Blob Blame History Raw
diff --git a/libfreerdp-gdi/graphics.c b/libfreerdp-gdi/graphics.c
index 04816334c..5a49bd365 100644
--- a/libfreerdp-gdi/graphics.c
+++ b/libfreerdp-gdi/graphics.c
@@ -30,6 +30,8 @@
 #include <freerdp/codec/bitmap.h>
 #include <freerdp/cache/glyph.h>
 
+#include <stdint.h>
+
 #include "graphics.h"
 
 /* Bitmap Class */
@@ -89,9 +91,18 @@ void gdi_Bitmap_Paint(rdpContext* context, rdpBitmap* bitmap)
 void gdi_Bitmap_Decompress(rdpContext* context, rdpBitmap* bitmap,
 		uint8* data, int width, int height, int bpp, int length, boolean compressed)
 {
-	uint16 size;
+	uint32 size = width * height;
+	int bpp_op = (bpp + 7) / 8;
+
+	if ((bpp == 0) ||
+	    (width == 0) || (height == 0) || (width > UINT32_MAX / height) ||
+	    (size > (UINT32_MAX / bpp_op)))
+	{
+		printf("gdi_Bitmap_Decompress failed\n");
+		abort();
+	}
 
-	size = width * height * (bpp + 7) / 8;
+	size *= bpp_op;
 
 	if (bitmap->data == NULL)
 		bitmap->data = (uint8*) xmalloc(size);