DICOM @ OFFIS

Index: djcodecd.cc
===================================================================
--- djcodecd.cc   (revision 5186)
+++ djcodecd.cc   (working copy)
@@ -152,21 +152,26 @@
               {
                 Uint32 frameSize = ((precision > 8) ? sizeof(Uint16) : sizeof(Uint8)) * imageRows * imageColumns * imageSamplesPerPixel;
                 Uint32 totalSize = frameSize * imageFrames;
+                if (totalSize/frameSize != imageFrames)  // check for integer overflow
+                  result = EC_MemoryExhausted;
                 if (totalSize & 1) totalSize++; // align on 16-bit word boundary
                 Uint16 *imageData16 = NULL;
                 Sint32 currentFrame = 0;
                 Uint32 currentItem = 1; // ignore offset table
 
-                if (isYBR && (imageBitsStored < imageBitsAllocated)) // check for a special case that is currently not handled properly
+                if (result.good())
                 {
-                  if (djcp->getDecompressionColorSpaceConversion() != EDC_never)
+                  if (isYBR && (imageBitsStored < imageBitsAllocated)) // check for a special case that is currently not handled properly
                   {
-                    DCMJPEG_WARN("BitsStored < BitsAllocated for JPEG compressed image with YCbCr color model, color space conversion will probably not work properly");
-                    DCMJPEG_DEBUG("workaround: use option --conv-never (for command line tools) or EDC_never (for the DJDecoderRegistration::registerCodecs() call)");
+                    if (djcp->getDecompressionColorSpaceConversion() != EDC_never)
+                    {
+                      DCMJPEG_WARN("BitsStored < BitsAllocated for JPEG compressed image with YCbCr color model, color space conversion will probably not work properly");
+                      DCMJPEG_DEBUG("workaround: use option --conv-never (for command line tools) or EDC_never (for the DJDecoderRegistration::registerCodecs() call)");
+                    }
                   }
+
+                  result = uncompressedPixelData.createUint16Array(totalSize / sizeof(Uint16), imageData16);
                 }
-
-                result = uncompressedPixelData.createUint16Array(totalSize / sizeof(Uint16), imageData16);
                 if (result.good())
                 {
                   Uint8 *imageData8 = (Uint8 *)imageData16;