Skip to content

fix integer overflow in _imaging.c #1711

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
nedwill wants to merge 1 commit into from
Closed

fix integer overflow in _imaging.c #1711

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 12 additions & 0 deletions libImaging/Resample.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -138,11 +138,23 @@ ImagingResampleHorizontal(Imaging imIn, int xsize, int filter)
/* maximum number of coofs */
kmax = (int) ceil(support) * 2 + 1;

// check for overflow
if (kmax > 0 && xsize > SIZE_MAX / kmax)
return (Imaging) ImagingError_MemoryError();

// sizeof(float) should be greater than 0
if (xsize * kmax > SIZE_MAX / sizeof(float))
return (Imaging) ImagingError_MemoryError();

/* coefficient buffer */
kk = malloc(xsize * kmax * sizeof(float));
if ( ! kk)
return (Imaging) ImagingError_MemoryError();

// sizeof(int) should be greater than 0 as well
if (xsize > SIZE_MAX / (2 * sizeof(int)))
return (Imaging) ImagingError_MemoryError();

xbounds = malloc(xsize * 2 * sizeof(int));
if ( ! xbounds) {
free(kk);
Expand Down