Don't abort if the SampleFunction has too many samples

Fixes issue #634

1 files changed, 5 insertions, 1 deletions

diff --git a/poppler/Function.cc b/poppler/Function.cc
index cc32414b..6918fbcd 100644
--- a/poppler/Function.cc
+++ b/poppler/Function.cc
@@ -362,7 +362,11 @@ SampledFunction::SampledFunction(Object *funcObj, Dict *dict) {
   nSamples = n;
   for (i = 0; i < m; ++i)
     nSamples *= sampleSize[i];
-  samples = (double *)gmallocn(nSamples, sizeof(double));
+  samples = (double *)gmallocn_checkoverflow(nSamples, sizeof(double));
+  if (!samples) {
+    error(errSyntaxError, -1, "Function has invalid number of samples");
+    return;
+  }
   buf = 0;
   bits = 0;
   bitMask = (1 << sampleBits) - 1;