From 6443fb25810a44ddc92e86a700d4e1c7db2cf7ee Mon Sep 17 00:00:00 2001
From: Ilia Alshanetsky <iliaa@php.net>
Date: Tue, 3 Jun 2003 23:42:49 +0000
Subject: [PATCH] MFH (Last set of integer overflow checks.)

---
 ext/gd/libgd/gd_gif_in.c | 2 +-
 ext/gd/libgd/gdxpm.c     | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/ext/gd/libgd/gd_gif_in.c b/ext/gd/libgd/gd_gif_in.c
index df8cc2ec0e..a5cd664461 100644
--- a/ext/gd/libgd/gd_gif_in.c
+++ b/ext/gd/libgd/gd_gif_in.c
@@ -299,7 +299,7 @@ GetDataBlock(gdIOCtx *fd, unsigned char *buf)
 	rv = GetDataBlock_(fd,buf);
 	if (VERBOSE) {
 		if (rv > 0) {
-			tmp = emalloc((3*sizeof(char)*rv) + 1);
+			tmp = safe_emalloc(3 * rv, sizeof(char), 1);
 			for (i=0;i<rv;i++) {
 				sprintf(&tmp[3*sizeof(char)*i], " %02x", buf[i]);
 			}
diff --git a/ext/gd/libgd/gdxpm.c b/ext/gd/libgd/gdxpm.c
index 4687fa870b..3a836deda6 100644
--- a/ext/gd/libgd/gdxpm.c
+++ b/ext/gd/libgd/gdxpm.c
@@ -37,7 +37,7 @@ gdImageCreateFromXpm (char *filename)
     return 0;
 
   number = image.ncolors;
-  colors = (int *) gdMalloc (sizeof (int) * number);
+  colors = (int *) safe_emalloc(number, sizeof(int), 0);
   for (i = 0; i < number; i++)
     {
       switch (strlen (image.colorTable[i].c_color))
-- 
2.50.1