commit 062bed289bd2806815203add22d134762bcfbcc3
author Serhiy Storchaka <storchaka@gmail.com> Sun May 31 09:05:10 2015 +0300
committer Serhiy Storchaka <storchaka@gmail.com> Sun May 31 09:05:10 2015 +0300
tree 0dbed218a126b54e53d41ff8534afe14f86c7a6d
parent d6bfa94493b897f45ab939208a4a54a259a530e8

Issue #24264: Fixed buffer overflow in the imageop module.

Modules/imageop.c

diff --git a/Modules/imageop.c b/Modules/imageop.c
index 8bd11b2..b91f967 100644
--- a/Modules/imageop.c
+++ b/Modules/imageop.c
@@ -50,8 +50,11 @@
         return 0;
     if ( !check_coordonnate(y, yname) )
         return 0;
-    if ( size == (product / y) / x )
-        return 1;
+    if ( product % y == 0 ) {
+        product /= y;
+        if ( product % x == 0 && size == product / x )
+            return 1;
+    }
     PyErr_SetString(ImageopError, "String has incorrect length");
     return 0;
 }