From 08624abbdfd90dce83c6cd62a21f9014825d3f0d Mon Sep 17 00:00:00 2001
From: Marek Kasik <mkasik@redhat.com>
Date: Tue, 7 May 2024 15:22:53 +0200
Subject: [PATCH] Check for zero-size image when allocating GBuffer

Resolves: #2234737
---
 0001-Check-for-zero-width-and-height.patch | 35 ++++++++++++++++++++++
 djvulibre.spec                             |  8 ++++-
 2 files changed, 42 insertions(+), 1 deletion(-)
 create mode 100644 0001-Check-for-zero-width-and-height.patch

diff --git a/0001-Check-for-zero-width-and-height.patch b/0001-Check-for-zero-width-and-height.patch
new file mode 100644
index 0000000..f6800ca
--- /dev/null
+++ b/0001-Check-for-zero-width-and-height.patch
@@ -0,0 +1,35 @@
+From 3e7facdbcdab27143327b216cddb42a6dd1a50a7 Mon Sep 17 00:00:00 2001
+From: Petr Gajdos <pgajdos@suse.cz>
+Date: Mon, 6 May 2024 11:26:12 +0200
+Subject: [PATCH] Check for zero width and height
+
+Also check for positive number of gray levels.
+
+The patch was created by Petr Gajdos for
+https://sourceforge.net/p/djvu/bugs/345/ and pushed
+by Marek Kasik to Fedora/EPEL repositories.
+---
+ libdjvu/IW44EncodeCodec.cpp | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/libdjvu/IW44EncodeCodec.cpp b/libdjvu/IW44EncodeCodec.cpp
+index f81eaeb..7a402f7 100644
+--- a/libdjvu/IW44EncodeCodec.cpp
++++ b/libdjvu/IW44EncodeCodec.cpp
+@@ -1424,7 +1424,12 @@ IWBitmap::Encode::init(const GBitmap &bm, const GP<GBitmap> gmask)
+   int h = bm.rows();
+   int g = bm.get_grays()-1;
+   signed char *buffer;
+-  GPBuffer<signed char> gbuffer(buffer,w*h);
++  size_t sz = w * h;
++  if (sz == 0 || g <= 0) // w or h is zero or g is not positive
++    G_THROW("IWBitmap: zero size image (corrupted file?)");
++  if (sz / (size_t)w != (size_t)h) // multiplication overflow
++    G_THROW("IWBitmap: image size exceeds maximum (corrupted file?)");
++  GPBuffer<signed char> gbuffer(buffer,sz);
+   // Prepare gray level conversion table
+   signed char  bconv[256];
+   for (i=0; i<256; i++)
+-- 
+2.44.0
+
diff --git a/djvulibre.spec b/djvulibre.spec
index 59b3d31..a3ca5e7 100644
--- a/djvulibre.spec
+++ b/djvulibre.spec
@@ -3,7 +3,7 @@
 Summary: DjVu viewers, encoders, and utilities
 Name: djvulibre
 Version: 3.5.28
-Release: 3%{?dist}
+Release: 4%{?dist}
 License: GPLv2+
 URL: http://djvu.sourceforge.net/
 Source0: http://downloads.sourceforge.net/djvu/%{name}-%{version}.tar.gz
@@ -16,6 +16,7 @@ Patch10: djvulibre-3.5.27-check-input-pool.patch
 Patch11: djvulibre-3.5.27-djvuport-stack-overflow.patch
 Patch12: djvulibre-3.5.27-unsigned-short-overflow.patch
 Patch14: djvulibre-3.5.27-out-of-bound-write-2.patch
+Patch15: 0001-Check-for-zero-width-and-height.patch
 
 Requires(post): xdg-utils
 Requires(preun): xdg-utils
@@ -76,6 +77,7 @@ Development files for DjVuLibre.
 %patch11 -p1 -b .djvuport-stack-overflow
 %patch12 -p1 -b .unsigned-short-overflow
 %patch14 -p1 -b .out-of-bound-write-2
+%patch15 -p1 -b .zero-size-image
 
 
 %build 
@@ -183,6 +185,10 @@ fi
 
 
 %changelog
+* Tue May 07 2024 Marek Kasik <mkasik@redhat.com> - 3.5.28-4
+- Check for zero-size image when allocating GBuffer
+- Resolves: #2234737
+
 * Tue May 07 2024 Marek Kasik <mkasik@redhat.com> - 3.5.28-3
 - Improve image size fix
 - Resolves: #2234740