https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5867

diff --git a/coders/sixel.c b/coders/sixel.c
index 6ae26c4345ec2b68c578ab5d848c6d5ec5161411..39e027199579d0415d5c61c933d8b6a9c70f3bae 100644 (file)
--- a/coders/sixel.c
+++ b/coders/sixel.c
@@ -203,7 +203,7 @@ static unsigned char *get_params(unsigned char *p, int *param, int *len)
         }
         if (isdigit(*p)) {
             for (n = 0; isdigit(*p); p++) {
-                n = n * 10 + (*p - '0');
+                n = (int) ((ssize_t) n * 10 + (*p - '0'));
             }
             if (*len < 10) {
                 param[(*len)++] = n;