Throw exception on integer overflow in dng_ifd.cpp. Bug: 36724453 Test: manual, see b/36724453 Change-Id: I6115361002d3e4167ff7ff654e1fd2176ac24e87 (cherry picked from commit 2cb858a7ed887b231086ae81e2b35a3614299da3) (cherry picked from commit 1cc3bdb6e11a9a6ce4629d77960a895cfb055200)
diff --git a/source/dng_ifd.cpp b/source/dng_ifd.cpp index 317ebf9..7f22065 100644 --- a/source/dng_ifd.cpp +++ b/source/dng_ifd.cpp
@@ -3979,7 +3979,7 @@ if (fTileWidth) { - return (fImageWidth + fTileWidth - 1) / fTileWidth; + return (SafeUint32Sub(SafeUint32Add(fImageWidth, fTileWidth), 1)) / fTileWidth; } @@ -3995,7 +3995,7 @@ if (fTileLength) { - return (fImageLength + fTileLength - 1) / fTileLength; + return (SafeUint32Sub(SafeUint32Add(fImageLength, fTileLength), 1)) / fTileLength; }