Blame SOURCES/djvulibre-3.5.27-unsigned-short-overflow.patch

3e9165
diff --git a/libdjvu/GBitmap.cpp b/libdjvu/GBitmap.cpp
3e9165
index c2fdbe4..e271a1d 100644
3e9165
--- a/libdjvu/GBitmap.cpp
3e9165
+++ b/libdjvu/GBitmap.cpp
3e9165
@@ -69,6 +69,7 @@
3e9165
 #include <stddef.h>
3e9165
 #include <stdlib.h>
3e9165
 #include <string.h>
3e9165
+#include <limits.h>
3e9165
 
3e9165
 // - Author: Leon Bottou, 05/1997
3e9165
 
3e9165
@@ -1284,6 +1285,8 @@ GBitmap::decode(unsigned char *runs)
3e9165
   // initialize pixel array
3e9165
   if (nrows==0 || ncolumns==0)
3e9165
     G_THROW( ERR_MSG("GBitmap.not_init") );
3e9165
+  if (ncolumns > USHRT_MAX - border)
3e9165
+    G_THROW("GBitmap: row size exceeds maximum (corrupted file?)");
3e9165
   bytes_per_row = ncolumns + border;
3e9165
   if (runs==0)
3e9165
     G_THROW( ERR_MSG("GBitmap.null_arg") );