Bug 695348: Proper fix for avoiding SEGV in interpolated scalar.

Avoid using the interpolated scaler for images where the
calculations have overflowed.

1 files changed, 15 insertions, 0 deletions

diff --git a/gs/base/gxiscale.c b/gs/base/gxiscale.c
index 8de9ef6ea..05bd68bdb 100644
--- a/gs/base/gxiscale.c
+++ b/gs/base/gxiscale.c
@@ -48,6 +48,8 @@
 #include "gsicc.h"
 #include "gxdevsop.h"
 
+#include <limits.h>             /* For INT_MAX */
+
 static void
 decode_sample_frac_to_float(gx_image_enum *penum, frac sample_value, gs_client_color *cc, int i);
 
@@ -100,6 +102,19 @@ gs_image_class_0_interpolate(gx_image_enum * penum)
         penum->interpolate = false; /* No need to interpolate and      */
         return 0;                  /* causes division by 0 if we try. */
     }
+    if (any_abs(penum->dst_width) < 0 || any_abs(penum->dst_height) < 0)
+    {
+        /* A calculation has overflowed. Bale */
+        return 0;
+    }
+    if (penum->x_extent.x == INT_MIN || penum->x_extent.x == INT_MAX ||
+        penum->x_extent.y == INT_MIN || penum->x_extent.y == INT_MAX ||
+        penum->y_extent.x == INT_MIN || penum->y_extent.x == INT_MAX ||
+        penum->y_extent.y == INT_MIN || penum->y_extent.y == INT_MAX)
+    {
+        /* A calculation has overflowed. Bale */
+        return 0;
+    }
     if ( pcs->cmm_icc_profile_data != NULL ) {
         use_icc = true;
     }