• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1diff --git a/third_party/libtiff/tif_dirread.c b/third_party/libtiff/tif_dirread.c
2index 35425b4b8..4c3b75603 100644
3--- a/third_party/libtiff/tif_dirread.c
4+++ b/third_party/libtiff/tif_dirread.c
5@@ -4627,6 +4627,14 @@ int TIFFReadDirectory(TIFF *tif)
6                       isTiled(tif) ? "tiles" : "strips");
7         goto bad;
8     }
9+    if (tif->tif_dir.td_nstrips > INT_MAX)
10+    {
11+        TIFFErrorExt(tif->tif_clientdata, module,
12+                     "Cannot handle %u number of %s",
13+                     tif->tif_dir.td_nstrips,
14+                     isTiled(tif) ? "tiles" : "strips");
15+        goto bad;
16+    }
17     tif->tif_dir.td_stripsperimage = tif->tif_dir.td_nstrips;
18     if (tif->tif_dir.td_planarconfig == PLANARCONFIG_SEPARATE)
19         tif->tif_dir.td_stripsperimage /= tif->tif_dir.td_samplesperpixel;
20