Fix crash in broken files
Bug #102854
diff --git a/poppler/Stream.cc b/poppler/Stream.cc
index f4eda85..0ad602c 100644
--- a/poppler/Stream.cc
+++ b/poppler/Stream.cc
@@ -454,11 +454,10 @@
} else {
imgLineSize = nVals;
}
- if (width > INT_MAX / nComps) {
- // force a call to gmallocn(-1,...), which will throw an exception
+ if (nComps <= 0 || width > INT_MAX / nComps) {
imgLineSize = -1;
}
- imgLine = (Guchar *)gmallocn(imgLineSize, sizeof(Guchar));
+ imgLine = (Guchar *)gmallocn_checkoverflow(imgLineSize, sizeof(Guchar));
}
imgIdx = nVals;
}