The JPXStream::init function in Poppler 0.78.0 and earlier doesn"t check for negative values of stream length, leading to an Integer Overflow, thereby making it possible to allocate a large memory chunk on the heap, with a size controlled by an attacker, as demonstrated by pdftocairo.marked the task 3.10-stable as completedmarked the task 3.9-stable as completedmarked the task 3.8-stable as completedmarked the task 3.7-stable as completed