Fix for #618267. Adding a method to determine if multiplication has

third_party/libtiff/tif_aux.c

 /* $Id: tif_aux.c,v 1.26 2010-07-01 15:33:28 dron Exp $ */
 
 /*
  * Copyright (c) 1991-1997 Sam Leffler
  * Copyright (c) 1991-1997 Silicon Graphics, Inc.
  *
  * Permission to use, copy, modify, distribute, and sell this software and 
  * its documentation for any purpose is hereby granted without fee, provided
  * that (i) the above copyright notices and this permission notice appear in
  * all copies of the software and related documentation, and (ii) the names of
@@ skipping 51 matching lines @@
 void*
 _TIFFCheckRealloc(TIFF* tif, void* buffer,
                   tmsize_t nmemb, tmsize_t elem_size, const char* what)
 {
         void* cp = NULL;
         tmsize_t bytes = nmemb * elem_size;
 
         /*
          * XXX: Check for integer overflow.
          */
-        if (nmemb && elem_size && bytes / elem_size == nmemb)
+        if (nmemb && elem_size && _TIFFIfMultiplicationOverflow(nmemb, elem_size))//&& bytes / elem_size == nmemb

[Tom Sepez, 2016/08/26 23:05:28]

remove the code following the // 

                 cp = _TIFFrealloc(buffer, bytes);
 
         if (cp == NULL) {
                 TIFFErrorExt(tif->tif_clientdata, tif->tif_name,
                              "Failed to allocate memory for %s "
                              "(%ld elements of %ld bytes each)",
                              what,(long) nmemb, (long) elem_size);
         }
 
         return cp;
@@ skipping 266 matching lines @@
 }
 
 /* vim: set ts=8 sts=8 sw=8 noet: */
 /*
  * Local Variables:
  * mode: c
  * c-basic-offset: 8
  * fill-column: 78
  * End:
  */