commit 2d6ba9b1483cd4ae7f90d2f7ddef5a08cc3082a2
author Albert Astals Cid <aacid@kde.org> Tue Oct 30 00:11:06 2018 +0100
committer Albert Astals Cid <aacid@kde.org> Tue Oct 30 00:11:06 2018 +0100
tree 4b0eb822bab2d7dba81f2e7de82f0b6776ae4a64
parent a186b43382a8c4e8a4443f9d7048a103499ba264

Fix crash if document is malformed (too wide)

oss-fuzz/11195

splash/Splash.cc

diff --git a/splash/Splash.cc b/splash/Splash.cc
index 7964da3..bce1015 100644
--- a/splash/Splash.cc
+++ b/splash/Splash.cc
@@ -3337,7 +3337,12 @@
 
   // allocate buffers
   lineBuf = (Guchar *)gmalloc(srcWidth);
-  pixBuf = (Guint *)gmallocn(srcWidth, sizeof(int));
+  pixBuf = (Guint *)gmallocn_checkoverflow(srcWidth, sizeof(int));
+  if (unlikely(!pixBuf)) {
+      error(errInternal, -1, "Couldn't allocate memory for pixBux in Splash::scaleMaskYdXd");
+      gfree(lineBuf);
+      return;
+  }
 
   // init y scale Bresenham
   yt = 0;