commit 5266fa426d73c5dbdb3dd903d50885097833acc6
author Albert Astals Cid <aacid@kde.org> Tue Jun 20 23:58:26 2017 +0200
committer Albert Astals Cid <aacid@kde.org> Wed Jun 21 22:31:19 2017 +0200
tree 18ce838ac8a52ed6f403f5d3df38069604d4299d
parent 112b8ab16128c6e7f80fe7c1890f7b63abd85cce

Fix crash in malformed document

Bug #101526

poppler/Stream.cc

diff --git a/poppler/Stream.cc b/poppler/Stream.cc
index 4ac9107..d93c560 100644
--- a/poppler/Stream.cc
+++ b/poppler/Stream.cc
@@ -468,7 +468,7 @@
 
   nVals = width * nComps;
   inputLineSize = (nVals * nBits + 7) >> 3;
-  if (nBits <= 0 || nVals > INT_MAX / nBits - 7 || width > INT_MAX / nComps) {
+  if (nComps <= 0 || nBits <= 0 || nVals > INT_MAX / nBits - 7 || width > INT_MAX / nComps) {
     inputLineSize = -1;
   }
   inputLine = (Guchar *)gmallocn_checkoverflow(inputLineSize, sizeof(char));