From c8f268ef1b8d7a37212ce6e62c0dd23e2f37eb47 Mon Sep 17 00:00:00 2001
From: Even Rouault <even.rouault@spatialys.com>
Date: Thu, 22 Aug 2019 10:19:44 +0200
Subject: EstimateStripByteCounts(): avoid unsigned integer overflow

---
 libtiff/tif_dirread.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/libtiff/tif_dirread.c b/libtiff/tif_dirread.c
index 7756e107..87bc030e 100644
--- a/libtiff/tif_dirread.c
+++ b/libtiff/tif_dirread.c
@@ -4549,6 +4549,8 @@ EstimateStripByteCounts(TIFF* tif, TIFFDirEntry* dir, uint16 dircount)
 				    dp->tdir_type);
 				return -1;
 			}
+			if( dp->tdir_count > TIFF_UINT64_MAX / typewidth )
+                            return -1;
 			datasize=(uint64)typewidth*dp->tdir_count;
 			if (!(tif->tif_flags&TIFF_BIGTIFF))
 			{
-- 
cgit v1.2.1