commit ed4d9f3d0834b0c02541e748b1aebab4773a1ab6
Author: Nils Philippsen <nils@redhat.com>
Date:   Fri Dec 4 11:51:27 2009 +0100

    PAT: sanitize input data
    
    Guard against bogus zero width and allocation overflows.

diff --git a/plug-ins/common/file-pat.c b/plug-ins/common/file-pat.c
index f6d5e1e..9a8ce2b 100644
--- a/plug-ins/common/file-pat.c
+++ b/plug-ins/common/file-pat.c
@@ -401,6 +401,17 @@ load_image (const gchar  *filename,
       return -1;
     }
 
+  /* Sanitize input width and guard against overflows. */
+  if ((ph.width == 0) || (G_MAXSIZE / ph.width / ph.bytes < 1))
+    {
+      g_set_error (error, G_FILE_ERROR, G_FILE_ERROR_FAILED,
+                   _("Invalid header data in '%s': width=%lu, height=%lu, "
+                     "bytes=%lu"), gimp_filename_to_utf8 (filename),
+                   (unsigned long int)ph.width, (unsigned long int)ph.height,
+                   (unsigned long int)ph.bytes);
+      return -1;
+    }
+
   image_ID = gimp_image_new (ph.width, ph.height, base_type);
   gimp_image_set_filename (image_ID, filename);
 
@@ -419,7 +430,7 @@ load_image (const gchar  *filename,
                        0, 0, drawable->width, drawable->height,
                        TRUE, FALSE);
 
-  buffer = g_malloc (ph.width * ph.bytes);
+  buffer = g_malloc (((gsize)ph.width) * ph.bytes);
 
   for (line = 0; line < ph.height; line++)
     {
@@ -489,7 +500,7 @@ save_image (const gchar  *filename,
       return FALSE;
     }
 
-  buffer = g_malloc (drawable->width * drawable->bpp);
+  buffer = g_malloc (((gsize)drawable->width) * drawable->bpp);
   if (buffer == NULL)
     {
       close (fd);
