X-Git-Url: https://www.fi.muni.cz/~kas/git//home/kas/public_html/git/?a=blobdiff_plain;f=tiff%2Ftiff-document.c;h=9605c16eacaf281ed04507ad87c7972a060e3192;hb=dfbda438b1e9f7427e0a5efb5daed603e8a51d61;hp=5c8cc8d4bac0ea3c22e6d4de64206ba387b2467d;hpb=dbf6fafd2939f4ff959d2eff4181f880ebd7ceaf;p=evince.git

diff --git a/tiff/tiff-document.c b/tiff/tiff-document.c
index 5c8cc8d4..9605c16e 100644
--- a/tiff/tiff-document.c
+++ b/tiff/tiff-document.c
@@ -167,6 +167,8 @@ tiff_document_render_pixbuf (EvDocument  *document, int page, double scale)
 {
   TiffDocument *tiff_document = TIFF_DOCUMENT (document);
   int width, height;
+  gint rowstride, bytes;
+  guchar *pixels = NULL;
   GdkPixbuf *pixbuf;
   GdkPixbuf *scaled_pixbuf;
 
@@ -180,8 +182,41 @@ tiff_document_render_pixbuf (EvDocument  *document, int page, double scale)
       return NULL;
     }
 
-  TIFFGetField (tiff_document->tiff, TIFFTAG_IMAGEWIDTH, &width);
-  TIFFGetField (tiff_document->tiff, TIFFTAG_IMAGELENGTH, &height);
+  if (!TIFFGetField (tiff_document->tiff, TIFFTAG_IMAGEWIDTH, &width))
+    {
+      pop_handlers ();
+      return NULL;
+    }
+
+  if (! TIFFGetField (tiff_document->tiff, TIFFTAG_IMAGELENGTH, &height))
+    {
+      pop_handlers ();
+      return NULL;
+    }
+
+  pop_handlers ();
+
+  /* Sanity check the doc */
+  if (width <= 0 || height <= 0)
+    return NULL;                
+        
+  rowstride = width * 4;
+  if (rowstride / 4 != width)
+    /* overflow */
+    return NULL;                
+        
+  bytes = height * rowstride;
+  if (bytes / rowstride != height)
+    /* overflow */
+    return NULL;                
+
+  pixels = g_try_malloc (bytes);
+  if (!pixels)
+    return NULL;
+
+  pixbuf = gdk_pixbuf_new_from_data (pixels, GDK_COLORSPACE_RGB, TRUE, 8, 
+				     width, height, rowstride,
+				     (GdkPixbufDestroyNotify) g_free, NULL);
 
   pixbuf = gdk_pixbuf_new (GDK_COLORSPACE_RGB, TRUE, 8, width, height);
   TIFFReadRGBAImageOriented (tiff_document->tiff, width, height, (uint32 *)gdk_pixbuf_get_pixels (pixbuf), ORIENTATION_TOPLEFT, 1);