|
|
|
@ -2,12 +2,14 @@ diff --git a/libdjvu/IW44Image.cpp b/libdjvu/IW44Image.cpp
|
|
|
|
|
index e8d4b44..aa3d554 100644
|
|
|
|
|
--- a/libdjvu/IW44Image.cpp
|
|
|
|
|
+++ b/libdjvu/IW44Image.cpp
|
|
|
|
|
@@ -678,7 +678,11 @@ IW44Image::Map::image(signed char *img8, int rowsize, int pixsep, int fast)
|
|
|
|
|
@@ -678,9 +678,13 @@ IW44Image::Map::image(signed char *img8, int rowsize, int pixsep, int fast)
|
|
|
|
|
// Allocate reconstruction buffer
|
|
|
|
|
short *data16;
|
|
|
|
|
size_t sz = bw * bh;
|
|
|
|
|
if (sz / (size_t)bw != (size_t)bh) // multiplication overflow
|
|
|
|
|
G_THROW("IW44Image: image size exceeds maximum (corrupted file?)");
|
|
|
|
|
+ if (sz == 0)
|
|
|
|
|
+ G_THROW("IW44Image: zero size image (corrupted file?)");
|
|
|
|
|
if (sz / (size_t)bw != (size_t)bh) // multiplication overflow
|
|
|
|
|
G_THROW("IW44Image: image size exceeds maximum (corrupted file?)");
|
|
|
|
|
GPBuffer<short> gdata16(data16,sz);
|
|
|
|
|
+ if (data16 == NULL)
|
|
|
|
|
+ G_THROW("IW44Image: unable to allocate image data");
|
|
|
|
|