From d9d84198031a28924b953391c148c1c207fd7894 Mon Sep 17 00:00:00 2001 From: Harald Kuhr Date: Tue, 14 Jan 2020 21:17:59 +0100 Subject: [PATCH] #514: Fix integer overflow in stripbytecounts computation. --- .../twelvemonkeys/imageio/plugins/tiff/TIFFImageWriter.java | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/imageio/imageio-tiff/src/main/java/com/twelvemonkeys/imageio/plugins/tiff/TIFFImageWriter.java b/imageio/imageio-tiff/src/main/java/com/twelvemonkeys/imageio/plugins/tiff/TIFFImageWriter.java index d5f71b39..594db004 100644 --- a/imageio/imageio-tiff/src/main/java/com/twelvemonkeys/imageio/plugins/tiff/TIFFImageWriter.java +++ b/imageio/imageio-tiff/src/main/java/com/twelvemonkeys/imageio/plugins/tiff/TIFFImageWriter.java @@ -314,8 +314,8 @@ public final class TIFFImageWriter extends ImageWriterBase { long streamPosition = imageOutput.getStreamPosition(); long ifdSize = tiffWriter.computeIFDSize(entries.values()); - long stripOffset = streamPosition + 4 + ifdSize + 4; - long stripByteCount = (renderedImage.getWidth() * renderedImage.getHeight() * pixelSize + 7) / 8; + long stripOffset = streamPosition + 4 + ifdSize + 4; + long stripByteCount = ((long) renderedImage.getWidth() * renderedImage.getHeight() * pixelSize + 7L) / 8L; entries.put(TIFF.TAG_STRIP_OFFSETS, new TIFFEntry(TIFF.TAG_STRIP_OFFSETS, TIFF.TYPE_LONG, stripOffset)); entries.put(TIFF.TAG_STRIP_BYTE_COUNTS, new TIFFEntry(TIFF.TAG_STRIP_BYTE_COUNTS, TIFF.TYPE_LONG, stripByteCount));