From: Ilia Alshanetsky <iliaa@php.net>
Date: Tue, 3 Jun 2003 23:42:31 +0000 (+0000)
Subject: Last set of integer overflow checks.
X-Git-Tag: RELEASE_1_0_2~444
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=c13be6e6d55a78493855c9bce17918ba387f39cc;p=php

Last set of integer overflow checks.
---

diff --git a/ext/gd/libgd/gd_gif_in.c b/ext/gd/libgd/gd_gif_in.c
index df8cc2ec0e..a5cd664461 100644
--- a/ext/gd/libgd/gd_gif_in.c
+++ b/ext/gd/libgd/gd_gif_in.c
@@ -299,7 +299,7 @@ GetDataBlock(gdIOCtx *fd, unsigned char *buf)
 	rv = GetDataBlock_(fd,buf);
 	if (VERBOSE) {
 		if (rv > 0) {
-			tmp = emalloc((3*sizeof(char)*rv) + 1);
+			tmp = safe_emalloc(3 * rv, sizeof(char), 1);
 			for (i=0;i<rv;i++) {
 				sprintf(&tmp[3*sizeof(char)*i], " %02x", buf[i]);
 			}
diff --git a/ext/gd/libgd/gd_png.c b/ext/gd/libgd/gd_png.c
index c1b147e0f0..35c16e7af9 100644
--- a/ext/gd/libgd/gd_png.c
+++ b/ext/gd/libgd/gd_png.c
@@ -281,9 +281,9 @@ gdImagePtr gdImageCreateFromPngCtx (gdIOCtx * infile)
 
 	/* allocate space for the PNG image data */
 	rowbytes = png_get_rowbytes(png_ptr, info_ptr);
-	image_data = (png_bytep) gdMalloc (rowbytes * height);
+	image_data = (png_bytep) safe_emalloc(rowbytes, height, 0);
 
-	row_pointers = (png_bytepp) gdMalloc (height * sizeof (png_bytep));
+	row_pointers = (png_bytepp) safe_emalloc(height, sizeof(png_bytep), 0);
 
 	/* set the individual row_pointers to point at the correct offsets */
 	for (h = 0; h < height; ++h) {
@@ -625,10 +625,10 @@ void gdImagePngCtxEx (gdImagePtr im, gdIOCtx * outfile, int level)
 		int channels = im->saveAlphaFlag ? 4 : 3;
 		/* Our little 7-bit alpha channel trick costs us a bit here. */
 		png_bytep *row_pointers;
-		row_pointers = gdMalloc(sizeof (png_bytep) * height);
+		row_pointers = safe_emalloc(sizeof(png_bytep), height, 0);
 		for (j = 0; j < height; ++j) {
 			int bo = 0;
-			row_pointers[j] = (png_bytep) gdMalloc(width * channels);
+			row_pointers[j] = (png_bytep) safe_emalloc(width, channels, 0);
 			for (i = 0; i < width; ++i) {
 				unsigned char a;
 				row_pointers[j][bo++] = gdTrueColorGetRed(im->tpixels[j][i]);
@@ -659,7 +659,7 @@ void gdImagePngCtxEx (gdImagePtr im, gdIOCtx * outfile, int level)
 	} else {
 		if (remap) {
 			png_bytep *row_pointers;
-			row_pointers = gdMalloc(sizeof (png_bytep) * height);
+			row_pointers = safe_emalloc(height, sizeof(png_bytep), 0);
 			for (j = 0; j < height; ++j) {
 				row_pointers[j] = (png_bytep) gdMalloc(width);
 				for (i = 0; i < width; ++i) {
diff --git a/ext/gd/libgd/gdxpm.c b/ext/gd/libgd/gdxpm.c
index bc9ff4dad7..95bbf94a0c 100644
--- a/ext/gd/libgd/gdxpm.c
+++ b/ext/gd/libgd/gdxpm.c
@@ -38,7 +38,7 @@ gdImagePtr gdImageCreateFromXpm (char *filename)
 	}
 
 	number = image.ncolors;
-	colors = (int *) gdMalloc (sizeof (int) * number);
+	colors = (int *) safe_emalloc(number, sizeof(int), 0);
 	for (i = 0; i < number; i++) {
 		switch (strlen (image.colorTable[i].c_color)) {
 			case 4:
diff --git a/ext/gd/libgd/wbmp.c b/ext/gd/libgd/wbmp.c
index 039d80f00c..eead82deda 100644
--- a/ext/gd/libgd/wbmp.c
+++ b/ext/gd/libgd/wbmp.c
@@ -176,7 +176,7 @@ readwbmp (int (*getin) (void *in), void *in, Wbmp ** return_wbmp)
   printf ("W: %d, H: %d\n", wbmp->width, wbmp->height);
 #endif
 
-  if ((wbmp->bitmap = (int *) gdMalloc (sizeof (int) * wbmp->width * wbmp->height)) == NULL)
+  if ((wbmp->bitmap = (int *) safe_emalloc(wbmp->width * wbmp->height, sizeof(int), 0)) == NULL)
     {
       gdFree (wbmp);
       return (-1);