Control: tags -1 + fixed-upstream patch Hi,
Upstream issue #1758 is still open, but upstream fixed the code on master in this commit: https://www.google.com/url?q=https://gitlab.freedesktop.org/poppler/poppler/-/commit/94c499fe&source=gmail&ust=1793769493640000&sa=E "Fix shift overflow when a sampled function has 32-bit samples" (2026-09-28, after 26.07.0) --- a/poppler/Function.cc +++ b/poppler/Function.cc @@ -373,7 +373,8 @@ - bitMask = (1 << sampleBits) - 1; + // sampleBits can be 32, so shift a 64-bit value to avoid overflowing int + bitMask = static_cast<unsigned int>((1ULL << sampleBits) - 1); It applies cleanly to poppler-26.07.0's Function.cc, and none of 26.07.0-3's debian/patches touch that file. I checked only that it applies; I did not do a full poppler build. On severity: sampleBits is limited to 1..32 just above. The only value that reaches the undefined shift is 32, and the sampleBits == 32 case reads the four bytes directly in its own branch, so bitMask is never used there. The issue is therefore the undefined-behaviour shift itself, as UBSan reports it; there is no memory-safety impact in this code path. That may support no-dsa/unimportant for stable, with the one-line cherry-pick for unstable. Thanks!
