diff --git a/libtiff/tif_getimage.c b/libtiff/tif_getimage.c index 0ad79b7f..3460af74 100644 --- a/libtiff/tif_getimage.c +++ b/libtiff/tif_getimage.c @@ -774,10 +774,18 @@ gtTileSeparate(TIFFRGBAImage* img, uint32* raster, uint32 w, uint32 h) flip = setorientation(img); if (flip & FLIP_VERTICALLY) { + if ((tw + w) > INT_MAX) { + TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "%s", "unsupported tile size (too wide)"); + return (0); + } y = h - 1; toskew = -(int32)(tw + w); } else { + if (tw > (INT_MAX + w)) { + TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "%s", "unsupported tile size (too wide)"); + return (0); + } y = 0; toskew = -(int32)(tw - w); } @@ -945,9 +953,9 @@ gtStripContig(TIFFRGBAImage* img, uint32* raster, uint32 w, uint32 h) flip = setorientation(img); if (flip & FLIP_VERTICALLY) { - if ( w > 0x7FFFFFFFu ) { - TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "Width overflow"); - return (0); + if ( w > INT_MAX ) { + TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "Width overflow"); + return (0); } y = h - 1; toskew = -(int32)(w + w); @@ -1045,6 +1053,10 @@ gtStripSeparate(TIFFRGBAImage* img, uint32* raster, uint32 w, uint32 h) flip = setorientation(img); if (flip & FLIP_VERTICALLY) { + if ( w > INT_MAX ) { + TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "Width overflow"); + return (0); + } y = h - 1; toskew = -(int32)(w + w); }