diff options
Diffstat (limited to 'gpdl')
| -rw-r--r-- | gpdl/pngtop.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/gpdl/pngtop.c b/gpdl/pngtop.c index db189dd04..0fcf821d0 100644 --- a/gpdl/pngtop.c +++ b/gpdl/pngtop.c @@ -590,6 +590,13 @@ do_impl_process(png_interp_instance_t *png, stream_cursor_read * pr, bool eof) break; } + if (SIZE_MAX / png->byte_width < (png->interlaced ? png->height : 1)) + { + code = gs_note_error(gs_error_VMerror); + png->state = ii_state_flush; + break; + } + png->samples = gs_alloc_bytes(png->memory, (size_t)png->byte_width * (png->interlaced ? png->height : 1), "png_impl_process(samples)"); |