diff options
Diffstat (limited to 'tiff')
-rw-r--r-- | tiff/tiff-document.c | 39 |
1 files changed, 37 insertions, 2 deletions
diff --git a/tiff/tiff-document.c b/tiff/tiff-document.c index 5c8cc8d..9605c16 100644 --- a/tiff/tiff-document.c +++ b/tiff/tiff-document.c @@ -167,6 +167,8 @@ tiff_document_render_pixbuf (EvDocument *document, int page, double scale) { TiffDocument *tiff_document = TIFF_DOCUMENT (document); int width, height; + gint rowstride, bytes; + guchar *pixels = NULL; GdkPixbuf *pixbuf; GdkPixbuf *scaled_pixbuf; @@ -180,8 +182,41 @@ tiff_document_render_pixbuf (EvDocument *document, int page, double scale) return NULL; } - TIFFGetField (tiff_document->tiff, TIFFTAG_IMAGEWIDTH, &width); - TIFFGetField (tiff_document->tiff, TIFFTAG_IMAGELENGTH, &height); + if (!TIFFGetField (tiff_document->tiff, TIFFTAG_IMAGEWIDTH, &width)) + { + pop_handlers (); + return NULL; + } + + if (! TIFFGetField (tiff_document->tiff, TIFFTAG_IMAGELENGTH, &height)) + { + pop_handlers (); + return NULL; + } + + pop_handlers (); + + /* Sanity check the doc */ + if (width <= 0 || height <= 0) + return NULL; + + rowstride = width * 4; + if (rowstride / 4 != width) + /* overflow */ + return NULL; + + bytes = height * rowstride; + if (bytes / rowstride != height) + /* overflow */ + return NULL; + + pixels = g_try_malloc (bytes); + if (!pixels) + return NULL; + + pixbuf = gdk_pixbuf_new_from_data (pixels, GDK_COLORSPACE_RGB, TRUE, 8, + width, height, rowstride, + (GdkPixbufDestroyNotify) g_free, NULL); pixbuf = gdk_pixbuf_new (GDK_COLORSPACE_RGB, TRUE, 8, width, height); TIFFReadRGBAImageOriented (tiff_document->tiff, width, height, (uint32 *)gdk_pixbuf_get_pixels (pixbuf), ORIENTATION_TOPLEFT, 1); |