1 files changed, 6 insertions, 2 deletions
diff --git a/testing/libfuzzer/xfa_codec_fuzzer.h b/testing/libfuzzer/xfa_codec_fuzzer.h
index 90706af9f4..0ab7834f1e 100644
--- a/testing/libfuzzer/xfa_codec_fuzzer.h
+++ b/testing/libfuzzer/xfa_codec_fuzzer.h
@@ -38,9 +38,13 @@ class XFACodecFuzzer {
 
     // Skipping very large images, since they will take a long time and may lead
     // to OOM.
-    if (decoder->GetHeight() != 0 &&
-        decoder->GetWidth() > kXFACodecFuzzerPixelLimit / decoder->GetHeight())
+    FX_SAFE_UINT32 bitmap_size = decoder->GetHeight();
+    bitmap_size *= decoder->GetWidth();
+    bitmap_size *= 4;  // From CFX_DIBitmap impl.
+    if (!bitmap_size.IsValid() ||
+        bitmap_size.ValueOrDie() > kXFACodecFuzzerPixelLimit) {
       return 0;
+    }
 
     auto bitmap = pdfium::MakeRetain<CFX_DIBitmap>();
     bitmap->Create(decoder->GetWidth(), decoder->GetHeight(), FXDIB_Argb);