fix(cve): CVE-2026-93311 - Fix shift overflow when a sampled function has 32-bit samples

debian/changelog

@@ -1,3 +1,12 @@
+poppler (22.12.0-2+deb12u3deepin2) unstable; urgency=medium
+
+  * fix(cve): CVE-2026-93311 (medium) - Fix shift overflow when a
+    sampled function has 32-bit samples   Upstream:
+    https://gitlab.freedesktop.org/poppler/poppler/-
+    /commit/94c499fe.patch
+
+ -- deepin-ci-robot <packages@deepin.org>  Fri, 06 Nov 2026 12:02:49 +0800
+
 poppler (22.12.0-2+deb12u3deepin1) unstable; urgency=medium
 
   * fix(cve): CVE-2026-93314 (medium) - FoFiTrueType::mapCodeToGID: Improve

debian/patches/CVE-2026-93311.patch

@@ -0,0 +1,20 @@
+Description: CVE-2026-93311 (medium) - Fix shift overflow when a sampled function has 32-bit samples
+Author: William Bader <william@newspapersystems.com>
+Origin: https://gitlab.freedesktop.org/poppler/poppler/-/commit/94c499fe.patch
+Bug: https://nvd.nist.gov/vuln/detail/CVE-2026-93311
+Last-Update: Tue, 8 Sep 2026 18:43:41 +0300
+---
+diff --git a/poppler/Function.cc b/poppler/Function.cc
+index 65888a0..2ce3668 100644
+--- a/poppler/Function.cc
++++ b/poppler/Function.cc
+@@ -365,7 +365,8 @@ SampledFunction::SampledFunction(Object *funcObj, Dict *dict) : cacheOut {}
+     }
+     buf = 0;
+     bits = 0;
+-    bitMask = (1 << sampleBits) - 1;
++    // sampleBits can be 32, so shift a 64-bit value to avoid overflowing int
++    bitMask = static_cast<unsigned int>((1ULL << sampleBits) - 1);
+     str->reset();
+     for (i = 0; i < nSamples; ++i) {
+         if (sampleBits == 8) {

debian/patches/series

@@ -15,3 +15,4 @@ CVE-2026-93312.patch
 CVE-2026-107705.patch
 CVE-2026-102621.patch
 CVE-2026-102620.patch
+CVE-2026-93311.patch