--- IlmImf/ImfPxr24Compressor.cpp	2006-08-08 17:22:39.000000000 -0700

+++ IlmImf/ImfPxr24Compressor.cpp	2011-02-15 10:02:21.249206726 -0800

@@ -73,6 +73,7 @@

 #include <zlib.h>

 #include <assert.h>

 #include <algorithm>

+#include <climits>

 using namespace std;

 using namespace Imath;

@@ -187,6 +188,9 @@

 {

     int maxInBytes = maxScanLineSize * numScanLines;

+    if (static_cast<unsigned int>(maxScanLineSize) > static_cast<unsigned int>(INT_MAX) / static_cast<unsigned int>(numScanLines))

+	throw Iex::InputExc ("Error: maxScanLineSize * numScanLines overflow!");

+

     _tmpBuffer = new unsigned char [maxInBytes];

     _outBuffer = new char [int (ceil (maxInBytes * 1.01)) + 100];

--- IlmImf/ImfRleCompressor.cpp	2006-10-13 20:06:39.000000000 -0700

+++ IlmImf/ImfRleCompressor.cpp	2011-02-15 10:04:37.515213450 -0800

@@ -42,6 +42,7 @@

 #include <ImfRleCompressor.h>

 #include "Iex.h"

+#include <climits>

 namespace Imf {

 namespace {

@@ -164,6 +165,9 @@

     _tmpBuffer (0),

     _outBuffer (0)

 {

+    if (static_cast<unsigned int>(maxScanLineSize) > static_cast<unsigned int>(INT_MAX / 3))

+	throw Iex::InputExc ("Error: maxScanLineSize * 3 overflow!");

+

     _tmpBuffer = new char [maxScanLineSize];

     _outBuffer = new char [maxScanLineSize * 3 / 2];

 }

--- IlmImf/ImfZipCompressor.cpp	2006-10-13 20:07:17.000000000 -0700

+++ IlmImf/ImfZipCompressor.cpp	2011-02-15 10:06:55.097529328 -0800

@@ -43,6 +43,7 @@

 #include <ImfZipCompressor.h>

 #include "Iex.h"

 #include <zlib.h>

+#include <climits>

 namespace Imf {

@@ -58,6 +59,9 @@

     _tmpBuffer (0),

     _outBuffer (0)

 {

+    if (static_cast<unsigned int>(maxScanLineSize) > static_cast<unsigned int>(INT_MAX) / static_cast<unsigned int>(numScanLines))

+	throw Iex::InputExc ("Error: maxScanLineSize * numScanLines overflow!");

+

     _tmpBuffer =

 	new char [maxScanLineSize * numScanLines];

--- IlmImf/ImfPreviewImage.cpp	2006-06-05 22:58:16.000000000 -0700

+++ IlmImf/ImfPreviewImage.cpp	2011-02-15 10:10:00.946063574 -0800

@@ -41,6 +41,7 @@

 #include <ImfPreviewImage.h>

 #include "Iex.h"

+#include <climits>

 namespace Imf {

@@ -51,6 +52,10 @@

 {

     _width = width;

     _height = height;

+

+    if ((_height && (_width > (UINT_MAX / _height))) || ((_width * _height) > (UINT_MAX / sizeof(PreviewRgba))))

+	throw Iex::ArgExc ("Error: Invalid height and/or width!");

+

     _pixels = new PreviewRgba [_width * _height];

     if (pixels)

--- IlmImf/ImfPizCompressor.cpp	2007-09-20 21:17:46.000000000 -0700

+++ IlmImf/ImfPizCompressor.cpp	2011-02-15 10:10:24.179648473 -0800

@@ -53,6 +53,7 @@

 #include <ImfAutoArray.h>

 #include <string.h>

 #include <assert.h>

+#include <climits>

 namespace Imf {

@@ -181,6 +182,9 @@

     _channels (hdr.channels()),

     _channelData (0)

 {

+    if (static_cast<unsigned int>(maxScanLineSize) > static_cast<unsigned int>(INT_MAX - 65536 - 8192) / static_cast<unsigned int>(numScanLines))

+	throw InputExc ("Error: maxScanLineSize * numScanLines overflow!");

+

     _tmpBuffer = new unsigned short [maxScanLineSize * numScanLines / 2];

     _outBuffer = new char [maxScanLineSize * numScanLines + 65536 + 8192];