djvulibre/trunk/djvulibre-unsigned-short-overflow.patch

   1 diff --git a/libdjvu/GBitmap.cpp b/libdjvu/GBitmap.cpp
   2 index c2fdbe4..e271a1d 100644
   3 --- a/libdjvu/GBitmap.cpp
   4 +++ b/libdjvu/GBitmap.cpp
   5 @@ -69,6 +69,7 @@
   6  #include <stddef.h>
   7  #include <stdlib.h>
   8  #include <string.h>
   9 +#include <limits.h>
  10
  11  // - Author: Leon Bottou, 05/1997
  12
  13 @@ -1284,6 +1285,8 @@ GBitmap::decode(unsigned char *runs)
  14    // initialize pixel array
  15    if (nrows==0 || ncolumns==0)
  16      G_THROW( ERR_MSG("GBitmap.not_init") );
  17 +  if (ncolumns > USHRT_MAX - border)
  18 +    G_THROW("GBitmap: row size exceeds maximum (corrupted file?)");
  19    bytes_per_row = ncolumns + border;
  20    if (runs==0)
  21      G_THROW( ERR_MSG("GBitmap.null_arg") );