From 66ad3cb461b37f72e1f5379c7dca4ad4de4100aa Mon Sep 17 00:00:00 2001
From: Andrew Murray <radarhere@users.noreply.github.com>
Date: Thu, 11 Jul 2019 21:12:36 +1000
Subject: [PATCH] Changed overflow check to use PY_SSIZE_T_MAX

---
 Tests/test_map.py | 12 ++++++++++++
 src/map.c         |  2 +-
 2 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/Tests/test_map.py b/Tests/test_map.py
index 653ed31e2c0..3fc42651b30 100644
--- a/Tests/test_map.py
+++ b/Tests/test_map.py
@@ -4,6 +4,11 @@
 
 from .helper import PillowTestCase, unittest
 
+try:
+    import numpy
+except ImportError:
+    numpy = None
+
 
 @unittest.skipIf(sys.platform.startswith("win32"), "Win32 does not call map_buffer")
 class TestMap(PillowTestCase):
@@ -23,3 +28,10 @@ def test_overflow(self):
             im.load()
 
         Image.MAX_IMAGE_PIXELS = max_pixels
+
+    @unittest.skipIf(sys.maxsize <= 2 ** 32, "requires 64-bit system")
+    @unittest.skipIf(numpy is None, "Numpy is not installed")
+    def test_ysize(self):
+        # Should not raise 'Integer overflow in ysize'
+        arr = numpy.zeros((46341, 46341), dtype=numpy.uint8)
+        Image.fromarray(arr)
diff --git a/src/map.c b/src/map.c
index 76b3160129f..099bb4b3ef3 100644
--- a/src/map.c
+++ b/src/map.c
@@ -339,7 +339,7 @@ PyImaging_MapBuffer(PyObject* self, PyObject* args)
             stride = xsize * 4;
     }
 
-    if (stride > 0 && ysize > INT_MAX / stride) {
+    if (stride > 0 && ysize > PY_SSIZE_T_MAX / stride) {
         PyErr_SetString(PyExc_MemoryError, "Integer overflow in ysize");
         return NULL;
     }