jbig2: Avoid integer overflow in custom allocator.

1 files changed, 5 insertions, 0 deletions

diff --git a/base/sjbig2.c b/base/sjbig2.c
index 7f530ce26..73e889abd 100644
--- a/base/sjbig2.c
+++ b/base/sjbig2.c
@@ -24,6 +24,7 @@
 #include "gdebug.h"
 #include "strimpl.h"
 #include "sjbig2.h"
+#include <limits.h>                     /* UINT_MAX */
 
 /* stream implementation */
 
@@ -185,6 +186,8 @@ typedef struct {
 static void *s_jbig2decode_alloc(Jbig2Allocator *_allocator, size_t size)
 {
         s_jbig2decode_allocator_t *allocator = (s_jbig2decode_allocator_t *) _allocator;
+        if (size > UINT_MAX)
+            return NULL;
         return gs_alloc_bytes(allocator->mem, size, "s_jbig2decode_alloc");
 }
 
@@ -197,6 +200,8 @@ static void s_jbig2decode_free(Jbig2Allocator *_allocator, void *p)
 static void *s_jbig2decode_realloc(Jbig2Allocator *_allocator, void *p, size_t size)
 {
         s_jbig2decode_allocator_t *allocator = (s_jbig2decode_allocator_t *) _allocator;
+        if (size > UINT_MAX)
+            return NULL;
         return gs_resize_object(allocator->mem, p, size, "s_jbig2decode_realloc");
 }