python-pillow/Pillow
1
1
Fork 0
mirror of https://github.com/python-pillow/Pillow.git synced 2025-10-29 06:57:40 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix integer overflow in Resample.c

Browse Source
This commit is contained in:
Ned Williamson 2016-02-04 01:54:12 -05:00 committed by wiredfool
parent bdd86b72ae
commit 4e0d9b0b97
1 changed files with 12 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
libImaging/Resample.c
View File

@ -138,11 +138,23 @@ ImagingResampleHorizontal(Imaging imIn, int xsize, int filter)
/* maximum number of coofs */
kmax = (int) ceil(support) * 2 + 1;
// check for overflow
if (kmax > 0 && xsize > SIZE_MAX / kmax)
return (Imaging) ImagingError_MemoryError();
// sizeof(float) should be greater than 0
if (xsize * kmax > SIZE_MAX / sizeof(float))
return (Imaging) ImagingError_MemoryError();
/* coefficient buffer */
kk = malloc(xsize * kmax * sizeof(float));
if ( ! kk)
return (Imaging) ImagingError_MemoryError();
// sizeof(int) should be greater than 0 as well
if (xsize > SIZE_MAX / (2 * sizeof(int)))
return (Imaging) ImagingError_MemoryError();
xbounds = malloc(xsize * 2 * sizeof(int));
if ( ! xbounds) {
free(kk);