Multiply safely in CCodec_TiffContext::Decode

core/fxcodec/codec/fx_codec_tiff.cpp

Index: core/fxcodec/codec/fx_codec_tiff.cpp
diff --git a/core/fxcodec/codec/fx_codec_tiff.cpp b/core/fxcodec/codec/fx_codec_tiff.cpp
index c4c745587f31fd7fa3b215f49e3a17f360000746..8046f1cc39c50de0a7c8fd1717d9ee70e2dc99aa 100644
--- a/core/fxcodec/codec/fx_codec_tiff.cpp
+++ b/core/fxcodec/codec/fx_codec_tiff.cpp
@@ -447,7 +447,11 @@ bool CCodec_TiffContext::Decode(CFX_DIBitmap* pDIBitmap) {
   uint16_t bps = 0;
   TIFFGetField(m_tif_ctx, TIFFTAG_SAMPLESPERPIXEL, &spp);
   TIFFGetField(m_tif_ctx, TIFFTAG_BITSPERSAMPLE, &bps);
-  uint32_t bpp = bps * spp;
+  FX_SAFE_UINT32 safe_bpp = bps;
+  safe_bpp *= spp;
+  if (!safe_bpp.IsValid())
+    return false;
+  uint32_t bpp = safe_bpp.ValueOrDie();
   if (bpp == 1)
     return Decode1bppRGB(pDIBitmap, height, width, bps, spp);
   if (bpp <= 8)