Skip to content

Commit d91198a

Browse files
committed
Fixed another integer overflow problem.
1 parent b9be3d9 commit d91198a

File tree

1 file changed

+5
-1
lines changed

1 file changed

+5
-1
lines changed

Diff for: src/libjasper/jpc/jpc_dec.c

+5-1
Original file line numberDiff line numberDiff line change
@@ -1195,6 +1195,7 @@ static int jpc_dec_process_siz(jpc_dec_t *dec, jpc_ms_t *ms)
11951195
int htileno;
11961196
int vtileno;
11971197
jpc_dec_cmpt_t *cmpt;
1198+
size_t size;
11981199

11991200
dec->xstart = siz->xoff;
12001201
dec->ystart = siz->yoff;
@@ -1231,7 +1232,10 @@ static int jpc_dec_process_siz(jpc_dec_t *dec, jpc_ms_t *ms)
12311232

12321233
dec->numhtiles = JPC_CEILDIV(dec->xend - dec->tilexoff, dec->tilewidth);
12331234
dec->numvtiles = JPC_CEILDIV(dec->yend - dec->tileyoff, dec->tileheight);
1234-
dec->numtiles = dec->numhtiles * dec->numvtiles;
1235+
if (!jas_safe_size_mul(dec->numhtiles, dec->numvtiles, &size)) {
1236+
return -1;
1237+
}
1238+
dec->numtiles = size;
12351239
JAS_DBGLOG(10, ("numtiles = %d; numhtiles = %d; numvtiles = %d;\n",
12361240
dec->numtiles, dec->numhtiles, dec->numvtiles));
12371241
if (!(dec->tiles = jas_alloc2(dec->numtiles, sizeof(jpc_dec_tile_t)))) {

0 commit comments

Comments
 (0)