| diff --git a/third_party/libtiff/tif_getimage.c b/third_party/libtiff/tif_getimage.c |
| index 8603ff026..f5a05e55b 100644 |
| --- a/third_party/libtiff/tif_getimage.c |
| +++ b/third_party/libtiff/tif_getimage.c |
| @@ -1083,6 +1083,12 @@ static int gtStripContig(TIFFRGBAImage *img, uint32_t *raster, uint32_t w, |
| int ret = 1, flip; |
| tmsize_t maxstripsize; |
| |
| + if ((tmsize_t)img->row_offset > TIFF_SSIZE_T_MAX || |
| + (size_t)h > (size_t)TIFF_SSIZE_T_MAX) |
| + { |
| + return (0); |
| + } |
| + |
| TIFFGetFieldDefaulted(tif, TIFFTAG_YCBCRSUBSAMPLING, &subsamplinghor, |
| &subsamplingver); |
| if (subsamplingver == 0) |
| diff --git a/third_party/libtiff/tiffconf.h b/third_party/libtiff/tiffconf.h |
| index 4c83b03f1..289f1758f 100644 |
| --- a/third_party/libtiff/tiffconf.h |
| +++ b/third_party/libtiff/tiffconf.h |
| @@ -136,10 +136,12 @@ |
| #if defined(ARCH_CPU_64_BITS) |
| #define TIFF_SSIZE_T int64_t |
| #define TIFF_SSIZE_FORMAT PRId64 |
| +#define TIFF_SSIZE_T_MAX INT64_MAX |
| #define SIZEOF_SIZE_T 8 |
| #else |
| #define TIFF_SSIZE_T int32_t |
| #define TIFF_SSIZE_FORMAT PRId32 |
| +#define TIFF_SSIZE_T_MAX INT32_MAX |
| #define SIZEOF_SIZE_T 4 |
| #endif |
| |
