1 diff --git a/third_party/libtiff/tif_dirread.c b/third_party/libtiff/tif_dirread.c 2 index 772ebaf7d..ab938eac9 100644 3 --- a/third_party/libtiff/tif_dirread.c 4 +++ b/third_party/libtiff/tif_dirread.c 5 @@ -41,6 +41,7 @@ 6 7 #include "tiffiop.h" 8 #include <float.h> 9 +#include <limits.h> 10 11 #define IGNORE 0 /* tag placeholder used below */ 12 #define FAILED_FII ((uint32) -1) 13 @@ -3638,6 +3639,13 @@ TIFFReadDirectory(TIFF* tif) 14 isTiled(tif) ? "tiles" : "strips"); 15 goto bad; 16 } 17 + if (tif->tif_dir.td_nstrips > INT_MAX) { 18 + TIFFErrorExt(tif->tif_clientdata, module, 19 + "Cannot handle %u number of %s", 20 + tif->tif_dir.td_nstrips, 21 + isTiled(tif) ? "tiles" : "strips"); 22 + goto bad; 23 + } 24 tif->tif_dir.td_stripsperimage = tif->tif_dir.td_nstrips; 25 if (tif->tif_dir.td_planarconfig == PLANARCONFIG_SEPARATE) 26 tif->tif_dir.td_stripsperimage /= tif->tif_dir.td_samplesperpixel; 27
