--- IlmImf/ImfPxr24Compressor.cpp 2006-08-08 17:22:39.000000000 -0700

+++ IlmImf/ImfPxr24Compressor.cpp 2011-02-15 10:02:21.249206726 -0800

@@ -73,6 +73,7 @@

#include <zlib.h>

#include <assert.h>

#include <algorithm>

+#include <climits>

using namespace std;

using namespace Imath;

@@ -187,6 +188,9 @@

{

int maxInBytes = maxScanLineSize * numScanLines;

+ if (static_cast<unsigned int>(maxScanLineSize) > static_cast<unsigned int>(INT_MAX) / static_cast<unsigned int>(numScanLines))

+ throw Iex::InputExc ("Error: maxScanLineSize * numScanLines overflow!");

+

_tmpBuffer = new unsigned char [maxInBytes];

_outBuffer = new char [int (ceil (maxInBytes * 1.01)) + 100];

--- IlmImf/ImfRleCompressor.cpp 2006-10-13 20:06:39.000000000 -0700

+++ IlmImf/ImfRleCompressor.cpp 2011-02-15 10:04:37.515213450 -0800

@@ -42,6 +42,7 @@

#include <ImfRleCompressor.h>

#include "Iex.h"

+#include <climits>

namespace Imf {

namespace {

@@ -164,6 +165,9 @@

_tmpBuffer (0),

_outBuffer (0)

{

+ if (static_cast<unsigned int>(maxScanLineSize) > static_cast<unsigned int>(INT_MAX / 3))

+ throw Iex::InputExc ("Error: maxScanLineSize * 3 overflow!");

+

_tmpBuffer = new char [maxScanLineSize];

_outBuffer = new char [maxScanLineSize * 3 / 2];

}

--- IlmImf/ImfZipCompressor.cpp 2006-10-13 20:07:17.000000000 -0700

+++ IlmImf/ImfZipCompressor.cpp 2011-02-15 10:06:55.097529328 -0800

@@ -43,6 +43,7 @@

#include <ImfZipCompressor.h>

#include "Iex.h"

#include <zlib.h>

+#include <climits>

namespace Imf {

@@ -58,6 +59,9 @@

_tmpBuffer (0),

_outBuffer (0)

{

+ if (static_cast<unsigned int>(maxScanLineSize) > static_cast<unsigned int>(INT_MAX) / static_cast<unsigned int>(numScanLines))

+ throw Iex::InputExc ("Error: maxScanLineSize * numScanLines overflow!");

+

_tmpBuffer =

new char [maxScanLineSize * numScanLines];

--- IlmImf/ImfPreviewImage.cpp 2006-06-05 22:58:16.000000000 -0700

+++ IlmImf/ImfPreviewImage.cpp 2011-02-15 10:10:00.946063574 -0800

@@ -41,6 +41,7 @@

#include <ImfPreviewImage.h>

#include "Iex.h"

+#include <climits>

namespace Imf {

@@ -51,6 +52,10 @@

{

_width = width;

_height = height;

+

+ if ((_height && (_width > (UINT_MAX / _height))) || ((_width * _height) > (UINT_MAX / sizeof(PreviewRgba))))

+ throw Iex::ArgExc ("Error: Invalid height and/or width!");

+

_pixels = new PreviewRgba [_width * _height];

if (pixels)

--- IlmImf/ImfPizCompressor.cpp 2007-09-20 21:17:46.000000000 -0700

+++ IlmImf/ImfPizCompressor.cpp 2011-02-15 10:10:24.179648473 -0800

@@ -53,6 +53,7 @@

#include <ImfAutoArray.h>

#include <string.h>

#include <assert.h>

+#include <climits>

namespace Imf {

@@ -181,6 +182,9 @@

_channels (hdr.channels()),

_channelData (0)

{

+ if (static_cast<unsigned int>(maxScanLineSize) > static_cast<unsigned int>(INT_MAX - 65536 - 8192) / static_cast<unsigned int>(numScanLines))

+ throw InputExc ("Error: maxScanLineSize * numScanLines overflow!");

+

_tmpBuffer = new unsigned short [maxScanLineSize * numScanLines / 2];

_outBuffer = new char [maxScanLineSize * numScanLines + 65536 + 8192];