diff --git a/libImaging/Storage.c b/libImaging/Storage.c index 04d6dd230..096717ce3 100644 --- a/libImaging/Storage.c +++ b/libImaging/Storage.c @@ -56,6 +56,11 @@ ImagingNewPrologueSubtype(const char *mode, int xsize, int ysize, if (!im) return (Imaging) ImagingError_MemoryError(); + /* linesize overflow check, roughly the current largest space req'd */ + if (xsize > (INT_MAX / 4) - 1) { + return (Imaging) ImagingError_MemoryError(); + } + /* Setup image descriptor */ im->xsize = xsize; im->ysize = ysize; @@ -306,8 +311,8 @@ ImagingNewArray(const char *mode, int xsize, int ysize) /* Allocate image as an array of lines */ for (y = 0; y < im->ysize; y++) { - /* malloc check UNDONE - where is linesize set? */ - p = (char *) malloc(im->linesize); + /* malloc check linesize checked in prologue */ + p = (char *) calloc(1, im->linesize); if (!p) { ImagingDestroyArray(im); break;