+diff --git a/xpdf/JBIG2Stream.cc b/xpdf/JBIG2Stream.cc
+index 8588931..00c8950 100644
+--- a/xpdf/JBIG2Stream.cc
++++ b/xpdf/JBIG2Stream.cc
+@@ -1977,7 +1977,14 @@ void JBIG2Stream::readTextRegionSeg(Guint segNum, GBool imm,
+ for (i = 0; i < nRefSegs; ++i) {
+ if ((seg = findSegment(refSegs[i]))) {
+ if (seg->getType() == jbig2SegSymbolDict) {
+- numSyms += ((JBIG2SymbolDict *)seg)->getSize();
++ Guint segSize = ((JBIG2SymbolDict *)seg)->getSize();
++ if (segSize > INT_MAX || numSyms > INT_MAX - segSize) {
++ error(errSyntaxError, getPos(),
++ "Too many symbols in JBIG2 text region");
++ delete codeTables;
++ return;
++ }
++ numSyms += segSize;
+ } else if (seg->getType() == jbig2SegCodeTable) {
+ codeTables->append(seg);
+ }