djvulibre/trunk/djvulibre-integer-overflow.patch

   1 diff --git a/tools/ddjvu.cpp b/tools/ddjvu.cpp
   2 index 7109952..b41f7d2 100644
   3 --- a/tools/ddjvu.cpp
   4 +++ b/tools/ddjvu.cpp
   5 @@ -70,6 +70,7 @@
   6  #include <locale.h>
   7  #include <fcntl.h>
   8  #include <errno.h>
   9 +#include <stdint.h>
  10
  11  #ifdef UNIX
  12  # include <sys/time.h>
  13 @@ -394,7 +395,9 @@ render(ddjvu_page_t *page, int pageno)
  14      rowsize = rrect.w;
  15    else
  16      rowsize = rrect.w * 3;
  17 -  if (! (image = (char*)malloc(rowsize * rrect.h)))
  18 +  if ((size_t)rowsize > SIZE_MAX / rrect.h)
  19 +    die(i18n("Integer overflow when allocating image buffer for page %d"), pageno);
  20 +  if (! (image = (char*)malloc((size_t)rowsize * rrect.h)))
  21      die(i18n("Cannot allocate image buffer for page %d"), pageno);
  22
  23    /* Render */