diff --git a/src/share/native/sun/java2d/cmm/lcms/cmscgats.c b/src/share/native/sun/java2d/cmm/lcms/cmscgats.c index ff88ffb13672cad7775372d181cfae379a93f1ad..981736a3f188874438bf86101b65798ac4d19ce8 100644 --- a/src/share/native/sun/java2d/cmm/lcms/cmscgats.c +++ b/src/share/native/sun/java2d/cmm/lcms/cmscgats.c @@ -1535,10 +1535,16 @@ void AllocateDataSet(cmsIT8* it8) t-> nSamples = atoi(cmsIT8GetProperty(it8, "NUMBER_OF_FIELDS")); t-> nPatches = atoi(cmsIT8GetProperty(it8, "NUMBER_OF_SETS")); - t-> Data = (char**)AllocChunk (it8, ((cmsUInt32Number) t->nSamples + 1) * ((cmsUInt32Number) t->nPatches + 1) *sizeof (char*)); - if (t->Data == NULL) { + if (t -> nSamples < 0 || t->nSamples > 0x7ffe || t->nPatches < 0 || t->nPatches > 0x7ffe) + { + SynError(it8, "AllocateDataSet: too much data"); + } + else { + t->Data = (char**)AllocChunk(it8, ((cmsUInt32Number)t->nSamples + 1) * ((cmsUInt32Number)t->nPatches + 1) * sizeof(char*)); + if (t->Data == NULL) { - SynError(it8, "AllocateDataSet: Unable to allocate data array"); + SynError(it8, "AllocateDataSet: Unable to allocate data array"); + } } }