Blame SOURCES/djvulibre-3.5.27-check-image-size.patch

3e9165
diff --git a/libdjvu/IW44Image.cpp b/libdjvu/IW44Image.cpp
3e9165
index e8d4b44..aa3d554 100644
3e9165
--- a/libdjvu/IW44Image.cpp
3e9165
+++ b/libdjvu/IW44Image.cpp
3e9165
@@ -678,9 +678,13 @@ IW44Image::Map::image(signed char *img8, int rowsize, int pixsep, int fast)
3e9165
   // Allocate reconstruction buffer
3e9165
   short *data16;
3e9165
   size_t sz = bw * bh;
3e9165
+  if (sz == 0)
3e9165
+    G_THROW("IW44Image: zero size image (corrupted file?)");
3e9165
   if (sz / (size_t)bw != (size_t)bh) // multiplication overflow
3e9165
     G_THROW("IW44Image: image size exceeds maximum (corrupted file?)");
3e9165
   GPBuffer<short> gdata16(data16,sz);
3e9165
+  if (data16 == NULL)
3e9165
+    G_THROW("IW44Image: unable to allocate image data");
3e9165
   // Copy coefficients
3e9165
   int i;
3e9165
   short *p = data16;