From 77ac8e9fd9b2c1aeec3951e2bb50f7cc2c1e92d2 Mon Sep 17 00:00:00 2001 From: Sebastian Pipping Date: Sun, 19 Nov 2017 16:04:26 +0100 Subject: [PATCH] Prevent integer overflow (bug #65, CVE-2017-1000229) --- src/minitiff/tiffread.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/minitiff/tiffread.c b/src/minitiff/tiffread.c index b4910ec..5f9b376 100644 --- a/src/minitiff/tiffread.c +++ b/src/minitiff/tiffread.c @@ -350,6 +350,8 @@ minitiff_read_info(struct minitiff_info *tiff_ptr, FILE *fp) count = tiff_ptr->strip_offsets_count; if (count == 0 || count > tiff_ptr->height) goto err_invalid; + if (count > (size_t)-1 / sizeof(long)) + goto err_memory; tiff_ptr->strip_offsets = (long *)malloc(count * sizeof(long)); if (tiff_ptr->strip_offsets == NULL) goto err_memory; -- 2.14.2