From 01e731fec5909d4e4c9b795b07b6af1873b72d93 Mon Sep 17 00:00:00 2001
From: CentOS Sources <bugs@centos.org>
Date: Sep 29 2020 07:02:39 +0000
Subject: import poppler-0.26.5-43.el7


---

diff --git a/SOURCES/poppler-0.26.5-tilingpatternfill-crash.patch b/SOURCES/poppler-0.26.5-tilingpatternfill-crash.patch
new file mode 100644
index 0000000..b85bcfe
--- /dev/null
+++ b/SOURCES/poppler-0.26.5-tilingpatternfill-crash.patch
@@ -0,0 +1,28 @@
+From b224e2f5739fe61de9fa69955d016725b2a4b78d Mon Sep 17 00:00:00 2001
+From: Albert Astals Cid <aacid@kde.org>
+Date: Mon, 15 Jul 2019 22:11:09 +0200
+Subject: [PATCH] SplashOutputDev::tilingPatternFill: Fix crash on broken file
+
+Issue #802
+---
+ poppler/SplashOutputDev.cc | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/poppler/SplashOutputDev.cc b/poppler/SplashOutputDev.cc
+index 544f132d..3d2befc2 100644
+--- a/poppler/SplashOutputDev.cc
++++ b/poppler/SplashOutputDev.cc
+@@ -4581,6 +4581,10 @@ bool SplashOutputDev::tilingPatternFill(GfxState *state, Gfx *gfxA, Catalog *cat
+     surface_width = (int) ceil (fabs(kx));
+     surface_height = (int) ceil (fabs(ky));
+     // adjust repeat values to completely fill region
++    if (unlikely(surface_width == 0 || surface_height == 0)) {
++        state->setCTM(savedCTM[0], savedCTM[1], savedCTM[2], savedCTM[3], savedCTM[4], savedCTM[5]);
++        return gFalse;
++    }
+     repeatX = result_width / surface_width;
+     repeatY = result_height / surface_height;
+     if (surface_width * repeatX < result_width)
+-- 
+2.24.1
+
diff --git a/SPECS/poppler.spec b/SPECS/poppler.spec
index 9408e7b..52700b7 100644
--- a/SPECS/poppler.spec
+++ b/SPECS/poppler.spec
@@ -1,7 +1,7 @@
 Summary: PDF rendering library
 Name:    poppler
 Version: 0.26.5
-Release: 42%{?dist}
+Release: 43%{?dist}
 License: (GPLv2 or GPLv3) and GPLv2+ and LGPLv2+ and MIT
 Group:   Development/Libraries
 URL:     http://poppler.freedesktop.org/
@@ -129,6 +129,9 @@ Patch44: poppler-0.26.5-JPXStream-length.patch
 # https://bugzilla.redhat.com/show_bug.cgi?id=1753850
 Patch45: poppler-0.26.5-parser-integer-overflow.patch
 
+# https://bugzilla.redhat.com/show_bug.cgi?id=1797453
+Patch46: poppler-0.26.5-tilingpatternfill-crash.patch
+
 Requires: poppler-data >= 0.4.0
 BuildRequires: automake libtool
 BuildRequires: gettext-devel
@@ -290,6 +293,7 @@ Requires: %{name}%{?_isa} = %{version}-%{release}
 %patch43 -p1 -b .jpeg2000-component-size
 %patch44 -p1 -b .jpxstream-length
 %patch45 -p1 -b .parser-integer-overflow
+%patch46 -p1 -b .divide-by-zero
 
 # hammer to nuke rpaths, recheck on new releases
 autoreconf -i -f
@@ -411,6 +415,10 @@ test "$(pkg-config --modversion poppler-splash)" = "%{version}"
 
 
 %changelog
+* Wed Apr 15 2020 Marek Kasik <mkasik@redhat.com> - 0.26.5-43
+- Fix crash on broken file in tilingPatternFill()
+- Resolves: #1801340
+
 * Fri Nov 15 2019 Marek Kasik <mkasik@redhat.com> - 0.26.5-42
 - Fix potential integer overflow and check length for negative values
 - Resolves: #1757283