1diff --git a/third_party/libtiff/tif_getimage.c b/third_party/libtiff/tif_getimage.c 2index 41f7dfd77..8603ff026 100644 3--- a/third_party/libtiff/tif_getimage.c 4+++ b/third_party/libtiff/tif_getimage.c 5@@ -723,6 +723,7 @@ static int gtTileContig(TIFFRGBAImage *img, uint32_t *raster, uint32_t w, 6 uint32_t this_tw, tocol; 7 int32_t this_toskew, leftmost_toskew; 8 int32_t leftmost_fromskew; 9+ int64_t safeskew; 10 uint32_t leftmost_tw; 11 tmsize_t bufsize; 12 13@@ -792,9 +793,28 @@ static int gtTileContig(TIFFRGBAImage *img, uint32_t *raster, uint32_t w, 14 /* 15 * Rightmost tile is clipped on right side. 16 */ 17- fromskew = tw - (w - tocol); 18+ safeskew = tw; 19+ safeskew -= w; 20+ safeskew += tocol; 21+ if (safeskew > INT_MAX || safeskew < INT_MIN) 22+ { 23+ _TIFFfree(buf); 24+ TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "%s", 25+ "Invalid skew"); 26+ return (0); 27+ } 28+ fromskew = safeskew; 29 this_tw = tw - fromskew; 30- this_toskew = toskew + fromskew; 31+ safeskew = toskew; 32+ safeskew += fromskew; 33+ if (safeskew > INT_MAX || safeskew < INT_MIN) 34+ { 35+ _TIFFfree(buf); 36+ TIFFErrorExt(tif->tif_clientdata, TIFFFileName(tif), "%s", 37+ "Invalid skew"); 38+ return (0); 39+ } 40+ this_toskew = safeskew; 41 } 42 tmsize_t roffset = (tmsize_t)y * w + tocol; 43 (*put)(img, raster + roffset, tocol, y, this_tw, nrow, fromskew, 44