commit ec2f8bca9f48935d3180dab65ef2ca455a893afd
author Albert Astals Cid <aacid@kde.org> Wed Mar 26 18:38:13 2014 +0100
committer Albert Astals Cid <aacid@kde.org> Wed Mar 26 18:43:48 2014 +0100
tree 881a19464e0e00fc317b58a3404dd3c9287b0857
parent 322e416451b7b33cba8fb3d4702207693c3c7921

Fix overflow malloc

poppler/Stream.cc

diff --git a/poppler/Stream.cc b/poppler/Stream.cc
index 8ef061a..4c00ddb 100644
--- a/poppler/Stream.cc
+++ b/poppler/Stream.cc
@@ -14,7 +14,7 @@
 // under GPL version 2 or later
 //
 // Copyright (C) 2005 Jeff Muizelaar <jeff@infidigm.net>
-// Copyright (C) 2006-2010, 2012, 2013 Albert Astals Cid <aacid@kde.org>
+// Copyright (C) 2006-2010, 2012-2014 Albert Astals Cid <aacid@kde.org>
 // Copyright (C) 2007 Krzysztof Kowalczyk <kkowalczyk@gmail.com>
 // Copyright (C) 2008 Julien Rebetez <julien@fhtagn.net>
 // Copyright (C) 2009 Carlos Garcia Campos <carlosgc@gnome.org>
@@ -452,7 +452,7 @@
 
   nVals = width * nComps;
   inputLineSize = (nVals * nBits + 7) >> 3;
-  if (nBits <= 0 || nVals > INT_MAX / nBits - 7) {
+  if (nBits <= 0 || nVals > INT_MAX / nBits - 7 || width > INT_MAX / nComps) {
     inputLineSize = -1;
   }
   inputLine = (Guchar *)gmallocn_checkoverflow(inputLineSize, sizeof(char));