1 files changed, 9 insertions, 1 deletions
diff --git a/libpng/contrib/visupng/VisualPng.c b/libpng/contrib/visupng/VisualPng.c
index 236525a59..20e1625fa 100644
--- a/libpng/contrib/visupng/VisualPng.c
+++ b/libpng/contrib/visupng/VisualPng.c
@@ -2,7 +2,7 @@
  *  VisualPng.C -- Shows a PNG image
  *------------------------------------
  *
- * Copyright 2000, Willem van Schaik.
+ * Copyright 2000,2017 Willem van Schaik.
  *
  * This code is released under the libpng license.
  * For conditions of distribution and use, see the disclaimer
@@ -726,6 +726,10 @@ BOOL DisplayImage (HWND hwnd, BYTE **ppDib,
         pDib = NULL;
     }
 
+    if (cyWinSize > ((size_t)(-1))/wDIRowBytes) {
+    {
+        MessageBox (hwnd, TEXT ("Visual PNG: image is too big");
+    }
     if (!(pDib = (BYTE *) malloc (sizeof(BITMAPINFOHEADER) +
         wDIRowBytes * cyWinSize)))
     {
@@ -847,6 +851,10 @@ BOOL FillBitmap (
             cxImgPos = (cxWinSize - cxNewSize) / 2;
         }
 
+        if (cyNewSize > ((size_t)(-1))/(cImgChannels * cxNewSize)) {
+        {
+            MessageBox (hwnd, TEXT ("Visual PNG: stretched image is too big");
+        }
         pStretchedImage = malloc (cImgChannels * cxNewSize * cyNewSize);
         pImg = pStretchedImage;