diff --git a/ogr/ogrsf_frmts/miramon/mm_rdlayr.c b/ogr/ogrsf_frmts/miramon/mm_rdlayr.c index 1f3a9fc61f88..ba15f5c1841d 100644 --- a/ogr/ogrsf_frmts/miramon/mm_rdlayr.c +++ b/ogr/ogrsf_frmts/miramon/mm_rdlayr.c @@ -449,6 +449,23 @@ MMGetMultiPolygonCoordinates(struct MiraMonVectLayerInfo *hMiraMonLayer, pArcHeader = hMiraMonLayer->MMPolygon.MMArc.pArcHeader + (hMiraMonLayer->pArcs + nIndex)->nIArc; + + if (hMiraMonLayer->ReadFeature + .pNCoordRing[hMiraMonLayer->ReadFeature.nNRings] > + UINT64_MAX - pArcHeader->nElemCount) + { + free_function(pBuffer); + return 1; + } + + if (hMiraMonLayer->ReadFeature + .pNCoordRing[hMiraMonLayer->ReadFeature.nNRings] > + UINT64_MAX - pArcHeader->nElemCount) + { + free_function(pBuffer); + return 1; + } + hMiraMonLayer->ReadFeature .pNCoordRing[hMiraMonLayer->ReadFeature.nNRings] += pArcHeader->nElemCount; @@ -517,10 +534,19 @@ MMGetMultiPolygonCoordinates(struct MiraMonVectLayerInfo *hMiraMonLayer, return 1; } + if (hMiraMonLayer->ReadFeature + .pNCoordRing[hMiraMonLayer->ReadFeature.nNRings] > + UINT64_MAX - hMiraMonLayer->ReadFeature.nNumpCoord) + { + free_function(pBuffer); + return 1; + } + hMiraMonLayer->ReadFeature .pNCoordRing[hMiraMonLayer->ReadFeature.nNRings] += hMiraMonLayer->ReadFeature.nNumpCoord; nNAcumulVertices += hMiraMonLayer->ReadFeature.nNumpCoord; + if ((hMiraMonLayer->pArcs + nIndex)->VFG & MM_POL_END_RING) { hMiraMonLayer->ReadFeature