1diff --git a/third_party/libtiff/tif_dirread.c b/third_party/libtiff/tif_dirread.c 2index 772ebaf7d..ab938eac9 100644 3--- a/third_party/libtiff/tif_dirread.c 4+++ b/third_party/libtiff/tif_dirread.c 5@@ -41,6 +41,7 @@ 6 7 #include "tiffiop.h" 8 #include <float.h> 9+#include <limits.h> 10 11 #define IGNORE 0 /* tag placeholder used below */ 12 #define FAILED_FII ((uint32) -1) 13@@ -3638,6 +3639,13 @@ TIFFReadDirectory(TIFF* tif) 14 isTiled(tif) ? "tiles" : "strips"); 15 goto bad; 16 } 17+ if (tif->tif_dir.td_nstrips > INT_MAX) { 18+ TIFFErrorExt(tif->tif_clientdata, module, 19+ "Cannot handle %u number of %s", 20+ tif->tif_dir.td_nstrips, 21+ isTiled(tif) ? "tiles" : "strips"); 22+ goto bad; 23+ } 24 tif->tif_dir.td_stripsperimage = tif->tif_dir.td_nstrips; 25 if (tif->tif_dir.td_planarconfig == PLANARCONFIG_SEPARATE) 26 tif->tif_dir.td_stripsperimage /= tif->tif_dir.td_samplesperpixel; 27