commit 33e1e3ebfffd8d39efecb931480ee6146c7c1529
author Yujie Qin <yujieqin@google.com> Mon May 08 10:14:37 2017 +0200
committer JP Sugarbroad <jpsugar@google.com> Fri May 19 00:25:00 2017 -0700
tree d49fb775bdf32dcb66fe70a228c476446d4fbe31
parent 0420a20d94d620f471e47cf3f8c40facca5de58e

Throw exception on integer overflow in dng_ifd.cpp.

Bug: 36724453
Test: manual, see b/36724453
Change-Id: I6115361002d3e4167ff7ff654e1fd2176ac24e87
(cherry picked from commit 2cb858a7ed887b231086ae81e2b35a3614299da3)
(cherry picked from commit 5e702072c8012638e4356eb2e62f5f8f910bd01d)

source/dng_ifd.cpp

diff --git a/source/dng_ifd.cpp b/source/dng_ifd.cpp
index 317ebf9..7f22065 100644
--- a/source/dng_ifd.cpp
+++ b/source/dng_ifd.cpp
@@ -3979,7 +3979,7 @@
 	if (fTileWidth)
 		{
 
-		return (fImageWidth + fTileWidth - 1) / fTileWidth;
+		return (SafeUint32Sub(SafeUint32Add(fImageWidth, fTileWidth), 1)) / fTileWidth;
 		
 		}
 		
@@ -3995,7 +3995,7 @@
 	if (fTileLength)
 		{
 
-		return (fImageLength + fTileLength - 1) / fTileLength;
+		return (SafeUint32Sub(SafeUint32Add(fImageLength, fTileLength), 1)) / fTileLength;
 		
 		}