diff --git a/src/preview.c b/src/preview.c index a343d57..a7749d6 100644 --- a/src/preview.c +++ b/src/preview.c @@ -1159,11 +1159,28 @@ restore_preview_image (Preview * p) p->image_height = height; if ((width == 0) || (height == 0)) return; - p->image_data = malloc (3 * width * height); - p->preview_data = malloc (3 * width * height); + + int data_size = 3 * width * height; + + // Overflow check. + if ((data_size / width) / height != 3) + { + // overflow occurred. Ignore the image. The dimensions are probably corrupted. + return; + } + + p->image_data = malloc (data_size); if (!p->image_data) return; + p->preview_data = malloc (data_size); + if (!p->preview_data) + { + free(p->image_data); + p->image_data = NULL; + return; + } + nread = fread (p->image_data, 3, width * height, in); p->image_y = nread / width;