blob: 97cc953abcbc20a3b12237566571a5048933df22 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
|
diff --git a/third_party/libtiff/tif_dirread.c b/third_party/libtiff/tif_dirread.c
index 5e62e8131..521dbf0a4 100644
--- a/third_party/libtiff/tif_dirread.c
+++ b/third_party/libtiff/tif_dirread.c
@@ -41,6 +41,7 @@
#include "tiffiop.h"
#include <float.h>
+#include <limits.h>
#include <stdlib.h>
#define IGNORE 0 /* tag placeholder used below */
@@ -3743,6 +3744,13 @@ TIFFReadDirectory(TIFF* tif)
isTiled(tif) ? "tiles" : "strips");
goto bad;
}
+ if (tif->tif_dir.td_nstrips > INT_MAX) {
+ TIFFErrorExt(tif->tif_clientdata, module,
+ "Cannot handle %u number of %s",
+ tif->tif_dir.td_nstrips,
+ isTiled(tif) ? "tiles" : "strips");
+ goto bad;
+ }
tif->tif_dir.td_stripsperimage = tif->tif_dir.td_nstrips;
if (tif->tif_dir.td_planarconfig == PLANARCONFIG_SEPARATE)
tif->tif_dir.td_stripsperimage /= tif->tif_dir.td_samplesperpixel;
|
