diff options
| author | Ray Johnston <ray.johnston@artifex.com> | 2017-07-19 22:05:33 -0700 |
|---|---|---|
| committer | Ray Johnston <ray.johnston@artifex.com> | 2017-07-20 10:01:41 -0700 |
| commit | 983e56cb679768fe5a048fbb33a43259efb9afbf (patch) | |
| tree | 47c247d3a07f1820fc3fbac5f4a0cd775686b60b /base/gxht_thresh.c | |
| parent | 877cbdf0b279bb4bf5f3b74182ab6d0101095f99 (diff) | |
| download | ghostpdl-983e56cb679768fe5a048fbb33a43259efb9afbf.tar.gz | |
Fix Bug 696398: Segfault with fuzzing file.
Oveflow of integer caused later failure even if allocation of the
ht_buffer succeeded. Detect overflow, return error.
Diffstat (limited to 'base/gxht_thresh.c')
| -rw-r--r-- | base/gxht_thresh.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/base/gxht_thresh.c b/base/gxht_thresh.c index 35f8e3f57..3fb840213 100644 --- a/base/gxht_thresh.c +++ b/base/gxht_thresh.c @@ -711,6 +711,9 @@ gxht_thresh_image_init(gx_image_enum *penum) space */ max_height = (int) ceil(fixed2float(any_abs(penum->dst_height)) / (float) penum->Height); + if ((max_height > 0) && (penum->ht_stride * spp_out > max_int / max_height)) + return -1; /* overflow */ + penum->ht_buffer = gs_alloc_bytes(penum->memory, penum->ht_stride * max_height * spp_out, |