commit 93f6f78246b4aec0c0bfc3029074e65684d9b1b2
Author: Nils Philippsen <nils@redhat.com>
Date:   Mon Nov 16 12:06:46 2009 +0100

    Make type overflow checks more defensive.
    
    Use divisions instead of multiplications for checking against type
    boundaries as they cannot overflow. Avoid dividing by zero.

diff --git a/plug-ins/file-psd/psd-load.c b/plug-ins/file-psd/psd-load.c
index 197da4a..83c1090 100644
--- a/plug-ins/file-psd/psd-load.c
+++ b/plug-ins/file-psd/psd-load.c
@@ -303,7 +303,8 @@ read_header_block (PSDimage  *img_a,
       return -1;
     }
 
-  if (((guint64) img_a->columns) * img_a->rows > G_MAXINT32)
+  /* img_a->rows is sanitized above, so a division by zero is avoided here */
+  if (img_a->columns > G_MAXINT32 / img_a->rows)
     {
       g_set_error (error, G_FILE_ERROR, G_FILE_ERROR_FAILED,
                    _("Unsupported or invalid image size: %dx%d"),
@@ -1809,8 +1810,9 @@ read_channel_data (PSDchannel     *channel,
   IFDBG(3) g_debug ("raw data size %d x %d = %d", readline_len,
                     channel->rows, readline_len * channel->rows);
 
-  /* int overflow check */
-  if (((gint64) channel->rows) * channel->columns * MAX (bps >> 3, 1) > G_MAXINT32)
+  /* int overflow check, avoid divisions by zero */
+  if ((channel->columns == 0) ||
+      (channel->rows > G_MAXINT32 / channel->columns / MAX (bps >> 3, 1)))
     {
       g_set_error (error, G_FILE_ERROR, G_FILE_ERROR_FAILED,
                    _("Unsupported or invalid channel size"));
