• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1diff --git a/third_party/libtiff/tif_dirread.c b/third_party/libtiff/tif_dirread.c
2index 772ebaf7d..ab938eac9 100644
3--- a/third_party/libtiff/tif_dirread.c
4+++ b/third_party/libtiff/tif_dirread.c
5@@ -41,6 +41,7 @@
6
7 #include "tiffiop.h"
8 #include <float.h>
9+#include <limits.h>
10
11 #define IGNORE 0          /* tag placeholder used below */
12 #define FAILED_FII    ((uint32) -1)
13@@ -3638,6 +3639,13 @@ TIFFReadDirectory(TIFF* tif)
14 		    isTiled(tif) ? "tiles" : "strips");
15 		goto bad;
16 	}
17+	if (tif->tif_dir.td_nstrips > INT_MAX) {
18+		TIFFErrorExt(tif->tif_clientdata, module,
19+		    "Cannot handle %u number of %s",
20+		    tif->tif_dir.td_nstrips,
21+		    isTiled(tif) ? "tiles" : "strips");
22+		goto bad;
23+	}
24 	tif->tif_dir.td_stripsperimage = tif->tif_dir.td_nstrips;
25 	if (tif->tif_dir.td_planarconfig == PLANARCONFIG_SEPARATE)
26 		tif->tif_dir.td_stripsperimage /= tif->tif_dir.td_samplesperpixel;
27