MFH (Last set of integer overflow checks.)

diff --git a/ext/gd/libgd/gd_gif_in.c b/ext/gd/libgd/gd_gif_in.c
index df8cc2ec0e693d7710026c098f53bd6f5a8b2122..a5cd6644617f16b2949a42593b4803527447da0a 100644 (file)
--- a/ext/gd/libgd/gd_gif_in.c
+++ b/ext/gd/libgd/gd_gif_in.c
@@ -299,7 +299,7 @@ GetDataBlock(gdIOCtx *fd, unsigned char *buf)
        rv = GetDataBlock_(fd,buf);
        if (VERBOSE) {
                if (rv > 0) {
-                       tmp = emalloc((3*sizeof(char)*rv) + 1);
+                       tmp = safe_emalloc(3 * rv, sizeof(char), 1);
                        for (i=0;i<rv;i++) {
                                sprintf(&tmp[3*sizeof(char)*i], " %02x", buf[i]);
                        }

diff --git a/ext/gd/libgd/gdxpm.c b/ext/gd/libgd/gdxpm.c
index 4687fa870be2d67475750092f15d025b5db6f3a4..3a836deda67911fc89cb8c057beb3e846a75f163 100644 (file)
--- a/ext/gd/libgd/gdxpm.c
+++ b/ext/gd/libgd/gdxpm.c
@@ -37,7 +37,7 @@ gdImageCreateFromXpm (char *filename)
     return 0;
 
   number = image.ncolors;
-  colors = (int *) gdMalloc (sizeof (int) * number);
+  colors = (int *) safe_emalloc(number, sizeof(int), 0);
   for (i = 0; i < number; i++)
     {
       switch (strlen (image.colorTable[i].c_color))