[gimp/gimp-2-6] file-gif-load: fix type overflow (CVE-2012-3481)

[Nils Philippsen <nphilipp src gnome org>]

commit 372ba14850c12fe9c618fceeb5af9404ee8fbdf7
Author: Nils Philippsen <nils redhat com>
Date:   Tue Aug 14 15:27:39 2012 +0200

    file-gif-load: fix type overflow (CVE-2012-3481)
    
    Cast variables properly to avoid overflowing when computing how much
    memory to allocate.
    (cherry picked from commit 43fc9dbd8e2196944c8a71321e525b89b7df9f5c)

 plug-ins/common/file-gif-load.c |    4 ++--
 1 files changed, 2 insertions(+), 2 deletions(-)
---
diff --git a/plug-ins/common/file-gif-load.c b/plug-ins/common/file-gif-load.c
index 67db933..295c351 100644
--- a/plug-ins/common/file-gif-load.c
+++ b/plug-ins/common/file-gif-load.c
@@ -1036,9 +1036,9 @@ ReadImage (FILE        *fd,
   }
 
   if (alpha_frame)
-    dest = (guchar *) g_malloc (len * height * (promote_to_rgb ? 4 : 2));
+    dest = (guchar *) g_malloc ((gsize)len * (gsize)height * (promote_to_rgb ? 4 : 2));
   else
-    dest = (guchar *) g_malloc (len * height);
+    dest = (guchar *) g_malloc ((gsize)len * (gsize)height);
 
 #ifdef GIFDEBUG
     g_print ("GIF: reading %d by %d%s GIF image, ncols=%d\n",