about summary refs log tree commit diff
path: root/lib
diff options
context:
space:
mode:
authorgiraffedata <giraffedata@9d0c8265-081b-0410-96cb-a4ca84ce46f8>2023-10-21 20:13:26 +0000
committergiraffedata <giraffedata@9d0c8265-081b-0410-96cb-a4ca84ce46f8>2023-10-21 20:13:26 +0000
commit6f46bc6bc1154208cc4b2122669b259f1259f25a (patch)
tree0045e80f675bca0b24327e08d4d5577d05ba6153 /lib
parent56619691402a6ef78a876ad8e8fcbf8f6c9b2d1d (diff)
downloadnetpbm-mirror-6f46bc6bc1154208cc4b2122669b259f1259f25a.tar.gz
netpbm-mirror-6f46bc6bc1154208cc4b2122669b259f1259f25a.tar.xz
netpbm-mirror-6f46bc6bc1154208cc4b2122669b259f1259f25a.zip
Fix arithmetic overflow
git-svn-id: http://svn.code.sf.net/p/netpbm/code/trunk@4772 9d0c8265-081b-0410-96cb-a4ca84ce46f8
Diffstat (limited to 'lib')
-rw-r--r--lib/libpammap.c7
1 files changed, 5 insertions, 2 deletions
diff --git a/lib/libpammap.c b/lib/libpammap.c
index 569156fe..a0e7fb55 100644
--- a/lib/libpammap.c
+++ b/lib/libpammap.c
@@ -102,12 +102,15 @@ static struct tupleint_list_item *
 allocTupleIntListItem(struct pam * const pamP) {
 
 
-    /* This is complicated by the fact that the last element of a
-       tupleint_list_item is of variable length, because the last element
+    /* This is complicated by the fact that the last member of a
+       tupleint_list_item is of variable length, because the last member
        of _it_ is of variable length
     */
     struct tupleint_list_item * retval;
 
+    if (pamP->depth > (UINT_MAX - sizeof(*retval)) / sizeof(sample))
+        pm_error("Depth %u is too large for computation", pamP->depth);
+
     unsigned int const size =
         sizeof(*retval) - sizeof(retval->tupleint.tuple)
         + pamP->depth * sizeof(sample);