https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13694

diff --git a/coders/sixel.c b/coders/sixel.c
index ae32db87490be730748dbdd31d96eb5733d13da6..b17dea99023b176b18fb62aca37786a7f8722504 100644 (file)
--- a/coders/sixel.c
+++ b/coders/sixel.c
@@ -203,7 +203,8 @@ static unsigned char *get_params(unsigned char *p, int *param, int *len)
         }
         if (isdigit((int) ((unsigned char) *p))) {
             for (n = 0; isdigit((int) ((unsigned char) *p)); p++) {
-                n = (int) ((ssize_t) n * 10 + (*p - '0'));
+                if (n <= (INT_MAX/10))
+                  n = (int) ((ssize_t) n * 10 + (*p - '0'));
             }
             if (*len < 10) {
                 param[(*len)++] = n;