1 files changed, 36 insertions, 0 deletions
diff --git a/app-text/poppler/files/poppler-0.57.0-CVE-2017-14926.patch b/app-text/poppler/files/poppler-0.57.0-CVE-2017-14926.patch
new file mode 100644
index 000000000000..882cf0e2b8b5
--- /dev/null
+++ b/app-text/poppler/files/poppler-0.57.0-CVE-2017-14926.patch
@@ -0,0 +1,36 @@
+From 170fe21144d469d3f865eda6e298df440b784499 Mon Sep 17 00:00:00 2001
+From: Albert Astals Cid <aacid@kde.org>
+Date: Fri, 8 Sep 2017 18:28:15 +0200
+Subject: [PATCH 2/3] Annot: Fix crash on broken files
+
+Bug #102601
+
+(cherry picked from commit 2532df6060092e9fab7f041ae9598aff9cdd94bb)
+---
+ poppler/Annot.cc | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/poppler/Annot.cc b/poppler/Annot.cc
+index 27b698db..643ff12c 100644
+--- a/poppler/Annot.cc
++++ b/poppler/Annot.cc
+@@ -6865,13 +6865,13 @@ AnnotRichMedia::Content::Content(Dict *dict) {
+       assets = (Asset **)gmallocn(nAssets, sizeof(Asset *));
+ 
+       int counter = 0;
+-      for (int i = 0; i < obj2.arrayGetLength(); i += 2) {
++      for (int i = 0; i < nAssets; ++i) {
+         Object objKey;
+ 
+         assets[counter] = new AnnotRichMedia::Asset;
+ 
+-        obj2.arrayGet(i, &objKey);
+-        obj2.arrayGet(i + 1, &assets[counter]->fileSpec);
++        obj2.arrayGet(i * 2, &objKey);
++        obj2.arrayGet(i * 2 + 1, &assets[counter]->fileSpec);
+ 
+         assets[counter]->name = new GooString( objKey.getString() );
+         ++counter;
+-- 
+2.14.1
+