From a21f78eeacc4e796b4b2a3a90a4c00200e633d84 Mon Sep 17 00:00:00 2001
From: Dirk Mueller <mueller@kde.org>
Date: Fri, 9 Dec 2005 12:56:16 +0000
Subject: [PATCH] fix integer overflow in gmallocn and friends

svn path=/trunk/KDE/kdegraphics/kpdf/; revision=487067
---
 xpdf/goo/gmem.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/xpdf/goo/gmem.c b/xpdf/goo/gmem.c
index 00cbbda27..1a9c4f008 100644
--- a/xpdf/goo/gmem.c
+++ b/xpdf/goo/gmem.c
@@ -11,6 +11,7 @@
 #include <stdlib.h>
 #include <stddef.h>
 #include <string.h>
+#include <limits.h>
 #include "gmem.h"
 
 #ifdef DEBUG_MEM
@@ -141,7 +142,7 @@ void *gmallocn(int nObjs, int objSize) {
   int n;
 
   n = nObjs * objSize;
-  if (objSize == 0 || n / objSize != nObjs) {
+  if (objSize <= 0 || nObjs < 0 || nObjs >= INT_MAX / objSize) {
     fprintf(stderr, "Bogus memory allocation size\n");
     exit(1);
   }
@@ -152,7 +153,7 @@ void *greallocn(void *p, int nObjs, int objSize) {
   int n;
 
   n = nObjs * objSize;
-  if (objSize == 0 || n / objSize != nObjs) {
+  if (objSize <= 0 || nObjs < 0 || nObjs >= INT_MAX / objSize) {
     fprintf(stderr, "Bogus memory allocation size\n");
     exit(1);
   }