Fix overflow when calculating strip height for multiple images

src/decoder/mod.rs

@@ -1468,10 +1468,18 @@ impl<R: Read + Seek> Decoder<R> {
         let sized_width = usize::try_from(self.width)?;
         let sized_height = usize::try_from(self.height)?;
 
-        // Ignore potential vertical padding on the bottommost strip
-        let strip_height = cmp::min(rows_per_strip, sized_height - index * rows_per_strip);
+        let strip_height_without_padding = index
+            .checked_mul(rows_per_strip)
+            .and_then(|x| sized_height.checked_sub(x))
+            .ok_or(TiffError::IntSizeError)?;
 
-        let buffer_size = sized_width * strip_height * self.bits_per_sample.len();
+        // Ignore potential vertical padding on the bottommost strip
+        let strip_height = rows_per_strip.min(strip_height_without_padding);
+
+        let buffer_size = sized_width
+            .checked_mul(strip_height)
+            .and_then(|x| x.checked_mul(self.bits_per_sample.len()))
+            .ok_or(TiffError::LimitsExceeded)?;
 
         if buffer.len() < buffer_size {
             return Err(TiffError::FormatError(

tests/decode_images.rs

@@ -475,3 +475,26 @@ fn invalid_jpeg_tag_2() {
         unexpected => panic!("Unexpected error {}", unexpected),
     }
 }
+
+#[test]
+fn multiple_images_strip_height() {
+    use tiff::TiffError;
+
+    let image = [
+        73, 73, 42, 0, 8, 0, 0, 0, 8, 0, 0, 1, 4, 0, 1, 0, 0, 0, 2, 0, 0, 0, 61, 1, 9, 0, 46, 22,
+        128, 0, 0, 0, 0, 1, 6, 1, 3, 0, 1, 0, 0, 0, 0, 0, 0, 0, 17, 1, 4, 0, 27, 0, 0, 0, 0, 0, 0,
+        0, 1, 1, 3, 0, 1, 0, 0, 0, 17, 1, 0, 231, 22, 1, 1, 0, 1, 0, 0, 0, 130, 0, 0, 0, 23, 1, 4,
+        0, 14, 0, 0, 0, 0, 0, 0, 0, 133, 133, 133, 77, 77, 77, 0, 0, 22, 128, 0, 255, 255, 255,
+        255, 255,
+    ];
+
+    let mut decoder = tiff::decoder::Decoder::new(std::io::Cursor::new(&image)).unwrap();
+
+    let _ = decoder.read_image().unwrap();
+    let err = decoder.read_image().unwrap_err();
+
+    match err {
+        TiffError::IntSizeError => {}
+        unexpected => panic!("Unexpected error {}", unexpected),
+    }
+}