Use CImg::safe_size to prevent integer overflow in get_load_jpeg_buffer

GreycLab · Jul 2, 2024 · 53c020f · 53c020f
1 parent 40d7904
commit 53c020f
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/plugins/jpeg_buffer.h b/plugins/jpeg_buffer.h
@@ -234,7 +234,8 @@ static CImg get_load_jpeg_buffer(const JOCTET *const buffer, const unsigned buff
   jpeg_start_decompress(&cinfo);
 
   const unsigned int row_stride = cinfo.output_width * cinfo.output_components;
-  JOCTET *buf = new JOCTET[cinfo.output_width*cinfo.output_height*cinfo.output_components];
+  const size_t siz = safe_size(cinfo.output_width,cinfo.output_height,1,cinfo.output_components);
+  JOCTET *buf = new JOCTET[siz];
   const JOCTET *buf2 = buf;
   JSAMPROW row_pointer[1];
   while (cinfo.output_scanline < cinfo.output_height) {