- add samples/tk-photo.pl

[imager.git] / image.c

diff --git a/image.c b/image.c
index 4fd56b4a83668026de9546f42061444996a6b505..eba037c5d0c1a1bcb55e8bff032b1cc6da519a7d 100644 (file)
--- a/image.c
+++ b/image.c
@@ -1,6 +1,5 @@
 #include "image.h"
 #include "imagei.h"
-#include "io.h"
 
 /*
 =head1 NAME
@@ -349,6 +348,8 @@ Re-new image reference
 
 i_img *
 i_img_empty_ch(i_img *im,int x,int y,int ch) {
+  int bytes;
+
   mm_log((1,"i_img_empty_ch(*im %p, x %d, y %d, ch %d)\n", im, x, y, ch));
 
   if (x < 1 || y < 1) {
@@ -359,6 +360,12 @@ i_img_empty_ch(i_img *im,int x,int y,int ch) {
     i_push_errorf(0, "channels must be between 1 and %d", MAXCHANNELS);
     return NULL;
   }
+  /* check this multiplication doesn't overflow */
+  bytes = x*y*ch;
+  if (bytes / y / ch != x) {
+    i_push_errorf(0, "integer overflow calculating image allocation");
+    return NULL;
+  }
 
   if (im == NULL)
     if ( (im=mymalloc(sizeof(i_img))) == NULL)
@@ -370,8 +377,9 @@ i_img_empty_ch(i_img *im,int x,int y,int ch) {
   im->ysize    = y;
   im->channels = ch;
   im->ch_mask  = MAXINT;
-  im->bytes=x*y*im->channels;
-  if ( (im->idata=mymalloc(im->bytes)) == NULL) m_fatal(2,"malloc() error\n"); 
+  im->bytes=bytes;
+  if ( (im->idata=mymalloc(im->bytes)) == NULL) 
+    m_fatal(2,"malloc() error\n"); 
   memset(im->idata,0,(size_t)im->bytes);
   
   im->ext_data = NULL;