Multiply safely in CCodec_TiffContext::Decode

core/fxcodec/codec/fx_codec_tiff.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include <limits>
 
 #include "core/fxcodec/codec/codec_int.h"
 #include "core/fxcodec/fx_codec.h"
@@ skipping 429 matching lines @@
         uint8_t* row_buf = (uint8_t*)pDIBitmap->GetScanline(row);
         TiffBGRA2RGBA(row_buf, img_wid, 4);
       }
       return true;
     }
   }
   uint16_t spp = 0;
   uint16_t bps = 0;
   TIFFGetField(m_tif_ctx, TIFFTAG_SAMPLESPERPIXEL, &spp);
   TIFFGetField(m_tif_ctx, TIFFTAG_BITSPERSAMPLE, &bps);
-  uint32_t bpp = bps * spp;
+  FX_SAFE_UINT32 safe_bpp = bps;
+  safe_bpp *= spp;
+  if (!safe_bpp.IsValid())
+    return false;
+  uint32_t bpp = safe_bpp.ValueOrDie();
   if (bpp == 1)
     return Decode1bppRGB(pDIBitmap, height, width, bps, spp);
   if (bpp <= 8)
     return Decode8bppRGB(pDIBitmap, height, width, bps, spp);
   if (bpp <= 24)
     return Decode24bppRGB(pDIBitmap, height, width, bps, spp);
   return false;
 }
 
 CCodec_TiffContext* CCodec_TiffModule::CreateDecoder(
@@ skipping 17 matching lines @@
 }
 
 bool CCodec_TiffModule::Decode(CCodec_TiffContext* ctx,
                                class CFX_DIBitmap* pDIBitmap) {
   return ctx->Decode(pDIBitmap);
 }
 
 void CCodec_TiffModule::DestroyDecoder(CCodec_TiffContext* ctx) {
   delete ctx;
 }