1diff --git a/third_party/lcms/src/cmscgats.c b/third_party/lcms/src/cmscgats.c 2index 55f74ede8..0738a1cce 100644 3--- a/third_party/lcms/src/cmscgats.c 4+++ b/third_party/lcms/src/cmscgats.c 5@@ -1504,10 +1504,16 @@ void AllocateDataSet(cmsIT8* it8) 6 t-> nSamples = atoi(cmsIT8GetProperty(it8, "NUMBER_OF_FIELDS")); 7 t-> nPatches = atoi(cmsIT8GetProperty(it8, "NUMBER_OF_SETS")); 8 9- t-> Data = (char**)AllocChunk (it8, ((cmsUInt32Number) t->nSamples + 1) * ((cmsUInt32Number) t->nPatches + 1) *sizeof (char*)); 10- if (t->Data == NULL) { 11+ if (t -> nSamples < 0 || t->nSamples > 0x7ffe || t->nPatches < 0 || t->nPatches > 0x7ffe) 12+ { 13+ SynError(it8, "AllocateDataSet: too much data"); 14+ } 15+ else { 16+ t->Data = (char**)AllocChunk(it8, ((cmsUInt32Number)t->nSamples + 1) * ((cmsUInt32Number)t->nPatches + 1) * sizeof(char*)); 17+ if (t->Data == NULL) { 18 19- SynError(it8, "AllocateDataSet: Unable to allocate data array"); 20+ SynError(it8, "AllocateDataSet: Unable to allocate data array"); 21+ } 22 } 23 24 } 25