Rmys
34 lines
930 B
Diff
34 lines
930 B
Diff
https://codereview.chromium.org/2284063002
|
|
https://crbug.com/618267
|
|
https://pdfium.googlesource.com/pdfium/+/master/libtiff/
|
|
|
|
Author: tracy_jiang <tracy_jiang@foxitsoftware.com>
|
|
Date: Mon Aug 29 13:42:56 2016 -0700
|
|
|
|
Fix for #618267. Adding a method to determine if multiplication has
|
|
overflow.
|
|
|
|
--- a/libtiff/tif_aux.c
|
|
+++ b/libtiff/tif_aux.c
|
|
@@ -69,7 +69,7 @@ _TIFFCheckRealloc(TIFF* tif, void* buffer,
|
|
/*
|
|
* XXX: Check for integer overflow.
|
|
*/
|
|
- if (nmemb && elem_size && bytes / elem_size == nmemb)
|
|
+ if (nmemb && elem_size && !_TIFFIfMultiplicationOverflow(nmemb, elem_size))
|
|
cp = _TIFFrealloc(buffer, bytes);
|
|
|
|
if (cp == NULL) {
|
|
--- a/libtiff/tiffiop.h
|
|
+++ b/libtiff/tiffiop.h
|
|
@@ -315,6 +315,9 @@ typedef size_t TIFFIOSize_t;
|
|
#define _TIFF_off_t off_t
|
|
#endif
|
|
|
|
+#include <limits.h>
|
|
+#define _TIFFIfMultiplicationOverflow(op1, op2) ((op1) > SSIZE_MAX / (op2))
|
|
+
|
|
#if defined(__cplusplus)
|
|
extern "C" {
|
|
#endif
|