https://codereview.chromium.org/2405693002
https://crbug.com/654169
https://pdfium.googlesource.com/pdfium/+/master/libtiff/

Author: stackexploit <stackexploit@gmail.com>
Date:   Mon Oct 10 10:58:25 2016 -0700

libtiff: Prevent a buffer overflow in function ChopUpSingleUncompressedStrip.

The patch (https://codereview.chromium.org/2284063002) for Issue 618267
was insufficient. The integer overflow still could be triggered and could
lead to heap buffer overflow.

This CL strengthens integer overflow check in function _TIFFCheckRealloc.

--- a/libtiff/tif_aux.c
+++ b/libtiff/tif_aux.c
@@ -69,7 +69,7 @@ _TIFFCheckRealloc(TIFF* tif, void* buffer,
 	/*
 	 * XXX: Check for integer overflow.
 	 */
-	if (nmemb && elem_size && !_TIFFIfMultiplicationOverflow(nmemb, elem_size))
+	if (nmemb > 0 && elem_size > 0 && !_TIFFIfMultiplicationOverflow(nmemb, elem_size))
 		cp = _TIFFrealloc(buffer, bytes);
 
 	if (cp == NULL) {