 @@
+ // Copyright (C) 2020-2022 Oliver Sander <oliver.sander@tu-dresden.de>
+ // Copyright (C) 2024-2026 g10 Code GmbH, Author: Sune Stolborg Vuorela <sune@vuorela.dk>
+ // Copyright (C) 2025 Arnav V <arnav0872@gmail.com>
++// Copyright (C) 2026 Marek Kasik <mkasik@redhat.com>
+ //
+ // To see a description of the changes please see the Changelog file that
+ // came with your tarball or type make ChangeLog if you are building from git
+@@ -4337,7 +4338,7 @@ bool SplashOutputDev::tilingPatternFill(GfxState *stat
+     matc[2] = ctm[2];
+     matc[3] = ctm[3];
+ 
+-    if (surface_width == 0 || surface_height == 0 || repeatX * repeatY <= 4) {
++    if (surface_width == 0 || surface_height == 0 || repeatX * repeatY <= 4 || checkedMultiply(surface_width, repeatX, &result_width) || checkedMultiply(surface_height, repeatY, &result_height)) {
+         state->setCTM(savedCTM[0], savedCTM[1], savedCTM[2], savedCTM[3], savedCTM[4], savedCTM[5]);
+         return false;
+     }
+@@ -4359,8 +4360,6 @@ bool SplashOutputDev::tilingPatternFill(GfxState *stat
+         kx = matc[0];
+         ky = matc[3] - (matc[1] * matc[2]) / matc[0];
+     }
+-    result_width = surface_width * repeatX;
+-    result_height = surface_height * repeatY;
+     kx = result_width / (fabs(kx) + 1);
+     ky = result_height / (fabs(ky) + 1);
+     state->concatCTM(kx, 0, 0, ky, 0, 0);