|
@@ -68,8 +68,10 @@ struct pixel_buffer * alloc_pixbuf ( unsigned int width, unsigned int height ) {
|
68
|
68
|
pixbuf->len = ( width * height * sizeof ( uint32_t ) );
|
69
|
69
|
|
70
|
70
|
/* Check for multiplication overflow */
|
71
|
|
- if ( ( ( pixbuf->len / sizeof ( uint32_t ) ) / width ) != height )
|
|
71
|
+ if ( ( width != 0 ) &&
|
|
72
|
+ ( ( pixbuf->len / sizeof ( uint32_t ) ) / width ) != height ) {
|
72
|
73
|
goto err_overflow;
|
|
74
|
+ }
|
73
|
75
|
|
74
|
76
|
/* Allocate pixel data buffer */
|
75
|
77
|
pixbuf->data = umalloc ( pixbuf->len );
|