Bug 706048: Detect overflow in gpdl png handling.

Give an error, rather than setting ourselves up to fail later.

1 files changed, 7 insertions, 0 deletions

diff --git a/gpdl/pngtop.c b/gpdl/pngtop.c
index db189dd04..0fcf821d0 100644
--- a/gpdl/pngtop.c
+++ b/gpdl/pngtop.c
@@ -590,6 +590,13 @@ do_impl_process(png_interp_instance_t *png, stream_cursor_read * pr, bool eof)
                 break;
             }
 
+            if (SIZE_MAX / png->byte_width < (png->interlaced ? png->height : 1))
+            {
+                code = gs_note_error(gs_error_VMerror);
+                png->state = ii_state_flush;
+                break;
+            }
+
             png->samples = gs_alloc_bytes(png->memory,
                                           (size_t)png->byte_width * (png->interlaced ? png->height : 1),
                                           "png_impl_process(samples)");