From 5e86931dff30f7f92ee4e002cf08adc292065d9d Mon Sep 17 00:00:00 2001
From: Birk Tjelmeland <birktjelmeland@yahoo.no>
Date: Tue, 12 Mar 2019 11:07:57 +0100
Subject: [PATCH] Fix possibly overflowing multiplications

---
 src/decoder/ifd.rs | 11 ++++-------
 src/decoder/mod.rs | 12 ++++++------
 2 files changed, 10 insertions(+), 13 deletions(-)

diff --git a/src/decoder/ifd.rs b/src/decoder/ifd.rs
index 3f0ff69..15db66b 100644
--- a/src/decoder/ifd.rs
+++ b/src/decoder/ifd.rs
@@ -170,8 +170,7 @@ impl Entry {
                 ]))
             },
             (Type::SHORT, n) => {
-                // each value is ~8 bytes
-                if u64::from(n)*8 > limits.decoding_buffer_size {
+                if n as usize > limits.decoding_buffer_size / std::mem::size_of::<Value>() {
                     return Err(TiffError::LimitsExceeded)
                 }
                 let mut v = Vec::with_capacity(n as usize);
@@ -183,8 +182,7 @@ impl Entry {
             },
             (Type::LONG, 1) => Ok(Unsigned(try!(self.r(bo).read_u32()))),
             (Type::LONG, n) => {
-                // each value is ~8 bytes
-                if u64::from(n)*8 > limits.decoding_buffer_size {
+                if n as usize > limits.decoding_buffer_size / std::mem::size_of::<Value>() {
                     return Err(TiffError::LimitsExceeded)
                 }
                 let mut v = Vec::with_capacity(n as usize);
@@ -201,8 +199,7 @@ impl Entry {
                 Ok(Rational(numerator, denominator))
             },
             (Type::RATIONAL, n) => {
-                // each value is ~8 bytes
-                if u64::from(n)*8 > limits.decoding_buffer_size {
+                if n as usize > limits.decoding_buffer_size / std::mem::size_of::<Value>() {
                     return Err(TiffError::LimitsExceeded)
                 }
                 let mut v = Vec::with_capacity(n as usize);
@@ -215,7 +212,7 @@ impl Entry {
                 Ok(List(v))
             },
             (Type::ASCII, n) => {
-                if u64::from(n) > limits.decoding_buffer_size {
+                if n as usize > limits.decoding_buffer_size {
                     return Err(TiffError::LimitsExceeded)
                 }
                 try!(decoder.goto_offset(try!(self.r(bo).read_u32())));
diff --git a/src/decoder/mod.rs b/src/decoder/mod.rs
index b58649f..5e070f1 100644
--- a/src/decoder/mod.rs
+++ b/src/decoder/mod.rs
@@ -28,7 +28,7 @@ pub enum DecodingResult {
 
 impl DecodingResult {
     fn new_u8(size: usize, limits: &Limits) -> TiffResult<DecodingResult> {
-        if size as u64 > limits.decoding_buffer_size {
+        if size > limits.decoding_buffer_size {
             Err(TiffError::LimitsExceeded)
         }
         else {
@@ -37,7 +37,7 @@ impl DecodingResult {
     }
 
     fn new_u16(size: usize, limits: &Limits) -> TiffResult<DecodingResult> {
-        if size as u64*2 > limits.decoding_buffer_size {
+        if size > limits.decoding_buffer_size / 2 {
             Err(TiffError::LimitsExceeded)
         }
         else {
@@ -133,10 +133,10 @@ pub struct Limits {
     /// 256MiB. If the entire image is decoded at once, then this will
     /// be the maximum size of the image. If it is decoded one strip at a
     /// time, this will be the maximum size of a strip.
-    decoding_buffer_size: u64,
+    decoding_buffer_size: usize,
     /// The maximum size of any ifd value in bytes, the default is 
     /// 1MiB.
-    ifd_value_size: u64,
+    ifd_value_size: usize,
 }
 
 impl Default for Limits {
@@ -493,7 +493,7 @@ impl<R: Read + Seek> Decoder<R> {
             method => return Err(TiffError::UnsupportedError(TiffUnsupportedError::UnsupportedCompressionMethod(method)))
         };
         
-        if bytes > max_uncompressed_length*buffer.byte_len() {
+        if bytes / buffer.byte_len() > max_uncompressed_length {
             return Err(TiffError::FormatError(TiffFormatError::InconsistentSizesEncountered));
         }
 
@@ -569,7 +569,7 @@ impl<R: Read + Seek> Decoder<R> {
 
         let buffer_size = self.width as usize * strip_height * self.bits_per_sample.len();
 
-        if buffer.len() < buffer_size || byte_count as usize > buffer_size*buffer.byte_len() {
+        if buffer.len() < buffer_size || byte_count as usize / buffer.byte_len() > buffer_size {
             return Err(TiffError::FormatError(TiffFormatError::InconsistentSizesEncountered));
         }