diff options
Diffstat (limited to 'community/djvulibre/djvulibre-3.5.27-check-image-size.patch')
| -rw-r--r-- | community/djvulibre/djvulibre-3.5.27-check-image-size.patch | 16 |
1 files changed, 16 insertions, 0 deletions
diff --git a/community/djvulibre/djvulibre-3.5.27-check-image-size.patch b/community/djvulibre/djvulibre-3.5.27-check-image-size.patch new file mode 100644 index 00000000000..9d0d5b87993 --- /dev/null +++ b/community/djvulibre/djvulibre-3.5.27-check-image-size.patch @@ -0,0 +1,16 @@ +diff --git a/libdjvu/IW44Image.cpp b/libdjvu/IW44Image.cpp +index e8d4b44..aa3d554 100644 +--- a/libdjvu/IW44Image.cpp ++++ b/libdjvu/IW44Image.cpp +@@ -678,7 +678,11 @@ IW44Image::Map::image(signed char *img8, int rowsize, int pixsep, int fast) + size_t sz = bw * bh; + if (sz / (size_t)bw != (size_t)bh) // multiplication overflow + G_THROW("IW44Image: image size exceeds maximum (corrupted file?)"); ++ if (sz == 0) ++ G_THROW("IW44Image: zero size image (corrupted file?)"); + GPBuffer<short> gdata16(data16,sz); ++ if (data16 == NULL) ++ G_THROW("IW44Image: unable to allocate image data"); + // Copy coefficients + int i; + short *p = data16; |