# HG changeset patch
# User bae
# Date 1297934509 -10800
# Node ID add64ce324a8e9d75449ea4f75ddeefb6d5e22c7
# Parent  0f553990ca9357da9cde0eb727833f8ebd1aad42
7013519: [parfait] Integer overflows in 2D code
Reviewed-by: prr, valeriep

diff -r 0f553990ca93 -r add64ce324a8 jdk/src/share/native/sun/awt/image/jpeg/imageioJPEG.c
--- a/jdk/src/share/native/sun/awt/image/jpeg/imageioJPEG.c	Wed Feb 09 11:50:29 2011 +0800
+++ b/jdk/src/share/native/sun/awt/image/jpeg/imageioJPEG.c	Thu Feb 17 12:21:49 2011 +0300
@@ -1971,6 +1971,13 @@
         return data->abortFlag;
     }
 
+    if (cinfo->output_components <= 0 ||
+        cinfo->image_width > (0xffffffffu / (unsigned int)cinfo->output_components))
+    {
+        JNU_ThrowByName(env, "javax/imageio/IIOException",
+                        "Invalid number of output components");
+        return data->abortFlag;
+    }
 
     // Allocate a 1-scanline buffer
     scanLinePtr = (JSAMPROW)malloc(cinfo->image_width*cinfo->output_components);
diff -r 0f553990ca93 -r add64ce324a8 jdk/src/share/native/sun/font/layout/SunLayoutEngine.cpp
--- a/jdk/src/share/native/sun/font/layout/SunLayoutEngine.cpp	Wed Feb 09 11:50:29 2011 +0800
+++ b/jdk/src/share/native/sun/font/layout/SunLayoutEngine.cpp	Thu Feb 17 12:21:49 2011 +0300
@@ -186,7 +186,11 @@
   jchar buffer[256];
   jchar* chars = buffer;
   if (len > 256) {
-    chars = (jchar*)malloc(len * sizeof(jchar));
+    size_t size = len * sizeof(jchar);
+    if (size / sizeof(jchar) != len) {
+      return;
+    }
+    chars = (jchar*)malloc(size);
     if (chars == 0) {
       return;
     }