blob: 7de456578c76ce4ea8b5381235273c9068ccaec6 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
|
--- libtiff/tif_fax3.c.orig 2010-05-13 19:36:08.995479161 +0200
+++ libtiff/tif_fax3.c 2010-05-13 19:48:04.215467428 +0200
@@ -42,6 +42,7 @@
#define G3CODES
#include "t4.h"
#include <stdio.h>
+#include <stdint.h>
/*
* Compression+decompression state blocks are
@@ -493,9 +494,21 @@
td->td_compression == COMPRESSION_CCITTFAX4
);
- nruns = needsRefLine ? 2*TIFFroundup(rowpixels,32) : rowpixels;
+ uint64_t val64 = rowpixels;
+ if (needsRefLine)
+ {
+ val64 = 2*TIFFroundup(rowpixels,32);
+ if (val64 > 0xffffffff)
+ return (0);
+ }
+ nruns = (val64 &0xffffffff);
nruns += 3;
- dsp->runs = (uint32*) _TIFFCheckMalloc(tif, 2*nruns, sizeof (uint32),
+
+ val64 = 2*nruns+3;
+ if (val64 > 0xffffffff)
+ return (0);
+
+ dsp->runs = (uint32*) _TIFFCheckMalloc(tif, (val64 & 0xffffffff), sizeof (uint32),
"for Group 3/4 run arrays");
if (dsp->runs == NULL)
return (0);
|
GitWeb
