diff --git a/third_party/libtiff/tif_dirread.c b/third_party/libtiff/tif_dirread.c index 35425b4b8..4c3b75603 100644 --- a/third_party/libtiff/tif_dirread.c +++ b/third_party/libtiff/tif_dirread.c @@ -4627,6 +4627,14 @@ int TIFFReadDirectory(TIFF *tif) isTiled(tif) ? "tiles" : "strips"); goto bad; } + if (tif->tif_dir.td_nstrips > INT_MAX) + { + TIFFErrorExt(tif->tif_clientdata, module, + "Cannot handle %u number of %s", + tif->tif_dir.td_nstrips, + isTiled(tif) ? "tiles" : "strips"); + goto bad; + } tif->tif_dir.td_stripsperimage = tif->tif_dir.td_nstrips; if (tif->tif_dir.td_planarconfig == PLANARCONFIG_SEPARATE) tif->tif_dir.td_stripsperimage /= tif->tif_dir.td_samplesperpixel;