20 lines
829 B
Diff
20 lines
829 B
Diff
diff --git a/third_party/libtiff/tif_dirread.c b/third_party/libtiff/tif_dirread.c
|
|
index 35425b4b8..4c3b75603 100644
|
|
--- a/third_party/libtiff/tif_dirread.c
|
|
+++ b/third_party/libtiff/tif_dirread.c
|
|
@@ -4627,6 +4627,14 @@ int TIFFReadDirectory(TIFF *tif)
|
|
isTiled(tif) ? "tiles" : "strips");
|
|
goto bad;
|
|
}
|
|
+ if (tif->tif_dir.td_nstrips > INT_MAX)
|
|
+ {
|
|
+ TIFFErrorExt(tif->tif_clientdata, module,
|
|
+ "Cannot handle %u number of %s",
|
|
+ tif->tif_dir.td_nstrips,
|
|
+ isTiled(tif) ? "tiles" : "strips");
|
|
+ goto bad;
|
|
+ }
|
|
tif->tif_dir.td_stripsperimage = tif->tif_dir.td_nstrips;
|
|
if (tif->tif_dir.td_planarconfig == PLANARCONFIG_SEPARATE)
|
|
tif->tif_dir.td_stripsperimage /= tif->tif_dir.td_samplesperpixel;
|