Blame SOURCES/djvulibre-3.5.27-integer-overflow.patch

a9380a
diff --git a/tools/ddjvu.cpp b/tools/ddjvu.cpp
a9380a
index 7109952..b41f7d2 100644
a9380a
--- a/tools/ddjvu.cpp
a9380a
+++ b/tools/ddjvu.cpp
a9380a
@@ -70,6 +70,7 @@
a9380a
 #include <locale.h>
a9380a
 #include <fcntl.h>
a9380a
 #include <errno.h>
a9380a
+#include <stdint.h>
a9380a
 
a9380a
 #ifdef UNIX
a9380a
 # include <sys/time.h>
a9380a
@@ -394,7 +395,9 @@ render(ddjvu_page_t *page, int pageno)
a9380a
     rowsize = rrect.w;
a9380a
   else
a9380a
     rowsize = rrect.w * 3; 
a9380a
-  if (! (image = (char*)malloc(rowsize * rrect.h)))
a9380a
+  if ((size_t)rowsize > SIZE_MAX / rrect.h)
a9380a
+    die(i18n("Integer overflow when allocating image buffer for page %d"), pageno);
a9380a
+  if (! (image = (char*)malloc((size_t)rowsize * rrect.h)))
a9380a
     die(i18n("Cannot allocate image buffer for page %d"), pageno);
a9380a
 
a9380a
   /* Render */