Blob Blame History Raw
diff -rupN --no-dereference freeimage-svn-r1909-FreeImage-trunk/Source/FreeImage/PluginJPEG.cpp freeimage-svn-r1909-FreeImage-trunk-new/Source/FreeImage/PluginJPEG.cpp
--- freeimage-svn-r1909-FreeImage-trunk/Source/FreeImage/PluginJPEG.cpp	2024-03-10 14:22:17.818579271 +0100
+++ freeimage-svn-r1909-FreeImage-trunk-new/Source/FreeImage/PluginJPEG.cpp	2024-03-10 14:22:18.776573816 +0100
@@ -1086,6 +1086,10 @@ Load(FreeImageIO *io, fi_handle handle,
 
 			jpeg_read_header(&cinfo, TRUE);
 
+			if (cinfo.image_width > JPEG_MAX_DIMENSION || cinfo.image_height > JPEG_MAX_DIMENSION) {
+				throw FI_MSG_ERROR_DIB_MEMORY;
+			}
+
 			// step 4: set parameters for decompression
 
 			unsigned int scale_denom = 1;		// fraction by which to scale image