Last set of integer overflow checks.

diff --git a/ext/gd/libgd/gd_gif_in.c b/ext/gd/libgd/gd_gif_in.c
index df8cc2ec0e693d7710026c098f53bd6f5a8b2122..a5cd6644617f16b2949a42593b4803527447da0a 100644 (file)
--- a/ext/gd/libgd/gd_gif_in.c
+++ b/ext/gd/libgd/gd_gif_in.c
@@ -299,7 +299,7 @@ GetDataBlock(gdIOCtx *fd, unsigned char *buf)
        rv = GetDataBlock_(fd,buf);
        if (VERBOSE) {
                if (rv > 0) {
-                       tmp = emalloc((3*sizeof(char)*rv) + 1);
+                       tmp = safe_emalloc(3 * rv, sizeof(char), 1);
                        for (i=0;i<rv;i++) {
                                sprintf(&tmp[3*sizeof(char)*i], " %02x", buf[i]);
                        }

diff --git a/ext/gd/libgd/gd_png.c b/ext/gd/libgd/gd_png.c
index c1b147e0f0ac99bc850ea013f43114a89ff888a9..35c16e7af95e682e99dfa9d9d8d9a96645e7f7d4 100644 (file)
--- a/ext/gd/libgd/gd_png.c
+++ b/ext/gd/libgd/gd_png.c
@@ -281,9 +281,9 @@ gdImagePtr gdImageCreateFromPngCtx (gdIOCtx * infile)
 
        /* allocate space for the PNG image data */
        rowbytes = png_get_rowbytes(png_ptr, info_ptr);
-       image_data = (png_bytep) gdMalloc (rowbytes * height);
+       image_data = (png_bytep) safe_emalloc(rowbytes, height, 0);
 
-       row_pointers = (png_bytepp) gdMalloc (height * sizeof (png_bytep));
+       row_pointers = (png_bytepp) safe_emalloc(height, sizeof(png_bytep), 0);
 
        /* set the individual row_pointers to point at the correct offsets */
        for (h = 0; h < height; ++h) {
@@ -625,10 +625,10 @@ void gdImagePngCtxEx (gdImagePtr im, gdIOCtx * outfile, int level)
                int channels = im->saveAlphaFlag ? 4 : 3;
                /* Our little 7-bit alpha channel trick costs us a bit here. */
                png_bytep *row_pointers;
-               row_pointers = gdMalloc(sizeof (png_bytep) * height);
+               row_pointers = safe_emalloc(sizeof(png_bytep), height, 0);
                for (j = 0; j < height; ++j) {
                        int bo = 0;
-                       row_pointers[j] = (png_bytep) gdMalloc(width * channels);
+                       row_pointers[j] = (png_bytep) safe_emalloc(width, channels, 0);
                        for (i = 0; i < width; ++i) {
                                unsigned char a;
                                row_pointers[j][bo++] = gdTrueColorGetRed(im->tpixels[j][i]);
@@ -659,7 +659,7 @@ void gdImagePngCtxEx (gdImagePtr im, gdIOCtx * outfile, int level)
        } else {
                if (remap) {
                        png_bytep *row_pointers;
-                       row_pointers = gdMalloc(sizeof (png_bytep) * height);
+                       row_pointers = safe_emalloc(height, sizeof(png_bytep), 0);
                        for (j = 0; j < height; ++j) {
                                row_pointers[j] = (png_bytep) gdMalloc(width);
                                for (i = 0; i < width; ++i) {

diff --git a/ext/gd/libgd/gdxpm.c b/ext/gd/libgd/gdxpm.c
index bc9ff4dad751dfe78e299d282a40f4d9b3dd5e8e..95bbf94a0ca9e4bc5008d45917be966568c5b867 100644 (file)
--- a/ext/gd/libgd/gdxpm.c
+++ b/ext/gd/libgd/gdxpm.c
@@ -38,7 +38,7 @@ gdImagePtr gdImageCreateFromXpm (char *filename)
        }
 
        number = image.ncolors;
-       colors = (int *) gdMalloc (sizeof (int) * number);
+       colors = (int *) safe_emalloc(number, sizeof(int), 0);
        for (i = 0; i < number; i++) {
                switch (strlen (image.colorTable[i].c_color)) {
                        case 4:

diff --git a/ext/gd/libgd/wbmp.c b/ext/gd/libgd/wbmp.c
index 039d80f00c762b23a6de8b02f40b3a3d640f1187..eead82dedafd91774e0d0678da98a6110cd9e61d 100644 (file)
--- a/ext/gd/libgd/wbmp.c
+++ b/ext/gd/libgd/wbmp.c
@@ -176,7 +176,7 @@ readwbmp (int (*getin) (void *in), void *in, Wbmp ** return_wbmp)
   printf ("W: %d, H: %d\n", wbmp->width, wbmp->height);
 #endif
 
-  if ((wbmp->bitmap = (int *) gdMalloc (sizeof (int) * wbmp->width * wbmp->height)) == NULL)
+  if ((wbmp->bitmap = (int *) safe_emalloc(wbmp->width * wbmp->height, sizeof(int), 0)) == NULL)
     {
       gdFree (wbmp);
       return (-1);