| diff --git a/third_party/lcms/src/cmscgats.c b/third_party/lcms/src/cmscgats.c |
| index 55f74ede8..0738a1cce 100644 |
| --- a/third_party/lcms/src/cmscgats.c |
| +++ b/third_party/lcms/src/cmscgats.c |
| @@ -1504,10 +1504,16 @@ void AllocateDataSet(cmsIT8* it8) |
| t-> nSamples = atoi(cmsIT8GetProperty(it8, "NUMBER_OF_FIELDS")); |
| t-> nPatches = atoi(cmsIT8GetProperty(it8, "NUMBER_OF_SETS")); |
| |
| - t-> Data = (char**)AllocChunk (it8, ((cmsUInt32Number) t->nSamples + 1) * ((cmsUInt32Number) t->nPatches + 1) *sizeof (char*)); |
| - if (t->Data == NULL) { |
| + if (t -> nSamples < 0 || t->nSamples > 0x7ffe || t->nPatches < 0 || t->nPatches > 0x7ffe) |
| + { |
| + SynError(it8, "AllocateDataSet: too much data"); |
| + } |
| + else { |
| + t->Data = (char**)AllocChunk(it8, ((cmsUInt32Number)t->nSamples + 1) * ((cmsUInt32Number)t->nPatches + 1) * sizeof(char*)); |
| + if (t->Data == NULL) { |
| |
| - SynError(it8, "AllocateDataSet: Unable to allocate data array"); |
| + SynError(it8, "AllocateDataSet: Unable to allocate data array"); |
| + } |
| } |
| |
| } |