python-pillow/Pillow
1
1
Fork 0
mirror of https://github.com/python-pillow/Pillow.git synced 2025-10-31 07:57:27 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix integer overflow in Resample.c

Browse Source
This commit is contained in:
Ned Williamson 2016-02-04 01:54:12 -05:00 committed by wiredfool
parent 5fdf23ab1c
commit 41fae6d9e2
1 changed files with 12 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
libImaging/Resample.c
View File

@ -138,11 +138,23 @@ ImagingResampleHorizontal(Imaging imIn, int xsize, int filter)
/* maximum number of coofs */ /* maximum number of coofs */
kmax = (int) ceil(support) * 2 + 1; kmax = (int) ceil(support) * 2 + 1;
// check for overflow
if (kmax > 0 && xsize > SIZE_MAX / kmax)
return (Imaging) ImagingError_MemoryError();
// sizeof(float) should be greater than 0
if (xsize * kmax > SIZE_MAX / sizeof(float))
return (Imaging) ImagingError_MemoryError();
/* coefficient buffer */ /* coefficient buffer */
kk = malloc(xsize * kmax * sizeof(float)); kk = malloc(xsize * kmax * sizeof(float));
if ( ! kk) if ( ! kk)
return (Imaging) ImagingError_MemoryError(); return (Imaging) ImagingError_MemoryError();
// sizeof(int) should be greater than 0 as well
if (xsize > SIZE_MAX / (2 * sizeof(int)))
return (Imaging) ImagingError_MemoryError();
xbounds = malloc(xsize * 2 * sizeof(int)); xbounds = malloc(xsize * 2 * sizeof(int));
if ( ! xbounds) { if ( ! xbounds) {
free(kk); free(kk);