X-Git-Url: https://git.saurik.com/wxWidgets.git/blobdiff_plain/b47c832e5529dc6c632536b4665a005f0a85aec8..4c410aa14e7818b946351842fed2905239c15592:/src/tiff/tif_next.c?ds=sidebyside

diff --git a/src/tiff/tif_next.c b/src/tiff/tif_next.c
index 74593a6b5f..42d631e07f 100644
--- a/src/tiff/tif_next.c
+++ b/src/tiff/tif_next.c
@@ -34,7 +34,7 @@
 
 #define SETPIXEL(op, v) {			\
 	switch (npixels++ & 3) {		\
-	case 0:	op[0]  = (v) << 6; break;	\
+	case 0:	op[0]  = (u_char) ((v) << 6); break;	\
 	case 1:	op[0] |= (v) << 4; break;	\
 	case 2:	op[0] |= (v) << 2; break;	\
 	case 3:	*op++ |= (v);	   break;	\
@@ -87,7 +87,7 @@ NeXTDecode(TIFF* tif, tidata_t buf, tsize_t occ, tsample_t s)
 			 */
 			off = (bp[0] * 256) + bp[1];
 			n = (bp[2] * 256) + bp[3];
-			if (cc < 4+n)
+			if (cc < 4+n || off+n > scanline)
 				goto bad;
 			_TIFFmemcpy(row+off, bp+4, n);
 			bp += 4+n;
@@ -111,7 +111,7 @@ NeXTDecode(TIFF* tif, tidata_t buf, tsize_t occ, tsample_t s)
 				n &= 0x3f;
 				while (n-- > 0)
 					SETPIXEL(op, grey);
-				if (npixels >= imagewidth)
+				if (npixels >= (int) imagewidth)
 					break;
 				if (cc == 0)
 					goto bad;