Lucio Andrés Illanes Albornoz daac7c
Based on http://bugzilla.maptools.org/show_bug.cgi?id=2750#c5
Lucio Andrés Illanes Albornoz daac7c
Lucio Andrés Illanes Albornoz daac7c
diff --git a/tools/pal2rgb.c b/tools/pal2rgb.c
Lucio Andrés Illanes Albornoz daac7c
index 7a57800..8443fce 100644
Lucio Andrés Illanes Albornoz daac7c
--- a/tools/pal2rgb.c
Lucio Andrés Illanes Albornoz daac7c
+++ b/tools/pal2rgb.c
Lucio Andrés Illanes Albornoz daac7c
@@ -184,8 +184,19 @@ main(int argc, char* argv[])
Lucio Andrés Illanes Albornoz daac7c
 	{ unsigned char *ibuf, *obuf;
Lucio Andrés Illanes Albornoz daac7c
 	  register unsigned char* pp;
Lucio Andrés Illanes Albornoz daac7c
 	  register uint32 x;
Lucio Andrés Illanes Albornoz daac7c
-	  ibuf = (unsigned char*)_TIFFmalloc(TIFFScanlineSize(in));
Lucio Andrés Illanes Albornoz daac7c
-	  obuf = (unsigned char*)_TIFFmalloc(TIFFScanlineSize(out));
Lucio Andrés Illanes Albornoz daac7c
+	  tmsize_t tss_in = TIFFScanlineSize(in);
Lucio Andrés Illanes Albornoz daac7c
+	  tmsize_t tss_out = TIFFScanlineSize(out);
Lucio Andrés Illanes Albornoz daac7c
+	  if (tss_out / tss_in < 3) {
Lucio Andrés Illanes Albornoz daac7c
+		/*
Lucio Andrés Illanes Albornoz daac7c
+		 * BUG 2750: The following code assumes the output buffer is 3x the
Lucio Andrés Illanes Albornoz daac7c
+		 * length of the input buffer due to exploding the palette into
Lucio Andrés Illanes Albornoz daac7c
+		 * RGB tuples. If this doesn't happen, fail now.
Lucio Andrés Illanes Albornoz daac7c
+		*/
Lucio Andrés Illanes Albornoz daac7c
+		fprintf(stderr, "Could not determine correct image size for output. Exiting.\n");
Lucio Andrés Illanes Albornoz daac7c
+		return -1;
Lucio Andrés Illanes Albornoz daac7c
+	  }
Lucio Andrés Illanes Albornoz daac7c
+	  ibuf = (unsigned char*)_TIFFmalloc(tss_in);
Lucio Andrés Illanes Albornoz daac7c
+	  obuf = (unsigned char*)_TIFFmalloc(tss_out);
Lucio Andrés Illanes Albornoz daac7c
 	  switch (config) {
Lucio Andrés Illanes Albornoz daac7c
 	  case PLANARCONFIG_CONTIG:
Lucio Andrés Illanes Albornoz daac7c
 		for (row = 0; row < imagelength; row++) {