There is a potential int32 overflow in multiply_ms function in
tools/ppm2tiff.c.

static tmsize_t
multiply_ms(tmsize_t m1, tmsize_t m2)
{
        tmsize_t bytes = m1 * m2;

        if (m1 && bytes / m1 != m2)
                bytes = 0;

        return bytes;
}

Below is the proposal patch for the issue. 


+#define TIFF_SIZE_T_MAX ((size_t) ~ ((size_t)0))
+#define TIFF_TMSIZE_T_MAX (tmsize_t)(TIFF_SIZE_T_MAX >> 1)
+
 static tmsize_t
 multiply_ms(tmsize_t m1, tmsize_t m2)
 {
-       tmsize_t bytes = m1 * m2;
-
-       if (m1 && bytes / m1 != m2)
-               bytes = 0;
-
-       return bytes;
+        if( m1 == 0 || m2 > TIFF_TMSIZE_T_MAX / m1 )
+            return 0;
+        return m1 * m2;
 }