diff -urN netpbm-9.25.orig/COPYRIGHT.PATENT netpbm-9.25/COPYRIGHT.PATENT
--- netpbm-9.25.orig/COPYRIGHT.PATENT	2001-11-12 20:16:00.000000000 +0100
+++ netpbm-9.25/COPYRIGHT.PATENT	2004-05-12 11:53:57.823565720 +0200
@@ -23,6 +23,11 @@
 The copyrights on individual components of this package are detailed 
 at appropriate places within the package.
 
+These security fixes for netpbm are (c) Copyright 2002 Red Hat Inc.
+Red Hat has not fixed those items with patent claims or commercial
+use restrictions. These changes include NO WARRANTY and are provided
+under the Open Software License v.1 (see file OPENLICENSE).
+
 
 PATENTS
 -------
diff -urN netpbm-9.25.orig/OPENLICENSE netpbm-9.25/OPENLICENSE
--- netpbm-9.25.orig/OPENLICENSE	1970-01-01 01:00:00.000000000 +0100
+++ netpbm-9.25/OPENLICENSE	2004-05-12 11:53:57.831564504 +0200
@@ -0,0 +1,163 @@
+			The Open Software License
+			v. 1.1
+
+This Open Software License (the "License") applies to any original work of
+authorship (the "Original Work") whose owner (the "Licensor") has placed the
+following notice immediately following the copyright notice for the Original
+Work:
+
+Licensed under the Open Software License version 1.1
+
+1) Grant of Copyright License. Licensor hereby grants You a world-wide,
+royalty-free, non-exclusive, perpetual, non-sublicenseable license to do the
+following:
+
+a) to reproduce the Original Work in copies;
+
+b) to prepare derivative works ("Derivative Works") based upon the Original
+Work;
+
+c) to distribute copies of the Original Work and Derivative Works to the
+public, with the proviso that copies of Original Work or Derivative Works that
+You distribute shall be licensed under the Open Software License;
+
+d) to perform the Original Work publicly; and
+
+e) to display the Original Work publicly.
+
+2) Grant of Patent License. Licensor hereby grants You a world-wide,
+royalty-free, non-exclusive, perpetual, non-sublicenseable license, under
+patent claims owned or controlled by the Licensor that are embodied in the
+Original Work as furnished by the Licensor ("Licensed Claims") to make, use,
+sell and offer for sale the Original Work. Licensor hereby grants You a
+world-wide, royalty-free, non-exclusive, perpetual, non-sublicenseable license
+under the Licensed Claims to make, use, sell and offer for sale Derivative Works.
+
+3) Grant of Source Code License. The term "Source Code" means the preferred
+form of the Original Work for making modifications to it and all available
+documentation describing how to modify the Original Work. Licensor hereby
+agrees to provide a machine-readable copy of the Source Code of the Original
+Work along with each copy of the Original Work that Licensor distributes.
+Licensor reserves the right to satisfy this obligation by placing a
+machine-readable copy of the Source Code in an information repository reasonably
+calculated to permit inexpensive and convenient access by You for as long as
+ Licensor continues to distribute the Original Work, and by publishing the
+address of that information repository in a notice immediately following the
+copyright notice that applies to the Original Work.
+
+
+4) Exclusions From License Grant. Nothing in this License shall be deemed to
+grant any rights to trademarks, copyrights, patents, trade secrets or any
+other intellectual property of Licensor except as expressly stated herein. No
+patent license is granted to make, use, sell or offer to sell embodiments of
+any patent claims other than the Licensed Claims defined in Section 2. No
+right is granted to the trademarks of Licensor even if such marks are included
+in the Original Work. Nothing in this License shall be interpreted to prohibit
+Licensor from licensing under different terms from this License any Original
+Work that Licensor otherwise would have a right to license.
+
+5) External Deployment. The term "External Deployment" means the use or
+distribution of the Original Work or Derivative Works in any way such that the
+Original Work or Derivative Works may be used by anyone other than You,
+whether the Original Work or Derivative Works are distributed to those persons
+or made available as an application intended for use over a computer network.
+As an express condition for the grants of license hereunder, You agree that
+any External Deployment by You of a Derivative Work shall be deemed a
+distribution and shall be licensed to all under the terms of this License, as
+prescribed in section 1(c) herein.
+
+6) Attribution Rights. You must retain, in the Source Code of any Derivative
+Works that You create, all copyright, patent or trademark notices from the
+Source Code of the Original Work, as well as any notices of licensing and any
+descriptive text identified therein as an "Attribution Notice." You must cause
+the Source Code for any Derivative Works that You create to carry a prominent
+Attribution Notice reasonably calculated to inform recipients that You have
+modified the Original Work.
+
+7) Warranty and Disclaimer of Warranty. Licensor warrants that the copyright
+in and to the Original Work is owned by the Licensor or that the Original Work
+is distributed by Licensor under a valid current license from the copyright
+owner. Except as expressly stated in the immediately proceeding sentence, the
+Original Work is provided under this License on an "AS IS" BASIS and WITHOUT
+WARRANTY, either express or implied, including, without limitation, the
+warranties of NON-INFRINGEMENT, MERCHANTABILITY or FITNESS FOR A PARTICULAR
+PURPOSE. THE ENTIRE RISK AS TO THE QUALITY OF THE ORIGINAL WORK IS WITH YOU.
+This DISCLAIMER OF WARRANTY constitutes an essential part of this License. No
+license to Original Work is granted hereunder except under this disclaimer.
+
+8) Limitation of Liability. Under no circumstances and under no legal theory,
+whether in tort (including negligence), contract, or otherwise, shall the
+Licensor be liable to any person for any direct, indirect, special, incidental,
+or consequential damages of any character arising as a result of this License
+or the use of the Original Work including, without limitation, damages for
+loss of goodwill, work stoppage, computer failure or malfunction, or any and
+all other commercial damages or losses. This limitation of liability shall not
+apply to liability for death or personal injury resulting from Licensor's
+negligence to the extent applicable law prohibits such limitation. Some
+jurisdictions do not allow the exclusion or limitation of incidental or
+consequential damages, so this exclusion and limitation may not apply to You.
+
+
+9) Acceptance and Termination. If You distribute copies of the Original Work
+or a Derivative Work, You must make a reasonable effort under the circumstances
+to obtain the express and volitional assent of recipients to the terms of this
+License. Nothing else but this License (or another written agreement between
+Licensor and You) grants You permission to create Derivative Works based upon
+the Original Work or to exercise any of the rights granted in Sections 1 herein,
+and any attempt to do so except under the terms of this License (or another
+written agreement between Licensor and You) is expressly prohibited by U.S.
+copyright law, the equivalent laws of other countries, and by international
+treaty. Therefore, by exercising any of the rights granted to You in Sections
+1 herein, You indicate Your acceptance of this License and all of its terms and
+conditions. This License shall terminate immediately and you may no longer
+exercise any of the rights granted to You by this License upon Your failure to
+honor the proviso in Section 1(c) herein.
+
+10) Mutual Termination for Patent Action. This License shall terminate
+automatically and You may no longer exercise any of the rights granted to You
+by this License if You file a lawsuit in any court alleging that any OSI
+Certified open source software that is licensed under any license containing
+this "Mutual Termination for Patent Action" clause infringes any patent claims
+that are essential to use that software.
+
+11) Jurisdiction, Venue and Governing Law. Any action or suit relating to this
+License may be brought only in the courts of a jurisdiction wherein the Licensor
+resides or in which Licensor conducts its primary business, and under the laws
+of that jurisdiction excluding its conflict-of-law provisions. The application
+of the United Nations Convention on Contracts for the International Sale of
+Goods is expressly excluded. Any use of the Original Work outside the scope of
+this License or after its termination shall be subject to the requirements and
+penalties of the U.S. Copyright Act, 17 U.S.C. å¤ 101 et seq., the equivalent
+laws of other countries, and international treaty. This section shall survive
+the termination of this License.
+
+12) Attorneys Fees. In any action to enforce the terms of this License or
+seeking damages relating thereto, the prevailing party shall be entitled to
+recover its costs and expenses, including, without limitation, reasonable
+attorneys' fees and costs incurred in connection with such action, including
+any appeal of such action. This section shall survive the termination of this
+License.
+
+13) Miscellaneous. This License represents the complete agreement concerning
+the subject matter hereof. If any provision of this License is held to be
+unenforceable, such provision shall be reformed only to the extent necessary
+to make it enforceable.
+
+14) Definition of "You" in This License. "You" throughout this License,
+whether in upper or lower case, means an individual or a legal entity exercising
+rights under, and complying with all of the terms of, this License. For legal
+entities, "You" includes any entity that controls, is controlled by, or is under
+common control with you. For purposes of this definition, "control" means (i)
+the power, direct or indirect, to cause the direction or management of such
+entity, whether by contract or otherwise, or (ii) ownership of fifty percent
+(50%) or more of the outstanding shares, or (iii) beneficial ownership of such
+entity.
+
+15) Right to Use. You may use the Original Work in all ways not otherwise
+restricted or conditioned by this License or by law, and Licensor promises not
+to interfere with or be responsible for such uses by You.
+
+This license is Copyright (C) 2002 Lawrence E. Rosen. All rights reserved.
+Permission is hereby granted to copy and distribute this license without
+modification. This license may not be modified without the express written
+permission of its copyright owner.
diff -urN netpbm-9.25.orig/pbm/atktopbm.c netpbm-9.25/pbm/atktopbm.c
--- netpbm-9.25.orig/pbm/atktopbm.c	2000-03-19 05:33:36.000000000 +0100
+++ netpbm-9.25/pbm/atktopbm.c	2004-05-12 11:52:28.426156192 +0200
@@ -322,8 +322,7 @@
 	*rwidth = width;
 	*rheight = height;
 	rowlen = (width + 7) / 8;
-	*destaddr = (unsigned char *) malloc (sizeof(unsigned char) * height *
-rowlen);
+	*destaddr = (unsigned char *) malloc3 (sizeof(unsigned char), height, rowlen);
 	for (row = 0;   row < height;   row++)
 	  {
 	    long c;
diff -urN netpbm-9.25.orig/pbm/icontopbm.c netpbm-9.25/pbm/icontopbm.c
--- netpbm-9.25.orig/pbm/icontopbm.c	1993-10-04 10:10:28.000000000 +0100
+++ netpbm-9.25/pbm/icontopbm.c	2004-05-12 11:52:28.428155888 +0200
@@ -10,6 +10,8 @@
 ** implied warranty.
 */
 
+#include <string.h>
+#include <limits.h>
 #include "pbm.h"
 
 static void ReadIconFile ARGS(( FILE* file, int* width, int* height, short** data ));
@@ -137,6 +139,11 @@
     if ( *height <= 0 )
 	pm_error( "invalid height: %d", *height );
 
+    if ( *width > INT_MAX - 16 || *width < 0)
+    	pm_error( "invalid width: %d", *width);
+
+    overflow2(*width + 16, *height);
+
     data_length = BitmapSize( *width, *height );
     *data = (short*) malloc( data_length );
     if ( *data == NULL )
diff -urN netpbm-9.25.orig/pbm/libpbm1.c netpbm-9.25/pbm/libpbm1.c
--- netpbm-9.25.orig/pbm/libpbm1.c	2002-01-03 21:09:23.000000000 +0100
+++ netpbm-9.25/pbm/libpbm1.c	2004-05-12 11:52:28.426156192 +0200
@@ -36,13 +36,18 @@
           const int format, const int cols, const int rows,
           enum pm_check_code * const retval_p) {
 
+    if (rows < 0 || cols < 0)
+        pm_error("invalid image");
     if (check_type != PM_CHECK_BASIC) {
         if (retval_p) *retval_p = PM_CHECK_UNKNOWN_TYPE;
     } else if (format != RPBM_FORMAT) {
         if (retval_p) *retval_p = PM_CHECK_UNCHECKABLE;
     } else {        
+        /* signed to unsigned so wont wrap */
         const unsigned int bytes_per_row = (cols+7)/8;
         const unsigned int need_raster_size = rows * bytes_per_row;
+
+	overflow2(bytes_per_row, rows);
         
         pm_check(file, check_type, need_raster_size, retval_p);
     }
diff -urN netpbm-9.25.orig/pbm/libpbm5.c netpbm-9.25/pbm/libpbm5.c
--- netpbm-9.25.orig/pbm/libpbm5.c	2000-05-06 08:30:12.000000000 +0200
+++ netpbm-9.25/pbm/libpbm5.c	2004-05-12 11:52:28.424156496 +0200
@@ -767,15 +767,18 @@
     fn->frows = frows;
     fn->fcols = fcols;
     
-    glyph = (struct glyph*) malloc( sizeof(struct glyph) * 95 );
+    glyph = (struct glyph*) malloc2( sizeof(struct glyph), 95 );
     if ( glyph == (struct glyph*) 0 )
 	pm_error( "out of memory allocating glyphs" );
     
-    bmap = (char*) malloc( fn->maxwidth * fn->maxheight * 95 );
+    bmap = (char*) malloc3( fn->maxwidth, fn->maxheight, 95 );
     if ( bmap == (char*) 0)
 	pm_error( "out of memory allocating glyph data" );
 
     /* Now fill in the 0,0 coords. */
+    overflow2(char_height, 2);
+    overflow2(char_width, 2);
+
     row = char_height * 2;
     col = char_width * 2;
     for ( ch = 0; ch < 95; ++ch )
@@ -1022,7 +1025,7 @@
 				glyph->x = atoi(arg[3]);
 				glyph->y = atoi(arg[4]);
 
-				if (!(glyph->bmap = (char*)malloc(glyph->width * glyph->height)))
+				if (!(glyph->bmap = (char*)malloc2(glyph->width, glyph->height)))
 					pm_error("no memory for font glyph byte map");
 
 				if (readline(fp, line, arg) < 0) { fclose(fp); return 0; }
diff -urN netpbm-9.25.orig/pbm/libpbmvms.c netpbm-9.25/pbm/libpbmvms.c
--- netpbm-9.25.orig/pbm/libpbmvms.c	2000-05-26 20:34:55.000000000 +0200
+++ netpbm-9.25/pbm/libpbmvms.c	2004-05-12 11:52:28.448152848 +0200
@@ -1,3 +1,5 @@
+#warning "NOT AUDITED"
+
 /***************************************************************************
   This file contains library routines needed to build Netpbm for VMS.
   However, as of 2000.05.26, when these were split out of libpbm1.c
diff -urN netpbm-9.25.orig/pbm/libpm.c netpbm-9.25/pbm/libpm.c
--- netpbm-9.25.orig/pbm/libpm.c	2002-02-24 23:37:29.000000000 +0100
+++ netpbm-9.25/pbm/libpm.c	2004-05-12 11:52:28.449152696 +0200
@@ -14,6 +14,7 @@
 **************************************************************************/
 
 #include <stdio.h>
+#include <limits.h>
 #include "version.h"
 #include "compile.h"
 #include "shhopt.h"
@@ -90,7 +91,7 @@
 pm_allocrow(int const cols, int const size) {
     register char* itrow;
 
-    itrow = (char*) malloc( cols * size );
+    itrow = (char*) malloc2( cols , size );
     if ( itrow == (char*) 0 )
         pm_error( "out of memory allocating a row" );
     return itrow;
@@ -108,10 +109,10 @@
     char** its;
     int i;
 
-    its = (char**) malloc( rows * sizeof(char*) );
+    its = (char**) malloc2( rows, sizeof(char*) );
     if ( its == (char**) 0 )
         pm_error( "out of memory allocating an array" );
-    its[0] = (char*) malloc( rows * cols * size );
+    its[0] = (char*) malloc3( rows, cols, size );
     if ( its[0] == (char*) 0 )
         pm_error( "out of memory allocating an array" );
     for ( i = 1; i < rows; ++i )
@@ -129,10 +130,12 @@
 pm_allocarray(int const cols, int const rows, int const size) {
     char** its;
     int i;
-    its = (char**) malloc( (rows + 1) * sizeof(char*) );
+
+    overflow_add(rows, 1);
+    its = (char**) malloc2( (rows + 1),  sizeof(char*) );
     if ( its == (char**) 0 )
         pm_error( "out of memory allocating an array" );
-    its[rows] = its[0] = (char*) malloc( rows * cols * size );
+    its[rows] = its[0] = (char*) malloc3( rows. cols, size );
     if ( its[0] != (char*) 0 )
         for ( i = 1; i < rows; ++i )
             its[i] = &(its[0][i * cols * size]);
@@ -958,4 +961,53 @@
 }
 
 
+/*
+ *	Maths wrapping
+ */
+
+void overflow2(int a, int b)
+{
+	if(a < 0 || b < 0)
+		pm_error("object too large");
+	if(b == 0)
+		return;
+	if(a > INT_MAX / b)
+		pm_error("object too large");
+}
+
+void overflow3(int a, int b, int c)
+{
+	overflow2(a,b);
+	overflow2(a*b, c);
+}
+
+void overflow_add(int a, int b)
+{
+	if( a > INT_MAX - b)
+		pm_error("object too large");
+}
+
+void *malloc2(int a, int b)
+{
+	overflow2(a, b);
+	if(a*b == 0)
+		pm_error("Zero byte allocation");
+	return malloc(a*b);
+}
+
+void *malloc3(int a, int b, int c)
+{
+	overflow3(a, b, c);
+	if(a*b*c == 0)
+		pm_error("Zero byte allocation");
+	return malloc(a*b*c);
+}
+
+void *realloc2(void * a, int b, int c)
+{
+	overflow2(b, c);
+	if(b*c == 0)
+		pm_error("Zero byte allocation");
+	return realloc(a, b*c);
+}
 
diff -urN netpbm-9.25.orig/pbm/mdatopbm.c netpbm-9.25/pbm/mdatopbm.c
--- netpbm-9.25.orig/pbm/mdatopbm.c	2000-05-06 11:28:53.000000000 +0200
+++ netpbm-9.25/pbm/mdatopbm.c	2004-05-12 11:52:28.442153760 +0200
@@ -235,9 +235,14 @@
 	pm_readlittleshort(infile, &yy); nInRows = yy;
 	pm_readlittleshort(infile, &yy); nInCols = yy;
 
+	overflow2(nOutCols, 8);
 	nOutCols = 8*nInCols;
 	nOutRows = nInRows;
-	if (bScale) nOutRows *= 2;
+	if (bScale)
+	{
+		overflow2(nOutRows, 2);
+		nOutRows *= 2;
+	}
 
 	data = pbm_allocarray(nOutCols, nOutRows);
 	mdrow = malloc(nInCols);
diff -urN netpbm-9.25.orig/pbm/mgrtopbm.c netpbm-9.25/pbm/mgrtopbm.c
--- netpbm-9.25.orig/pbm/mgrtopbm.c	2000-03-03 02:02:09.000000000 +0100
+++ netpbm-9.25/pbm/mgrtopbm.c	2004-05-12 11:52:28.432155280 +0200
@@ -108,6 +108,12 @@
                  head.magic[0], head.magic[1] );
         pad = -1;  /* should never reach here */
     }
+
+    if(head.h_wide < ' ' || head.l_wide < ' ')
+    	pm_error("bad width/height chars in MGR file");
+
+    overflow_add(*colsP, pad);
+
     *colsP = ( ( (int) head.h_wide - ' ' ) << 6 ) + ( (int) head.l_wide - ' ' );
     *rowsP = ( ( (int) head.h_high - ' ' ) << 6 ) + ( (int) head.l_high - ' ' );
     *padrightP = ( ( *colsP + pad - 1 ) / pad ) * pad - *colsP;
diff -urN netpbm-9.25.orig/pbm/pbmlife.c netpbm-9.25/pbm/pbmlife.c
--- netpbm-9.25.orig/pbm/pbmlife.c	1993-10-04 10:10:37.000000000 +0100
+++ netpbm-9.25/pbm/pbmlife.c	2004-05-12 11:52:28.435154824 +0200
@@ -54,7 +54,7 @@
 	prevrow = thisrow;
 	thisrow = nextrow;
 	nextrow = temprow;
-	if ( row < rows - 1 )
+	if ( row <= rows )
 	    pbm_readpbmrow( ifp, nextrow, cols, format );
 
         for ( col = 0; col < cols; ++col )
diff -urN netpbm-9.25.orig/pbm/pbmpage.c netpbm-9.25/pbm/pbmpage.c
--- netpbm-9.25.orig/pbm/pbmpage.c	2002-03-13 04:08:09.000000000 +0100
+++ netpbm-9.25/pbm/pbmpage.c	2004-05-12 11:52:28.443153608 +0200
@@ -15,6 +15,7 @@
 #include <math.h>
 #include <stdio.h>
 #include <stdlib.h>
+#include <string.h>
 #include "pbm.h"
 
 /* Support both US and A4. */
@@ -157,6 +158,9 @@
     /* We round the allocated row space up to a multiple of 8 so the ugly
        fast code below can work.
        */
+
+    overflow_add(Width, 7);
+
     pbmrow = pbm_allocrow(((Width+7)/8)*8);
     
     bitmap_cursor = 0;
diff -urN netpbm-9.25.orig/pbm/pbmpscale.c netpbm-9.25/pbm/pbmpscale.c
--- netpbm-9.25.orig/pbm/pbmpscale.c	2000-03-03 02:14:24.000000000 +0100
+++ netpbm-9.25/pbm/pbmpscale.c	2004-05-12 11:52:28.427156040 +0200
@@ -108,8 +108,9 @@
    inrow[0] = inrow[1] = inrow[2] = NULL;
    pbm_readpbminit(ifd, &columns, &rows, &format) ;
 
+   overflow2(columns, scale);
    outrow = pbm_allocrow(columns*scale) ;
-   flags = (unsigned char *)malloc(sizeof(unsigned char)*columns) ;
+   flags = (unsigned char *)malloc2(sizeof(unsigned char), columns) ;
    if (flags == NULL) pm_perror("out of memory") ;
 
    pbm_writepbminit(stdout, columns*scale, rows*scale, 0) ;
diff -urN netpbm-9.25.orig/pbm/pbmreduce.c netpbm-9.25/pbm/pbmreduce.c
--- netpbm-9.25.orig/pbm/pbmreduce.c	2000-04-26 21:24:02.000000000 +0200
+++ netpbm-9.25/pbm/pbmreduce.c	2004-05-12 11:52:28.435154824 +0200
@@ -92,8 +92,9 @@
 
     if ( halftone == QT_FS ) {
         /* Initialize Floyd-Steinberg. */
-        thiserr = (long*) malloc( ( newcols + 2 ) * sizeof(long) );
-        nexterr = (long*) malloc( ( newcols + 2 ) * sizeof(long) );
+        overflow_add(newcols, 2);
+        thiserr = (long*) malloc2( ( newcols + 2 ), sizeof(long) );
+        nexterr = (long*) malloc2( ( newcols + 2 ), sizeof(long) );
         if ( thiserr == 0 || nexterr == 0 )
           pm_error( "out of memory" );
 
diff -urN netpbm-9.25.orig/pbm/pbmtext.c netpbm-9.25/pbm/pbmtext.c
--- netpbm-9.25.orig/pbm/pbmtext.c	2001-03-20 03:44:49.000000000 +0100
+++ netpbm-9.25/pbm/pbmtext.c	2004-05-12 11:52:28.428155888 +0200
@@ -82,12 +82,14 @@
         
         for (i = 1; i < argc; i++) {
             if (i > 1) {
+	        overflow_add(totaltextsize, 1);
                 totaltextsize += 1;
                 cmdline_p->text = realloc(cmdline_p->text, totaltextsize);
                 if (cmdline_p->text == NULL)
                     pm_error("out of memory");
                 strcat(cmdline_p->text, " ");
             } 
+	    overflow_add(totaltextsize, strlen(argv[i]));
             totaltextsize += strlen(argv[i]);
             cmdline_p->text = realloc(cmdline_p->text, totaltextsize);
             if (cmdline_p->text == NULL)
@@ -328,11 +330,12 @@
            */
 
     maxlines = 50;  /* initial value */
-    *input_textP = (char**) malloc(maxlines * sizeof(char*));
+    *input_textP = (char**) malloc2(maxlines, sizeof(char*));
     if (*input_textP == NULL)
         pm_error("out of memory");
 
     if (cmdline_text) {
+        overflow_add(strlen(cmdline_text), 1);
         (*input_textP)[0] = malloc(strlen(cmdline_text)+1);
         if ((*input_textP)[0] == NULL)
             pm_error("Out of memory.");
@@ -347,7 +350,9 @@
         while (fgets(buf, sizeof(buf), stdin) != NULL) {
             fix_control_chars(buf, fn);
             if (*linesP >= maxlines) {
+	        overflow2(maxlines, 2);
                 maxlines *= 2;
+		overflow2(maxlines, sizeof(char *));
                 *input_textP = (char**) realloc((char*) *input_textP, 
                                                 maxlines * sizeof(char*));
                 if(*input_textP == NULL)
@@ -426,6 +431,7 @@
         hmargin = fn->maxwidth;
 	} else {
         vmargin = fn->maxheight;
+        overflow2(2, fn->maxwidth);
         hmargin = 2 * fn->maxwidth;
 	}
 
@@ -441,10 +447,15 @@
     } else
         lp = input_text;
     
+    overflow2(2, vmargin);
+    overflow2(lines, fn->maxheight);
+    overflow_add(vmargin * 2, lines * fn->maxheight);
     rows = 2 * vmargin + lines * fn->maxheight;
 
     compute_image_width(lp, lines, fn, cmdline.space, &maxwidth, &maxleftb);
 
+    overflow2(2, hmargin);
+    overflow_add(2*hmargin, maxwidth);
     cols = 2 * hmargin + maxwidth;
     bits = pbm_allocarray(cols, rows);
 
diff -urN netpbm-9.25.orig/pbm/pbmto10x.c netpbm-9.25/pbm/pbmto10x.c
--- netpbm-9.25.orig/pbm/pbmto10x.c	1995-08-13 05:36:40.000000000 +0200
+++ netpbm-9.25/pbm/pbmto10x.c	2004-05-12 11:52:28.436154672 +0200
@@ -50,7 +50,7 @@
 		res_60x72();
 
 	pm_close(ifp);
-	exit(0);
+	return 0;
 }
 
 static void
@@ -84,6 +84,8 @@
 	char		*stripe, *sP;
 
 	stripe = malloc(cols);
+        if(stripe == NULL)
+        	pm_error("out of memory");
 	for (i = 0; i < LOW_RES_ROWS; ++i)
 		bitrows[i] = pbm_allocrow(cols);
 	printf("\033A\010");		/* '\n' = 8/72 */
@@ -117,6 +119,8 @@
 	char		*stripe, *sP;
 
 	stripe = malloc(cols);
+	if(stripe == NULL)
+		pm_error("out of memory");
 	for (i = 0; i < HIGH_RES_ROWS; ++i)
 		bitrows[i] = pbm_allocrow(cols);
 	printf("\0333\001");			/* \n = 1/144" */
diff -urN netpbm-9.25.orig/pbm/pbmtoascii.c netpbm-9.25/pbm/pbmtoascii.c
--- netpbm-9.25.orig/pbm/pbmtoascii.c	2000-03-25 23:23:05.000000000 +0100
+++ netpbm-9.25/pbm/pbmtoascii.c	2004-05-12 11:52:28.437154520 +0200
@@ -115,9 +115,11 @@
         pm_usage( usage );
 
     pbm_readpbminit( ifp, &cols, &rows, &format );
+    overflow_add(cols, gridx);
     ccols = ( cols + gridx - 1 ) / gridx;
     bitrow = pbm_allocrow( cols );
     sig = (int*) pm_allocrow( ccols, sizeof(int) );
+    overflow_add(ccols, 1);
     line = (char*) pm_allocrow( ccols + 1, sizeof(char) );
 
     for ( row = 0; row < rows; row += gridy )
diff -urN netpbm-9.25.orig/pbm/pbmtoatk.c netpbm-9.25/pbm/pbmtoatk.c
--- netpbm-9.25.orig/pbm/pbmtoatk.c	2000-06-09 09:05:24.000000000 +0200
+++ netpbm-9.25/pbm/pbmtoatk.c	2004-05-12 11:52:28.437154520 +0200
@@ -65,6 +65,7 @@
     bitrow = pbm_allocrow( cols );
 
     /* Compute padding to round cols up to the nearest multiple of 16. */
+    overflow_add(cols, 15);
     padright = ( ( cols + 15 ) / 16 ) * 16 - cols;
 
     printf ("\\begindata{raster,%d}\n", 1);
diff -urN netpbm-9.25.orig/pbm/pbmtocmuwm.c netpbm-9.25/pbm/pbmtocmuwm.c
--- netpbm-9.25.orig/pbm/pbmtocmuwm.c	1993-10-04 10:10:46.000000000 +0100
+++ netpbm-9.25/pbm/pbmtocmuwm.c	2004-05-12 11:52:28.438154368 +0200
@@ -43,6 +43,7 @@
     bitrow = pbm_allocrow( cols );
     
     /* Round cols up to the nearest multiple of 8. */
+    overflow_add(cols, 7);
     padright = ( ( cols + 7 ) / 8 ) * 8 - cols;
 
     putinit( rows, cols );
diff -urN netpbm-9.25.orig/pbm/pbmtogem.c netpbm-9.25/pbm/pbmtogem.c
--- netpbm-9.25.orig/pbm/pbmtogem.c	2000-06-09 09:07:05.000000000 +0200
+++ netpbm-9.25/pbm/pbmtogem.c	2004-05-12 11:52:28.432155280 +0200
@@ -123,6 +123,7 @@
   bitsperitem = 0;
   bitshift = 7;
   outcol = 0;
+  overflow_add(cols, 7);
   outmax = (cols + 7) / 8;
   outrow = (unsigned char *) pm_allocrow (outmax, sizeof (unsigned char));
   lastrow = (unsigned char *) pm_allocrow (outmax, sizeof (unsigned char));
diff -urN netpbm-9.25.orig/pbm/pbmtogo.c netpbm-9.25/pbm/pbmtogo.c
--- netpbm-9.25.orig/pbm/pbmtogo.c	2000-06-09 09:07:04.000000000 +0200
+++ netpbm-9.25/pbm/pbmtogo.c	2004-05-12 11:52:28.439154216 +0200
@@ -90,6 +90,7 @@
     bitrow = pbm_allocrow(cols);
 
     /* Round cols up to the nearest multiple of 8. */
+    overflow_add(cols, 7);
     rucols = ( cols + 7 ) / 8;
     bytesperrow = rucols;       /* GraphOn uses bytes */
     rucols = rucols * 8;
diff -urN netpbm-9.25.orig/pbm/pbmtoicon.c netpbm-9.25/pbm/pbmtoicon.c
--- netpbm-9.25.orig/pbm/pbmtoicon.c	1993-10-04 10:10:50.000000000 +0100
+++ netpbm-9.25/pbm/pbmtoicon.c	2004-05-12 11:52:28.439154216 +0200
@@ -42,6 +42,7 @@
     bitrow = pbm_allocrow( cols );
     
     /* Round cols up to the nearest multiple of 16. */
+    overflow_add(cols, 15);
     pad = ( ( cols + 15 ) / 16 ) * 16 - cols;
     padleft = pad / 2;
     padright = pad - padleft;
diff -urN netpbm-9.25.orig/pbm/pbmtolj.c netpbm-9.25/pbm/pbmtolj.c
--- netpbm-9.25.orig/pbm/pbmtolj.c	2002-02-22 05:32:44.000000000 +0100
+++ netpbm-9.25/pbm/pbmtolj.c	2004-05-12 11:52:28.441153912 +0200
@@ -30,6 +30,7 @@
 #include "pbm.h"
 #include <string.h>
 #include <assert.h>
+#include <string.h>
 
 static int dpi = 75;
 static int floating = 0;  /* suppress the ``ESC & l 0 E'' ? */
@@ -123,7 +124,11 @@
     pbm_readpbminit( ifp, &cols, &rows, &format );
     bitrow = pbm_allocrow( cols );
 
+    overflow_add(cols, 8);
     rowBufferSize = (cols + 7) / 8;
+    overflow_add(rowBufferSize, 128);
+    overflow_add(rowBufferSize, rowBufferSize+128);
+    overflow_add(rowBufferSize+10, rowBufferSize/8);
     packBufferSize = rowBufferSize + (rowBufferSize + 127) / 128 + 1;
     deltaBufferSize = rowBufferSize + rowBufferSize / 8 + 10;
 
diff -urN netpbm-9.25.orig/pbm/pbmtomacp.c netpbm-9.25/pbm/pbmtomacp.c
--- netpbm-9.25.orig/pbm/pbmtomacp.c	2000-03-03 03:27:33.000000000 +0100
+++ netpbm-9.25/pbm/pbmtomacp.c	2004-05-12 11:52:28.440154064 +0200
@@ -102,6 +102,7 @@
   if( !lflg )
     left = 0;
 
+  overflow_add(left, MAX_COLS - 1);
   if( rflg )
   { if( right - left >= MAX_COLS )
       right = left + MAX_COLS - 1;
@@ -112,6 +113,8 @@
   if( !tflg )
     top = 0;
 
+  overflow_add(top, MAX_LINES - 1);
+
   if( bflg )
   { if( bottom - top >= MAX_LINES )
       bottom = top + MAX_LINES - 1;
diff -urN netpbm-9.25.orig/pbm/pbmtomda.c netpbm-9.25/pbm/pbmtomda.c
--- netpbm-9.25.orig/pbm/pbmtomda.c	2000-05-06 11:28:11.000000000 +0200
+++ netpbm-9.25/pbm/pbmtomda.c	2004-05-12 11:52:28.441153912 +0200
@@ -152,6 +152,8 @@
 
 	if (bScale)	nOutRows = nInRows / 2;
 	else		nOutRows = nInRows;
+
+	overflow_add(nOutRows, 3);
 	nOutRows = ((nOutRows + 3) / 4) * 4;
 					 /* MDA wants rows a multiple of 4 */	
 	nOutCols = nInCols / 8;
diff -urN netpbm-9.25.orig/pbm/pbmtomgr.c netpbm-9.25/pbm/pbmtomgr.c
--- netpbm-9.25.orig/pbm/pbmtomgr.c	1993-10-04 10:10:50.000000000 +0100
+++ netpbm-9.25/pbm/pbmtomgr.c	2004-05-12 11:52:28.440154064 +0200
@@ -43,6 +43,7 @@
     bitrow = pbm_allocrow( cols );
     
     /* Round cols up to the nearest multiple of 8. */
+    overflow_add(cols, 7);
     padright = ( ( cols + 7 ) / 8 ) * 8 - cols;
 
     putinit( rows, cols );
diff -urN netpbm-9.25.orig/pbm/pbmtoppa/pbm.c netpbm-9.25/pbm/pbmtoppa/pbm.c
--- netpbm-9.25.orig/pbm/pbmtoppa/pbm.c	2000-06-01 19:20:30.000000000 +0200
+++ netpbm-9.25/pbm/pbmtoppa/pbm.c	2004-05-12 11:52:28.444153456 +0200
@@ -105,6 +105,7 @@
     return 0;
 
   case P4:
+    overflow_add(pbm->width, 7);
     tmp=(pbm->width+7)/8;
     tmp2=fread(data,1,tmp,pbm->fptr);
     if(tmp2 == tmp)
@@ -129,7 +130,8 @@
     return;
 
   pbm->unread = 1;
-  pbm->revdata = malloc ((pbm->width+7)/8);
+  overflow_add(pbm->width, 7);
+  pbm->revdata = malloc((pbm->width+7)/8);
   memcpy (pbm->revdata, data, (pbm->width+7)/8);
   pbm->current_line--;
 }
diff -urN netpbm-9.25.orig/pbm/pbmtoppa/pbmtoppa.c netpbm-9.25/pbm/pbmtoppa/pbmtoppa.c
--- netpbm-9.25.orig/pbm/pbmtoppa/pbmtoppa.c	2002-03-13 04:20:11.000000000 +0100
+++ netpbm-9.25/pbm/pbmtoppa/pbmtoppa.c	2004-05-12 11:52:28.443153608 +0200
@@ -471,6 +471,7 @@
     }
   }
 
+  overflow_add(Width, 7);
   Pwidth=(Width+7)/8;
   printer.fptr=out;
 
diff -urN netpbm-9.25.orig/pbm/pbmtox10bm.c netpbm-9.25/pbm/pbmtox10bm.c
--- netpbm-9.25.orig/pbm/pbmtox10bm.c	2000-06-09 09:07:01.000000000 +0200
+++ netpbm-9.25/pbm/pbmtox10bm.c	2004-05-12 11:52:28.438154368 +0200
@@ -57,6 +57,7 @@
     bitrow = pbm_allocrow( cols );
 
     /* Compute padding to round cols up to the nearest multiple of 16. */
+    overflow_add(cols, 15);
     padright = ( ( cols + 15 ) / 16 ) * 16 - cols;
 
     printf( "#define %s_width %d\n", name, cols );
diff -urN netpbm-9.25.orig/pbm/pbmtoxbm.c netpbm-9.25/pbm/pbmtoxbm.c
--- netpbm-9.25.orig/pbm/pbmtoxbm.c	2000-03-19 03:45:05.000000000 +0100
+++ netpbm-9.25/pbm/pbmtoxbm.c	2004-05-12 11:52:28.438154368 +0200
@@ -93,6 +93,8 @@
     bitrow = pbm_allocrow( cols );
     
     /* Compute padding to round cols up to the nearest multiple of 8. */
+
+    overflow_add(cols, 8);
     padright = ( ( cols + 7 ) / 8 ) * 8 - cols;
 
     printf( "#define %s_width %d\n", name, cols );
diff -urN netpbm-9.25.orig/pbm/pbmtoybm.c netpbm-9.25/pbm/pbmtoybm.c
--- netpbm-9.25.orig/pbm/pbmtoybm.c	1993-10-04 10:10:43.000000000 +0100
+++ netpbm-9.25/pbm/pbmtoybm.c	2004-05-12 11:52:28.436154672 +0200
@@ -45,6 +45,7 @@
     bitrow = pbm_allocrow( cols );
     
     /* Compute padding to round cols up to the nearest multiple of 16. */
+    overflow_add(cols, 16);
     padright = ( ( cols + 15 ) / 16 ) * 16 - cols;
 
     putinit( cols, rows );
diff -urN netpbm-9.25.orig/pbm/pbmtozinc.c netpbm-9.25/pbm/pbmtozinc.c
--- netpbm-9.25.orig/pbm/pbmtozinc.c	2000-06-09 09:07:21.000000000 +0200
+++ netpbm-9.25/pbm/pbmtozinc.c	2004-05-12 11:52:28.436154672 +0200
@@ -66,6 +66,7 @@
     bitrow = pbm_allocrow( cols );
 
     /* Compute padding to round cols up to the nearest multiple of 16. */
+    overflow_add(cols, 16);
     padright = ( ( cols + 15 ) / 16 ) * 16 - cols;
 
     printf( "USHORT %s[] = {\n",name);
diff -urN netpbm-9.25.orig/pbm/pm.h netpbm-9.25/pbm/pm.h
--- netpbm-9.25.orig/pbm/pm.h	2002-01-03 21:35:23.000000000 +0100
+++ netpbm-9.25/pbm/pm.h	2004-05-12 11:52:28.450152544 +0200
@@ -218,6 +218,12 @@
          enum pm_check_code * const retval_p);
 
 
+void *malloc2(int, int);
+void *malloc3(int, int, int);
+void overflow2(int, int);
+void overflow3(int, int, int);
+void overflow_add(int, int);
+
 /* By making this <> instead of "", we avoid making shhopt.h a dependency
    of every program in the package when we do make dep.
 */
diff -urN netpbm-9.25.orig/pbm/pm.h.orig netpbm-9.25/pbm/pm.h.orig
--- netpbm-9.25.orig/pbm/pm.h.orig	1970-01-01 01:00:00.000000000 +0100
+++ netpbm-9.25/pbm/pm.h.orig	2002-01-03 21:35:23.000000000 +0100
@@ -0,0 +1,243 @@
+/* pm.h - interface to format-independent part of libpbm.
+**
+** Copyright (C) 1988, 1989, 1991 by Jef Poskanzer.
+**
+** Permission to use, copy, modify, and distribute this software and its
+** documentation for any purpose and without fee is hereby granted, provided
+** that the above copyright notice appear in all copies and that both that
+** copyright notice and this permission notice appear in supporting
+** documentation.  This software is provided "as is" without express or
+** implied warranty.
+*/
+
+#ifndef _PM_H_
+#define _PM_H_
+
+#include "pm_config.h"
+
+#include <sys/types.h>
+#include <ctype.h>
+#include <stdio.h>
+#include <errno.h>
+#include <sys/stat.h>
+
+#ifdef VMS
+#include <perror.h>
+#endif
+
+/* NOTE: do not use "bool" as a type in an external interface.  It could
+   have different definitions on either side of the interface.  Even if both
+   sides include this interface header file, the conditional compilation
+   here means one side may use the typedef below and the other side may
+   use some other definition.  For an external interface, be safe and just
+   use "int".
+*/
+
+#ifndef TRUE
+#define TRUE 1
+#define FALSE 0
+/* C++ has a "bool" type built in. */
+#ifndef __cplusplus
+typedef int bool;
+#endif
+#elif defined(__DECC)
+/* Tru64 defines TRUE in standard header files, but not bool. 2001.09.21 */
+typedef int bool;
+#endif
+
+#undef max
+#define max(a,b) ((a) > (b) ? (a) : (b))
+#undef min
+#define min(a,b) ((a) < (b) ? (a) : (b))
+#undef abs
+#define abs(a) ((a) >= 0 ? (a) : -(a))
+#undef odd
+#define odd(n) ((n) & 1)
+
+
+/* Definitions to make Netpbm programs work with either ANSI C or C
+   Classic.
+
+   This is obsolete, as all compilers recognize the ANSI syntax now.
+
+   We are slowly removing all the ARGS invocations from the programs
+   (and replacing them with explicit ANSI syntax), but we have a lot
+   of programs where we have removed ARGS from the definition but not
+   the prototype, and we have discovered that the Sun compiler
+   considers the resulting mismatch between definition and prototype
+   to be an error.  So we make ARGS create the ANSI syntax
+   unconditionally to avoid having to fix all those mismatches.  */
+
+#if 0
+#if __STDC__
+#define ARGS(alist) alist
+#else /*__STDC__*/
+#define ARGS(alist) ()
+#define const
+#endif /*__STDC__*/
+#endif
+#define ARGS(alist) alist
+
+
+void 
+pm_init(const char * const progname, unsigned int const flags);
+
+void 
+pm_proginit(int* const argcP, char* argv[]);
+
+void
+pm_setMessage(int const newState, int * const oldStateP);
+
+void
+pm_nextimage(FILE * const file, int * const eofP);
+
+/* Variable-sized arrays definitions. */
+
+char** 
+pm_allocarray (int const cols, int const rows, int const size );
+
+char* 
+pm_allocrow (int const cols, int const size);
+
+void 
+pm_freearray (char** const its, int const rows);
+
+void 
+pm_freerow(char* const itrow);
+
+
+/* Obsolete -- use shhopt instead */
+int 
+pm_keymatch (char* const str, char* const keyword, int const minchars);
+
+
+int 
+pm_maxvaltobits (int const maxval);
+
+int 
+pm_bitstomaxval (int const bits);
+
+unsigned int 
+pm_lcm (const unsigned int x, 
+        const unsigned int y,
+        const unsigned int z,
+        const unsigned int limit);
+
+/* GNU_PRINTF_ATTR lets the GNU compiler check pm_message() and pm_error()
+   calls to be sure the arguments match the format string, thus preventing
+   runtime segmentation faults and incorrect messages.
+*/
+#ifdef __GNUC__
+#define GNU_PRINTF_ATTR __attribute__ ((format (printf, 1,2)))
+#else
+#define GNU_PRINTF_ATTR
+#endif
+
+void GNU_PRINTF_ATTR
+pm_message (const char format[], ...);     
+
+void GNU_PRINTF_ATTR
+pm_error (const char reason[], ...);       
+
+/* Obsolete - use helpful error message instead */
+void
+pm_perror (const char reason[]);           
+
+/* Obsolete - use shhopt and man page instead */
+void 
+pm_usage (const char usage[]);             
+
+FILE* 
+pm_openr (const char* const name);
+         
+FILE*    
+pm_openw (const char* const name);
+         
+FILE *
+pm_openr_seekable(const char name[]);
+
+void     
+pm_close (FILE* const f);
+
+void 
+pm_closer (FILE* const f);
+          
+void      
+pm_closew (FILE* const f);
+
+
+
+int
+pm_readbigshort ( FILE* const in, short* const sP );
+
+int
+pm_writebigshort ( FILE* const out, short const s );
+
+int
+pm_readbiglong ( FILE* const in, long* const lP );
+
+int
+pm_writebiglong ( FILE* const out, long const l );
+
+int
+pm_readlittleshort ( FILE* const in, short* const sP );
+
+int
+pm_writelittleshort ( FILE* const out, short const s );
+
+int
+pm_readlittlelong ( FILE* const in, long* const lP );
+
+int
+pm_writelittlelong ( FILE* const out, long const l );
+
+char* 
+pm_read_unknown_size(FILE* const file, long* const buf);
+
+unsigned int
+pm_tell(FILE * const fileP);
+
+void
+pm_seek(FILE * const fileP, unsigned long filepos);
+
+enum pm_check_code {
+    PM_CHECK_OK,
+    PM_CHECK_UNKNOWN_TYPE,
+    PM_CHECK_TOO_LONG,
+    PM_CHECK_UNCHECKABLE,
+    PM_CHECK_TOO_SHORT
+};
+
+enum pm_check_type {
+    PM_CHECK_BASIC
+};
+
+void
+pm_check(FILE * const file, const enum pm_check_type check_type, 
+         const unsigned int need_raster_size,
+         enum pm_check_code * const retval_p);
+
+
+/* By making this <> instead of "", we avoid making shhopt.h a dependency
+   of every program in the package when we do make dep.
+*/
+#include <shhopt.h>
+
+/* Use pm_optParseOptions instead of optParseOptions in order to use the
+   shared Netpbm libraries
+*/
+void 
+pm_optParseOptions(int * const argc, char *argv[],
+                   optStruct opt[], int const allowNegNum);
+void 
+pm_optParseOptions2(int * const argc, char *argv[],
+                    const optStruct2 opt, const unsigned long flags);
+void
+pm_optParseOptions3(int * const argc_p, char *argv[], const optStruct3 opt, 
+                 const unsigned int optStructSize, const unsigned long flags);
+
+char *
+pm_arg0toprogname(const char arg0[]);
+
+#endif
+
diff -urN netpbm-9.25.orig/pbm/thinkjettopbm.l netpbm-9.25/pbm/thinkjettopbm.l
--- netpbm-9.25.orig/pbm/thinkjettopbm.l	2002-03-13 04:06:09.000000000 +0100
+++ netpbm-9.25/pbm/thinkjettopbm.l	2004-05-12 11:52:28.450152544 +0200
@@ -74,7 +74,9 @@
 <RASTERMODE>\033\*b{DIG}+W  {
                             int l;
                             if (rowCount >= rowCapacity) {
+				overflow_add(rowCapacity, 100);
                                 rowCapacity += 100;
+				overflow2(rowCapacity, sizeof *rows);
                                 rows = realloc (rows, rowCapacity * sizeof *rows);
                                 if (rows == NULL)
                                     pm_error ("Out of memory.");
@@ -167,6 +169,8 @@
     /*
      * Quite simple since ThinkJet bit arrangement matches PBM
      */
+
+    overflow2(maxRowLength, 8);
     pbm_writepbminit(stdout, maxRowLength*8, rowCount, 0);
 
     packed_bitrow = malloc(maxRowLength);
diff -urN netpbm-9.25.orig/pbm/ybmtopbm.c netpbm-9.25/pbm/ybmtopbm.c
--- netpbm-9.25.orig/pbm/ybmtopbm.c	1993-10-04 10:10:35.000000000 +0100
+++ netpbm-9.25/pbm/ybmtopbm.c	2004-05-12 11:52:28.433155128 +0200
@@ -88,6 +88,7 @@
 	pm_error( "EOF / read error" );
 
     *depthP = 1;
+    overflow_add(*colsP, 15);
     *padrightP = ( ( *colsP + 15 ) / 16 ) * 16 - *colsP;
     bitsperitem = 0;
     }
diff -urN netpbm-9.25.orig/pgm/lispmtopgm.c netpbm-9.25/pgm/lispmtopgm.c
--- netpbm-9.25.orig/pgm/lispmtopgm.c	2002-01-04 18:11:11.000000000 +0100
+++ netpbm-9.25/pgm/lispmtopgm.c	2004-05-12 11:52:28.454151936 +0200
@@ -55,6 +55,7 @@
         pm_error( "depth (%d bits) is too large", depth);
 
     pgm_writepgminit( stdout, cols, rows, (gray) maxval, 0 );
+    overflow_add(cols, 7);
     grayrow = pgm_allocrow( ( cols + 7 ) / 8 * 8 );
 
     for ( row = 0; row < rows; ++row )
@@ -100,6 +101,8 @@
     if ( *depthP == 0 )
 	*depthP = 1;	/* very old file */
     
+    overflow_add(colsP, 31);
+
     *padrightP = ( ( *colsP + 31 ) / 32 ) * 32 - *colsP;
     
     if ( *colsP != (cols_32 - *padrightP) ) {
diff -urN netpbm-9.25.orig/pgm/pbmtopgm.c netpbm-9.25/pgm/pbmtopgm.c
--- netpbm-9.25.orig/pgm/pbmtopgm.c	1993-10-06 14:24:38.000000000 +0100
+++ netpbm-9.25/pgm/pbmtopgm.c	2004-05-12 11:52:28.454151936 +0200
@@ -42,6 +42,7 @@
       pm_error("sample size greater than bitmap size");
 
    outrow = pgm_allocrow(cols) ;
+   overflow2(width, height);
    maxval = width*height;
    pgm_writepgminit(stdout, cols, rows, maxval, 0) ;
 
diff -urN netpbm-9.25.orig/pgm/pgmcrater.c netpbm-9.25/pgm/pgmcrater.c
--- netpbm-9.25.orig/pgm/pgmcrater.c	2001-06-26 05:18:48.000000000 +0200
+++ netpbm-9.25/pgm/pgmcrater.c	2004-05-12 11:52:28.457151480 +0200
@@ -131,7 +131,7 @@
     /* Acquire the elevation array and initialise it to mean
        surface elevation. */
 
-    aux = (unsigned short *) malloc(SCRX * SCRY * sizeof(short));
+    aux = (unsigned short *) malloc3(SCRX, SCRY, sizeof(short));
     if (aux == (unsigned short *) 0) {
         pm_error("out of memory allocating elevation array");
     }
@@ -258,7 +258,7 @@
     }
 
     i = max((slopemax - slopemin) + 1, 1);
-    slopemap = (unsigned char *) malloc(i * sizeof(unsigned char));
+    slopemap = (unsigned char *) malloc2(i, sizeof(unsigned char));
     if (slopemap == (unsigned char *) 0) {
         pm_error("out of memory allocating slope map");
     }
diff -urN netpbm-9.25.orig/pgm/pgmhist.c netpbm-9.25/pgm/pgmhist.c
--- netpbm-9.25.orig/pgm/pgmhist.c	1993-10-04 10:11:17.000000000 +0100
+++ netpbm-9.25/pgm/pgmhist.c	2004-05-12 11:52:28.457151480 +0200
@@ -45,8 +45,9 @@
     grayrow = pgm_allocrow( cols );
 
     /* Build histogram. */
-    hist = (int *) malloc( ( maxval + 1 ) * sizeof(int) );
-    rcount = (int *) malloc( ( maxval + 1 ) * sizeof(int) );
+    overflow_add(maxval, 1);
+    hist = (int *) malloc2( ( maxval + 1 ),  sizeof(int) );
+    rcount = (int *) malloc2( ( maxval + 1 ), sizeof(int) );
     if ( hist == (int *) 0 || rcount == (int *) 0 )
 	pm_error( "out of memory" );
     for ( i = 0; i <= maxval; i++ )
diff -urN netpbm-9.25.orig/pgm/pgmkernel.c netpbm-9.25/pgm/pgmkernel.c
--- netpbm-9.25.orig/pgm/pgmkernel.c	2000-03-03 04:20:34.000000000 +0100
+++ netpbm-9.25/pgm/pgmkernel.c	2004-05-12 11:52:28.459151176 +0200
@@ -67,7 +67,7 @@
     kycenter = (fysize - 1) / 2.0;
     ixsize = fxsize + 0.999;
     iysize = fysize + 0.999;
-    fkernel = (double *) malloc ((unsigned)(ixsize*iysize*sizeof(double)));
+    fkernel = (double *) malloc3 (ixsize, iysize, sizeof(double));
     for (i = 0; i < iysize; i++) 
 	for (j = 0; j < ixsize; j++) {
 	    fkernel[i*ixsize+j] = 1.0 / (1.0 + w * sqrt((double)
diff -urN netpbm-9.25.orig/pgm/pgmtexture.c netpbm-9.25/pgm/pgmtexture.c
--- netpbm-9.25.orig/pgm/pgmtexture.c	2001-03-30 19:01:00.000000000 +0200
+++ netpbm-9.25/pgm/pgmtexture.c	2004-05-12 11:52:28.458151328 +0200
@@ -722,8 +722,10 @@
 float *vector (int nl, int nh)
 {
   float *v;
-
-  v = (float *) malloc ((unsigned) (nh - nl + 1) * sizeof (float));
+  overflow_add(nh, 1);
+  if(nh < nl)
+  	pm_error("assert: h < l");
+  v = (float *) malloc2 ((nh - nl + 1), sizeof (float));
   if (!v)
     fprintf (stderr, "memory allocation failure"), exit (1);
   return v - nl;
@@ -738,15 +740,21 @@
   float **m;
 
   /* allocate pointers to rows */
-  m = (float **) malloc ((unsigned) (nrh - nrl + 1) * sizeof (float *));
+  overflow_add(nrh, 1);
+  if(nrh < nrl)
+  	pm_error("assert: nrh < nrl");
+  m = (float **) malloc2(nrh - nrl + 1, sizeof (float *));
   if (!m)
     fprintf (stderr, "memory allocation failure"), exit (1);
   m -= ncl;
 
+  if(nch < ncl)
+  	pm_error("assert: nch < ncl");
+  overflow_add(nch, 1);
   /* allocate rows and set pointers to them */
   for (i = nrl; i <= nrh; i++)
   {
-    m[i] = (float *) malloc ((unsigned) (nch - ncl + 1) * sizeof (float));
+    m[i] = (float *) malloc2(nch - ncl + 1, sizeof (float));
     if (!m[i])
       fprintf (stderr, "memory allocation failure"), exit (2);
     m[i] -= ncl;
diff -urN netpbm-9.25.orig/pgm/pgmtopbm.c netpbm-9.25/pgm/pgmtopbm.c
--- netpbm-9.25.orig/pgm/pgmtopbm.c	2001-09-03 20:11:42.000000000 +0200
+++ netpbm-9.25/pgm/pgmtopbm.c	2004-05-12 11:52:28.453152088 +0200
@@ -129,6 +129,7 @@
 	{
 	case QT_FS:
 	    /* Initialize Floyd-Steinberg error vectors. */
+	    overflow_add(cols, 2);
 	    thiserr = (long*) pm_allocrow( cols + 2, sizeof(long) );
 	    nexterr = (long*) pm_allocrow( cols + 2, sizeof(long) );
 	    srand( (int) ( time( 0 ) ^ getpid( ) ) );
diff -urN netpbm-9.25.orig/pgm/psidtopgm.c netpbm-9.25/pgm/psidtopgm.c
--- netpbm-9.25.orig/pgm/psidtopgm.c	2002-01-04 18:11:10.000000000 +0100
+++ netpbm-9.25/pgm/psidtopgm.c	2004-05-12 11:52:28.458151328 +0200
@@ -60,6 +60,7 @@
 	    "bits/sample (%d) is too large.", bitspersample );
 
     pgm_writepgminit( stdout, cols, rows, (gray) maxval, 0 );
+    overflow_add(cols, 7);
     grayrow = pgm_allocrow( ( cols + 7 ) / 8 * 8 );
     for ( row = 0; row < rows; ++row)
 	{
diff -urN netpbm-9.25.orig/pnm/anytopnm netpbm-9.25/pnm/anytopnm
--- netpbm-9.25.orig/pnm/anytopnm	2000-07-26 03:54:08.000000000 +0200
+++ netpbm-9.25/pnm/anytopnm	2004-05-12 11:52:28.497145400 +0200
@@ -21,7 +21,7 @@
     exit 1
 fi
 
-tmpfiles=""
+tmpdir=$(mktemp -d -t anytopnm.XXXXXXXXXX) || exit 1 #219019
 
 # Take out all spaces
 # Find the filename extension for last-ditch efforts later
@@ -29,8 +29,9 @@
 
 # Sanitize the filename by making our own temporary files as safely as
 # possible.
-file="/tmp/atn.stdin.$$"
-rm -f "$file"
+# file="/tmp/atn.stdin.$$"
+#rm -f "$file"
+file="$tmpdir/atn.stdin"
 if [ $# -eq 0 -o "$1" = "-" ] ; then
 	cat > "$file"
 else
@@ -57,9 +58,6 @@
     cat < "$1" > "$file"
 fi
 
-tmpfiles="$tmpfiles $file"
-
-
 
 filetype=`file "$file" | cut -d: -f2-`
 
@@ -70,7 +68,8 @@
     ;;
 
     *uuencoded* )
-    newfile="/tmp/atn.decode.$$"
+#    newfile="/tmp/atn.decode.$$"
+    newfile="$tmpdir/atn.decode"
     rm -f "$newfile"
     (echo begin 600 $newfile; tail +2 < "$file") | uudecode
     tmpfiles="$tmpfiles $newfile"
@@ -258,7 +257,7 @@
 esac
 
 
-if [ "$tmpfiles" ] ; then
-    rm -f $tmpfiles
+if [ "$tmpdir" ] ; then
+    rm -rf "$tmpdir"
 fi
 exit 0
diff -urN netpbm-9.25.orig/pnm/gemtopnm.c netpbm-9.25/pnm/gemtopnm.c
--- netpbm-9.25.orig/pnm/gemtopnm.c	2000-04-30 14:42:15.000000000 +0200
+++ netpbm-9.25/pnm/gemtopnm.c	2004-05-12 11:52:28.469149656 +0200
@@ -106,6 +106,7 @@
 
 	pnm_writepnminit( stdout, cols, rows, MAXVAL, type, 0 );
 
+    overflow_add(cols, padright);
     { 
         /* allocate input row data structure */
         int plane;
diff -urN netpbm-9.25.orig/pnm/jpegtopnm.c netpbm-9.25/pnm/jpegtopnm.c
--- netpbm-9.25.orig/pnm/jpegtopnm.c	2002-03-13 04:53:22.000000000 +0100
+++ netpbm-9.25/pnm/jpegtopnm.c	2004-05-12 11:52:28.485147224 +0200
@@ -173,7 +173,7 @@
     unsigned int option_def_index;
 
     int argc_parse;       /* argc, except we modify it as we parse */
-    char ** const argv_parse = malloc(argc*sizeof(char *));
+    char ** const argv_parse = malloc2(argc, sizeof(char *));
     /* argv, except we modify it as we parse */
 
     option_def_index = 0;   /* incremented by OPTENTRY */
@@ -846,6 +846,8 @@
   /* Calculate output image dimensions so we can allocate space */
   jpeg_calc_output_dimensions(&cinfo);
 
+  overflow2(cinfo.output_width, cinfo.output_components);
+
   jpegbuffer = ((*cinfo.mem->alloc_sarray)
                 ((j_common_ptr) &cinfo, JPOOL_IMAGE,
                  cinfo.output_width * cinfo.output_components, (JDIMENSION) 1)
diff -urN netpbm-9.25.orig/pnm/libpam.c netpbm-9.25/pnm/libpam.c
--- netpbm-9.25.orig/pnm/libpam.c	2002-03-06 04:39:37.000000000 +0100
+++ netpbm-9.25/pnm/libpam.c	2004-05-12 11:53:57.752576512 +0200
@@ -155,7 +155,8 @@
         themselves.  Each tuple consists of 'depth' samples.  
     */
 
-    tuplerow = malloc(pamP->width * (sizeof(tuple *) + bytes_per_tuple));
+    overflow_add(sizeof(tuple *), bytes_per_tuple);
+    tuplerow = malloc2(pamP->width, sizeof(tuple *) + bytes_per_tuple);
     if (tuplerow == NULL)
         pm_error("Out of memory allocating space for a tuple row of\n"
                  "%d tuples by %d samples per tuple by %d bytes per sample.",
@@ -190,7 +191,7 @@
        by allocating one large chunk.
        */
     
-    tuplearray = malloc(pamP->height * sizeof(tuple*));
+    tuplearray = malloc2(pamP->height, sizeof(tuple*));
     if (tuplearray == NULL) 
         pm_error("Out of memory allocating the row pointer section of "
                  "a %u row array", pamP->height);
diff -urN netpbm-9.25.orig/pnm/libpnm4.c netpbm-9.25/pnm/libpnm4.c
--- netpbm-9.25.orig/pnm/libpnm4.c	1993-10-04 10:11:33.000000000 +0100
+++ netpbm-9.25/pnm/libpnm4.c	2004-05-12 11:52:28.464150416 +0200
@@ -43,11 +43,16 @@
     ** not to be the case.  In reality, all of Sun's code rounds up to
     ** a short, not a long.
     */
+
+    overflow_add(depth,15);
+    overflow2(w, depth+15);
+    overflow2(w * depth + 15, 2);
+
     m->md_linebytes = ( w * depth + 15 ) / 16 * 2;
     m->md_offset.x = 0;
     m->md_offset.y = 0;
     m->md_flags = 0;
-    m->md_image = (unsigned char*) malloc( m->md_linebytes * h );
+    m->md_image = (unsigned char*) malloc2( m->md_linebytes,  h );
     if ( m->md_image == NULL )
 	{
 	free( m );
@@ -104,12 +109,15 @@
 	case RT_STANDARD:
 	case RT_FORMAT_RGB:
 	/* Ignore hP->ras_length. */
+	overflow2(p->pr_size.y, p->pr_data->md_linebytes);
 	h.ras_length = p->pr_size.y * p->pr_data->md_linebytes;
 	break;
 
 	case RT_BYTE_ENCODED:
+	overflow2(p->pr_size.y, p->pr_data->md_linebytes);
 	size = p->pr_size.y * p->pr_data->md_linebytes;
 	bp = p->pr_data->md_image;
+	overflow2(size, 3);
 	beimage = (unsigned char*) malloc( size * 3 / 2 );	/* worst case */
 	if ( beimage == NULL )
 	    return PIX_ERR;
@@ -191,6 +199,7 @@
 	    {
 	    case RMT_EQUAL_RGB:
 	    h.ras_maplength = colormap->length * 3;
+	    overflow2(colormap->length, 3);
 	    break;
 
 	    case RMT_RAW:
@@ -395,6 +404,7 @@
 	case RT_FORMAT_RGB:
 	/* Ignore hP->ras_length. */
 	i = p->pr_size.y * p->pr_data->md_linebytes;
+	overflow2(p->pr_size.y, p->pr_data->md_linebytes);
 	if ( fread( p->pr_data->md_image, 1, i, in ) != i )
 	    {
 	    mem_free( p );
diff -urN netpbm-9.25.orig/pnm/pamcut.c netpbm-9.25/pnm/pamcut.c
--- netpbm-9.25.orig/pnm/pamcut.c	2001-11-12 06:11:27.000000000 +0100
+++ netpbm-9.25/pnm/pamcut.c	2004-05-12 11:53:57.753576360 +0200
@@ -380,6 +380,8 @@
     outpam.width = rightcol-leftcol+1;
     outpam.height = bottomrow-toprow+1;
 
+    overflow_add(rightcol, 1);
+    overflow_add(toprow, 1);
     pnm_writepaminit(&outpam);
 
     outputRow = pnm_allocpamrow(&outpam);
diff -urN netpbm-9.25.orig/pnm/pamoil.c netpbm-9.25/pnm/pamoil.c
--- netpbm-9.25.orig/pnm/pamoil.c	2001-06-29 08:13:03.000000000 +0200
+++ netpbm-9.25/pnm/pamoil.c	2004-05-12 11:53:57.758575600 +0200
@@ -112,7 +112,8 @@
     tuples = pnm_readpam(ifp, &inpam, sizeof(inpam));
     pm_close(ifp);
 
-    hist = malloc((inpam.maxval + 1) * sizeof(sample));
+    overflow_add(inpam.maxval, 1);
+    hist = malloc2((inpam.maxval + 1), sizeof(sample));
 
     outpam = inpam; outpam.file = stdout;
 
diff -urN netpbm-9.25.orig/pnm/pngtopnm.c netpbm-9.25/pnm/pngtopnm.c
--- netpbm-9.25.orig/pnm/pngtopnm.c	2002-01-04 18:22:43.000000000 +0100
+++ netpbm-9.25/pnm/pngtopnm.c	2004-05-12 11:52:28.460151024 +0200
@@ -371,18 +371,30 @@
   }
 
   if (info_ptr->bit_depth == 16)
+  {
+    overflow2(2, info_ptr->width);
     linesize = 2 * info_ptr->width;
+  }
   else
     linesize = info_ptr->width;
 
   if (info_ptr->color_type == PNG_COLOR_TYPE_GRAY_ALPHA)
+  {
     linesize *= 2;
+    overflow2(2, linesize);
+  }
   else
   if (info_ptr->color_type == PNG_COLOR_TYPE_RGB)
+  {
+    overflow2(3, linesize);
     linesize *= 3;
+  }
   else
   if (info_ptr->color_type == PNG_COLOR_TYPE_RGB_ALPHA)
+  {
+    overflow2(4, linesize);
     linesize *= 4;
+  }
 
   for (y = 0 ; y < info_ptr->height ; y++) {
     png_image[y] = malloc (linesize);
diff -urN netpbm-9.25.orig/pnm/pnmcat.c netpbm-9.25/pnm/pnmcat.c
--- netpbm-9.25.orig/pnm/pnmcat.c	1993-10-04 10:11:35.000000000 +0100
+++ netpbm-9.25/pnm/pnmcat.c	2004-05-12 11:52:28.464150416 +0200
@@ -83,13 +83,13 @@
 	nfiles = argc - argn;
     else
 	nfiles = 1;
-    ifp = (FILE**) malloc( nfiles * sizeof(FILE*) );
-    xelrow = (xel**) malloc( nfiles * sizeof(xel*) );
-    background = (xel*) malloc( nfiles * sizeof(xel) );
-    maxval = (xelval*) malloc( nfiles * sizeof(xelval) );
-    rows = (int*) malloc( nfiles * sizeof(int) );
-    cols = (int*) malloc( nfiles * sizeof(int) );
-    format = (int*) malloc( nfiles * sizeof(int) );
+    ifp = (FILE**) malloc2( nfiles, sizeof(FILE*) );
+    xelrow = (xel**) malloc2( nfiles, sizeof(xel*) );
+    background = (xel*) malloc2( nfiles, sizeof(xel) );
+    maxval = (xelval*) malloc2( nfiles, sizeof(xelval) );
+    rows = (int*) malloc2( nfiles, sizeof(int) );
+    cols = (int*) malloc2( nfiles, sizeof(int) );
+    format = (int*) malloc2( nfiles, sizeof(int) );
     if ( ifp == (FILE**) 0 || xelrow == (xel**) 0 || background == (xel*) 0 ||
 	 maxval == (xelval*) 0 || rows == (int*) 0 || cols == (int*) 0 ||
 	 format == (int*) 0 )
diff -urN netpbm-9.25.orig/pnm/pnmcrop.c netpbm-9.25/pnm/pnmcrop.c
--- netpbm-9.25.orig/pnm/pnmcrop.c	2001-05-20 09:24:08.000000000 +0200
+++ netpbm-9.25/pnm/pnmcrop.c	2004-05-12 11:52:28.463150568 +0200
@@ -378,6 +378,8 @@
 
         xelrow = pnm_allocrow(cols);
 
+	overflow_add(right, 1);
+	overflow_add(bottom, 1);
         newcols = right - left + 1;
         newrows = bottom - top + 1;
         pnm_writepnminit(stdout, newcols, newrows, maxval, format, 0);
diff -urN netpbm-9.25.orig/pnm/pnmcut.c netpbm-9.25/pnm/pnmcut.c
--- netpbm-9.25.orig/pnm/pnmcut.c	2001-11-05 05:23:49.000000000 +0100
+++ netpbm-9.25/pnm/pnmcut.c	2004-05-12 11:52:28.467149960 +0200
@@ -372,6 +372,7 @@
                    toprow, leftcol, bottomrow, rightcol);
     }
 
+    overflow_add(rightcol, 1);
     output_cols = rightcol-leftcol+1;
     output_row = pnm_allocrow(output_cols);
     
diff -urN netpbm-9.25.orig/pnm/pnmenlarge.c netpbm-9.25/pnm/pnmenlarge.c
--- netpbm-9.25.orig/pnm/pnmenlarge.c	1993-10-04 10:11:39.000000000 +0100
+++ netpbm-9.25/pnm/pnmenlarge.c	2004-05-12 11:52:28.468149808 +0200
@@ -52,6 +52,9 @@
 
     pnm_readpnminit( ifp, &cols, &rows, &maxval, &format );
     xelrow = pnm_allocrow( cols );
+
+    overflow2(cols, n);
+    overflow2(rows, n);
     pnm_writepnminit( stdout, cols * n, rows * n, maxval, format, 0 );
     newxelrow = pnm_allocrow( cols * n );
 
diff -urN netpbm-9.25.orig/pnm/pnmflip.c netpbm-9.25/pnm/pnmflip.c
--- netpbm-9.25.orig/pnm/pnmflip.c	2001-09-07 17:49:30.000000000 +0200
+++ netpbm-9.25/pnm/pnmflip.c	2004-05-12 11:52:28.470149504 +0200
@@ -289,6 +289,13 @@
     
     pnm_readpnminit( ifp, &cols, &rows, &maxval, &format );
 
+    overflow2(abs(xform.a), cols);
+    overflow2(abs(xform.b), cols);
+    overflow2(abs(xform.c), rows);
+    overflow2(abs(xform.d), rows);
+    overflow_add(abs( xform.a ) * cols, abs( xform.c ) * rows);
+    overflow_add(abs( xform.b ) * cols, abs( xform.d ) * rows);
+
     newcols = abs( xform.a ) * cols + abs( xform.c ) * rows;
     newrows = abs( xform.b ) * cols + abs( xform.d ) * rows;
     
diff -urN netpbm-9.25.orig/pnm/pnmgamma.c netpbm-9.25/pnm/pnmgamma.c
--- netpbm-9.25.orig/pnm/pnmgamma.c	2002-03-13 04:53:23.000000000 +0100
+++ netpbm-9.25/pnm/pnmgamma.c	2004-05-12 11:52:28.472149200 +0200
@@ -271,9 +271,11 @@
                   xelval **rtableP, xelval **gtableP, xelval **btableP) {
 
     /* Allocate space for the tables. */
-    *rtableP = (xelval*) malloc( (maxval+1) * sizeof(xelval) );
-    *gtableP = (xelval*) malloc( (maxval+1) * sizeof(xelval) );
-    *btableP = (xelval*) malloc( (maxval+1) * sizeof(xelval) );
+
+    overflow_add(maxval, 1);
+    *rtableP = (xelval*) malloc2( (maxval+1) , sizeof(xelval) );
+    *gtableP = (xelval*) malloc2( (maxval+1) , sizeof(xelval) );
+    *btableP = (xelval*) malloc2( (maxval+1) , sizeof(xelval) );
     if (*rtableP == NULL || *gtableP == NULL || *btableP == NULL)
         pm_error( "out of memory" );
 
diff -urN netpbm-9.25.orig/pnm/pnmhisteq.c netpbm-9.25/pnm/pnmhisteq.c
--- netpbm-9.25.orig/pnm/pnmhisteq.c	2000-06-09 09:51:45.000000000 +0200
+++ netpbm-9.25/pnm/pnmhisteq.c	2004-05-12 11:52:28.493146008 +0200
@@ -210,6 +210,7 @@
        user has specified an input map file, read it in at
        this point. */
 
+    overflow_add(maxval, 1);
     lumahist = (long *) pm_allocrow(maxval + 1, sizeof(long));
     memset((char *) lumahist, 0, (maxval + 1) * sizeof(long));
 
diff -urN netpbm-9.25.orig/pnm/pnmindex netpbm-9.25/pnm/pnmindex
--- netpbm-9.25.orig/pnm/pnmindex	2001-08-30 04:21:14.000000000 +0200
+++ netpbm-9.25/pnm/pnmindex	2004-05-12 11:52:28.497145400 +0200
@@ -94,8 +94,9 @@
 fi
 
 #tmpfile=`tempfile -p pi -m 600`
-tmpfile=$TMPDIR/pi.tmp.$$
-rm -f $tmpfile
+#tmpfile=$TMPDIR/pi.tmp.$$
+#rm -f $tmpfile
+tmpfile=$(mktemp -t pi.XXXXXXXX) || exit 1 #219019
 maxformat=PBM
 
 rowfiles=()
diff -urN netpbm-9.25.orig/pnm/pnmmargin netpbm-9.25/pnm/pnmmargin
--- netpbm-9.25.orig/pnm/pnmmargin	1993-10-04 10:11:44.000000000 +0100
+++ netpbm-9.25/pnm/pnmmargin	2004-05-12 11:52:28.498145248 +0200
@@ -11,11 +11,16 @@
 # documentation.  This software is provided "as is" without express or
 # implied warranty.
 
-tmp1=/tmp/pnmm1$$
-tmp2=/tmp/pnmm2$$
-tmp3=/tmp/pnmm3$$
-tmp4=/tmp/pnmm4$$
-rm -f $tmp1 $tmp2 $tmp3 $tmp4
+#tmp1=.tmppnmm1$$
+#tmp2=.tmppnmm2$$
+#tmp3=.tmppnmm3$$
+#tmp4=.tmppnmm4$$
+#rm -f $tmp1 $tmp2 $tmp3 $tmp4
+tmpdir=$(mktemp -d -t ppmmargin.XXXXXXX) || exit 1 #219019
+tmp1=$tmpdir/tmp1
+tmp2=$tmpdir/tmp2
+tmp3=$tmpdir/tmp3
+tmp4=$tmpdir/tmp4
 
 color="-gofigure"
 
@@ -83,4 +88,4 @@
 pnmcat -tb $tmp3 $tmp4 $tmp3
 
 # All done.
-rm -f $tmp1 $tmp2 $tmp3 $tmp4
+rm -rf $tmpdir
diff -urN netpbm-9.25.orig/pnm/pnmmontage.c netpbm-9.25/pnm/pnmmontage.c
--- netpbm-9.25.orig/pnm/pnmmontage.c	2001-01-01 20:59:04.000000000 +0100
+++ netpbm-9.25/pnm/pnmmontage.c	2004-05-12 11:53:57.755576056 +0200
@@ -229,9 +229,9 @@
   else
     nfiles = 1;
 
-  imgs = (struct pam*)malloc(nfiles * sizeof(struct pam));
-  coords = (coord *)malloc(nfiles * sizeof(coord));
-  names = (char **)malloc(nfiles * sizeof(char *));
+  imgs = (struct pam*)malloc2(nfiles, sizeof(struct pam));
+  coords = (coord *)malloc2(nfiles, sizeof(coord));
+  names = (char **)malloc2(nfiles, sizeof(char *));
   if (!imgs || !coords || !names)
     pm_error("out of memory");
 
diff -urN netpbm-9.25.orig/pnm/pnmpaste.c netpbm-9.25/pnm/pnmpaste.c
--- netpbm-9.25.orig/pnm/pnmpaste.c	1993-10-04 10:11:53.000000000 +0100
+++ netpbm-9.25/pnm/pnmpaste.c	2004-05-12 11:52:28.486147072 +0200
@@ -100,11 +100,16 @@
 	    "y is too large -- the second anymap has only %d rows",
 	    rows2 );
 
+    overflow_add(x, cols2);
+    overflow_add(y, rows2);
     if ( x < 0 )
 	x += cols2;
     if ( y < 0 )
 	y += rows2;
 
+    overflow_add(x, cols1);
+    overflow_add(y, rows1);
+
     if ( x + cols1 > cols2 )
 	pm_error( "x + width is too large by %d pixels", x + cols1 - cols2 );
     if ( y + rows1 > rows2 )
diff -urN netpbm-9.25.orig/pnm/pnmrotate.c netpbm-9.25/pnm/pnmrotate.c
--- netpbm-9.25.orig/pnm/pnmrotate.c	2001-06-25 05:34:52.000000000 +0200
+++ netpbm-9.25/pnm/pnmrotate.c	2004-05-12 11:52:28.487146920 +0200
@@ -11,6 +11,7 @@
 */
 
 #include <math.h>
+#include <limits.h>
 #include "pnm.h"
 #ifndef M_PI
 #define M_PI    3.14159265358979323846
@@ -93,11 +94,18 @@
         newmaxval = maxval;
     }
 
+    overflow2(rows, xshearfac);
+    overflow_add(cols, 1);
+    overflow_add(rows * xshearfac, cols);
+
     tempcols = rows * xshearfac + cols + 0.999999;
     yshearjunk = ( tempcols - cols ) * yshearfac;
     newrows = tempcols * yshearfac + rows + 0.999999;
     x2shearjunk = ( newrows - rows - yshearjunk ) * xshearfac;
     newrows -= 2 * yshearjunk;
+
+    if(newrows * xshearfac + tempcols + 0.999999 - 2 * x2shearjunk > INT_MAX)
+    	pm_error("image too large");
     newcols = newrows * xshearfac + tempcols + 0.999999 - 2 * x2shearjunk;
 
     bgxel = pnm_backgroundxelrow( xelrow, cols, newmaxval, format );
diff -urN netpbm-9.25.orig/pnm/pnmscalefixed.c netpbm-9.25/pnm/pnmscalefixed.c
--- netpbm-9.25.orig/pnm/pnmscalefixed.c	2002-01-04 18:22:44.000000000 +0100
+++ netpbm-9.25/pnm/pnmscalefixed.c	2004-05-12 11:53:57.756575904 +0200
@@ -208,6 +208,8 @@
                           const int rows, const int cols,
                           int * newrowsP, int * newcolsP) {
 
+    overflow2(rows, cols);
+
     if (cmdline.pixels) {
         if (rows * cols <= cmdline.pixels) {
             *newrowsP = rows;
@@ -259,6 +261,8 @@
 
     if (*newcolsP < 1) *newcolsP = 1;
     if (*newrowsP < 1) *newrowsP = 1;
+
+    overflow2(*newcolsP, *newrowsP);
 }        
 
 
@@ -440,6 +444,9 @@
        unfilled.  We can address that by stretching, whereas the other
        case would require throwing away some of the input.
     */
+
+    overflow2(newcols, SCALE);
+    overflow2(newrows, SCALE);
     sxscale = SCALE * newcols / cols;
     syscale = SCALE * newrows / rows;
 
diff -urN netpbm-9.25.orig/pnm/pnmshear.c netpbm-9.25/pnm/pnmshear.c
--- netpbm-9.25.orig/pnm/pnmshear.c	2001-06-26 06:43:02.000000000 +0200
+++ netpbm-9.25/pnm/pnmshear.c	2004-05-12 11:52:28.487146920 +0200
@@ -11,6 +11,7 @@
 */
 
 #include <math.h>
+#include <limits.h>
 #include "pnm.h"
 #ifndef M_PI
 #define M_PI    3.14159265358979323846
@@ -194,6 +195,11 @@
     if ( shearfac < 0.0 )
         shearfac = -shearfac;
 
+    if(rows * shearfac >= INT_MAX-1)
+    	pm_error("image too large");
+
+    overflow_add(rows * shearfac, cols+1);
+
     newcols = rows * shearfac + cols + 0.999999;
 
     pnm_writepnminit( stdout, newcols, rows, newmaxval, newformat, 0 );
diff -urN netpbm-9.25.orig/pnm/pnmsplit.c netpbm-9.25/pnm/pnmsplit.c
--- netpbm-9.25.orig/pnm/pnmsplit.c	2001-09-07 17:49:44.000000000 +0200
+++ netpbm-9.25/pnm/pnmsplit.c	2004-05-12 11:52:28.496145552 +0200
@@ -120,6 +120,7 @@
     *(strstr(before_sub, "%d")) = '\0';
     after_sub = strstr(output_file_pattern, "%d") + 2;
 
+    overflow_add(strlen(output_file_pattern), 9);
     size = strlen(output_file_pattern) - 2 + 10 + 1;
     *output_name_p = malloc(size);
 
diff -urN netpbm-9.25.orig/pnm/pnmtoddif.c netpbm-9.25/pnm/pnmtoddif.c
--- netpbm-9.25.orig/pnm/pnmtoddif.c	2000-05-06 08:30:12.000000000 +0200
+++ netpbm-9.25/pnm/pnmtoddif.c	2004-05-12 11:52:28.493146008 +0200
@@ -477,6 +477,7 @@
   switch (PNM_FORMAT_TYPE(format)) {
   case PBM_TYPE:
      ip.bits_per_pixel = 1;
+     overflow_add(cols, 7);
      ip.bytes_per_line = (cols + 7) / 8;
      ip.spectral = 2;
      ip.components = 1;
@@ -492,6 +493,7 @@
      ip.polarity = 2;
     break;
   case PPM_TYPE:
+     overflow2(cols, 3);
      ip.bytes_per_line = 3 * cols;
      ip.bits_per_pixel = 24;
      ip.spectral = 5;
diff -urN netpbm-9.25.orig/pnm/pnmtojpeg.c netpbm-9.25/pnm/pnmtojpeg.c
--- netpbm-9.25.orig/pnm/pnmtojpeg.c	2001-09-20 19:57:40.000000000 +0200
+++ netpbm-9.25/pnm/pnmtojpeg.c	2004-05-12 11:53:57.759575448 +0200
@@ -149,7 +149,7 @@
     unsigned int option_def_index;
 
     int argc_parse;       /* argc, except we modify it as we parse */
-    char ** const argv_parse = malloc(argc*sizeof(char *));
+    char ** const argv_parse = malloc2(argc,sizeof(char *));
     /* argv, except we modify it as we parse */
 
     option_def_index = 0;   /* incremented by OPTENTRY */
@@ -543,6 +543,8 @@
   const long half_maxval = maxval / 2;
   long val;
 
+  overflow_add(maxval, 1);
+  overflow2(maxval+1, sizeof(JSAMPLE));
   *rescale_p = (JSAMPLE *)
     (cinfo.mem->alloc_small) ((j_common_ptr) &cinfo, JPOOL_IMAGE,
                               (size_t) (((long) maxval + 1L) * 
@@ -619,6 +621,7 @@
     */
 
   /* Allocate the libpnm output and compressor input buffers */
+  overflow2(cinfo_p->image_width, cinfo_p->input_components);
   buffer = (*cinfo_p->mem->alloc_sarray)
     ((j_common_ptr) cinfo_p, JPOOL_IMAGE,
      (unsigned int) cinfo_p->image_width * cinfo_p->input_components, 
@@ -886,7 +889,9 @@
          * want JPOOL_PERMANENT.  
          */
         const unsigned int scan_info_size = nscans * sizeof(jpeg_scan_info);
-        jpeg_scan_info *scan_info = 
+        jpeg_scan_info *scan_info;
+	overflow2(nscans, sizeof(jpeg_scan_info));
+	scan_info =
             (jpeg_scan_info *)
             (*cinfo->mem->alloc_small) ((j_common_ptr) cinfo, JPOOL_IMAGE,
                                         scan_info_size);
diff -urN netpbm-9.25.orig/pnm/pnmtopalm/palmcolormap.c netpbm-9.25/pnm/pnmtopalm/palmcolormap.c
--- netpbm-9.25.orig/pnm/pnmtopalm/palmcolormap.c	2001-12-30 20:19:14.000000000 +0100
+++ netpbm-9.25/pnm/pnmtopalm/palmcolormap.c	2004-05-12 11:53:57.756575904 +0200
@@ -229,7 +229,7 @@
     return 0;
 
   colormap = malloc(sizeof(Colormap_s));
-  colormap->color_entries = malloc(sizeof(Color_s) * ncolors);
+  colormap->color_entries = malloc2(sizeof(Color_s), ncolors);
   colormap->nentries = ncolors;
   colormap->ncolors = ncolors;
 
diff -urN netpbm-9.25.orig/pnm/pnmtopalm/palmtopnm.c netpbm-9.25/pnm/pnmtopalm/palmtopnm.c
--- netpbm-9.25.orig/pnm/pnmtopalm/palmtopnm.c	2001-12-30 19:54:24.000000000 +0100
+++ netpbm-9.25/pnm/pnmtopalm/palmtopnm.c	2004-05-12 11:53:57.757575752 +0200
@@ -14,7 +14,7 @@
     int i;
     xelval *map;
 
-    map = (xelval *) malloc(sizeof(xelval) * ncolors);
+    map = (xelval *) malloc2(sizeof(xelval), ncolors);
     for (i = 0;  i < ncolors;  i++)
     {
         map[i] = maxval - (i * (maxval - minval)) / (ncolors - 1);
@@ -244,7 +244,7 @@
         graymap = figure_graymap(ncolors, 0, maxval);
     if (showhist)
     {
-        seen = (unsigned int *) malloc(sizeof(unsigned int) * ncolors);
+        seen = (unsigned int *) malloc2(sizeof(unsigned int), ncolors);
         if (!seen)
             pm_error("Can't allocate %d bytes for keeping track of "
                      "which pixels were seen.", 
diff -urN netpbm-9.25.orig/pnm/pnmtopng.c netpbm-9.25/pnm/pnmtopng.c
--- netpbm-9.25.orig/pnm/pnmtopng.c	2001-12-17 23:05:22.000000000 +0100
+++ netpbm-9.25/pnm/pnmtopng.c	2004-05-12 11:52:28.495145704 +0200
@@ -211,14 +211,17 @@
   int c;
   char *cp;
 
-  /* GRR:  need to check for malloc failure here */
-  info_ptr->text = (png_text *)malloc (MAXCOMMENTS * sizeof (png_text));
+  info_ptr->text = (png_text *)malloc2 (MAXCOMMENTS, sizeof (png_text));
+  if(info_ptr->text == NULL)
+  	pm_error("out of memory");
   j = 0;
   textpos = 0;
   while ((c = getc (tfp)) != EOF) {
     if (c != '\n' && c != EOF) {
+      overflow_add(textpos, 1);
       textline[textpos++] = c;
     } else {
+      overflow_add(textpos, 1);
       textline[textpos++] = '\0';
       if ((textline[0] != ' ') && (textline[0] != '\t')) {
         /* the following is a not that accurate check on Author or Title */
@@ -248,6 +251,7 @@
         j++;
       } else {
         j--;
+        overflow_add(info_ptr->text[j].text_length, textpos);
         cp = malloc (info_ptr->text[j].text_length + textpos);
         strcpy (cp, info_ptr->text[j].text);
         strcat (cp, "\n");
@@ -901,12 +905,21 @@
       }
     if (alpha) {
       if (pnm_type == PPM_TYPE)
+      {
+        overflow2(depth, 4);
         fulldepth = 4 * depth;
+      }
       else
+      {
+        overflow2(depth, 2);
         fulldepth = 2 * depth;
+      }
     } else {
       if (pnm_type == PPM_TYPE)
+      {
+        overflow2(depth, 3);
         fulldepth = 3 * depth;
+      }
       else
         fulldepth = depth;
     }
@@ -1229,7 +1242,7 @@
   png_set_packing (png_ptr);
 
   /* max: 3 color channels, one alpha channel, 16-bit */
-  if ((line = (png_byte *) malloc (cols*8)) == NULL)
+  if ((line = (png_byte *) malloc2(cols, 8)) == NULL)
   {
     png_destroy_write_struct (&png_ptr, &info_ptr);
     pm_closer (ifp);
diff -urN netpbm-9.25.orig/pnm/pnmtops.c netpbm-9.25/pnm/pnmtops.c
--- netpbm-9.25.orig/pnm/pnmtops.c	2002-01-09 16:32:19.000000000 +0100
+++ netpbm-9.25/pnm/pnmtops.c	2004-05-12 11:52:28.488146768 +0200
@@ -136,15 +136,24 @@
     cmdlineP->center  = !nocenter;
     cmdlineP->canturn = !noturn;
     
+    overflow2(width, 72);
+    overflow2(height, 72);
+
     cmdlineP->width  = width * 72;
     cmdlineP->height = height * 72;
 
     if (imagewidth_spec)
+    {
+	overflow2(imagewidth, 72);
         cmdlineP->imagewidth = imagewidth * 72;
+    }
     else
         cmdlineP->imagewidth = 0;
     if (imageheight_spec)
+    {
+        overflow2(imageheight, 72);
         cmdlineP->imageheight = imageheight * 72;
+    }
     else
         cmdlineP->imageheight = 0;
 
diff -urN netpbm-9.25.orig/pnm/pnmtorast.c netpbm-9.25/pnm/pnmtorast.c
--- netpbm-9.25.orig/pnm/pnmtorast.c	1993-10-04 10:11:58.000000000 +0100
+++ netpbm-9.25/pnm/pnmtorast.c	2004-05-12 11:52:28.489146616 +0200
@@ -299,11 +299,11 @@
     pr_colormapP->type = RMT_EQUAL_RGB;
     pr_colormapP->length = MAXCOLORS;
     pr_colormapP->map[0] =
-	(unsigned char*) malloc( MAXCOLORS * sizeof(unsigned char) );
+	(unsigned char*) malloc2( MAXCOLORS, sizeof(unsigned char) );
     pr_colormapP->map[1] =
-	(unsigned char*) malloc( MAXCOLORS * sizeof(unsigned char) );
+	(unsigned char*) malloc2( MAXCOLORS, sizeof(unsigned char) );
     pr_colormapP->map[2] =
-	(unsigned char*) malloc( MAXCOLORS * sizeof(unsigned char) );
+	(unsigned char*) malloc2( MAXCOLORS, sizeof(unsigned char) );
     if ( pr_colormapP->map[0] == 0 || pr_colormapP->map[1] == 0 ||
 	 pr_colormapP->map[2] == 0 )
 	pm_error( "out of memory" );
diff -urN netpbm-9.25.orig/pnm/pnmtorle.c netpbm-9.25/pnm/pnmtorle.c
--- netpbm-9.25.orig/pnm/pnmtorle.c	2002-03-13 04:50:50.000000000 +0100
+++ netpbm-9.25/pnm/pnmtorle.c	2004-05-12 11:52:28.496145552 +0200
@@ -19,6 +19,8 @@
  * If you modify this software, you should include a notice giving the
  * name of the person performing the modification, the date of modification,
  * and the reason for such modification.
+ *
+ *  2002-12-19: Fix maths wrapping bugs. Alan Cox <alan@redhat.com>
  */
 /*
  * pnmtorle - A program which will convert pbmplus (ppm or pgm) images
@@ -134,7 +136,7 @@
  */
    /*xelrow = pnm_allowcrow(width);*/
    xelrow = (xel*) pm_allocrow( width, sizeof(xel) );
-   scanlines = (rle_pixel ***)malloc( height * sizeof(rle_pixel **) );
+   scanlines = (rle_pixel ***)malloc2( height,  sizeof(rle_pixel **) );
    RLE_CHECK_ALLOC( hdr.cmd, scanlines, "scanline pointers" );
 
    for ( scan = 0; scan < height; scan++ )
diff -urN netpbm-9.25.orig/pnm/pnmtosgi.c netpbm-9.25/pnm/pnmtosgi.c
--- netpbm-9.25.orig/pnm/pnmtosgi.c	2001-06-03 10:35:32.000000000 +0200
+++ netpbm-9.25/pnm/pnmtosgi.c	2004-05-12 11:52:28.469149656 +0200
@@ -37,7 +37,8 @@
 static ScanElem *compress ARGS((ScanElem *temp, int row, int rows, int cols, int chan_no, long *table, int bpc));
 static int rle_compress ARGS((ScanElem *inbuf, int cols));
 static void * xmalloc ARGS((int bytes));
-#define MALLOC(n, type)     (type *)xmalloc((n) * sizeof(type))
+static void * xmalloc2 ARGS((int x, int y));
+#define MALLOC(n, type)     (type *)xmalloc2((n), sizeof(type))
 
 #define WORSTCOMPR(x)   (2*(x) + 2)
 
@@ -224,6 +225,22 @@
     return mem;
 }
 
+static void *
+xmalloc2(int x, int y)
+{
+    void *mem;
+
+    overflow2(x,y);
+    if( x * y == 0 )
+        return NULL;
+
+    mem = malloc2(x, y);
+    if( mem == NULL )
+        pm_error("out of memory allocating %d bytes", x * y);
+    return mem;
+}
+
+
 static void
 put_big_short(short s)
 {
@@ -261,6 +278,7 @@
 #endif
 
     if( storage != STORAGE_VERBATIM ) {
+        overflow2(channels, rows);
         table = MALLOC(channels * rows, long);
         rletemp = MALLOC(WORSTCOMPR(cols), ScanElem);
     }
@@ -314,6 +332,8 @@
             break;
         case STORAGE_RLE:
             tabrow = chan_no * rows + row;
+            overflow2(chan_no, rows);
+            overflow_add(chan_no* rows, row);
             len = rle_compress(temp, cols);     /* writes result into rletemp */
             channel[chan_no][row].length = len;
             channel[chan_no][row].data = p = MALLOC(len, ScanElem);
diff -urN netpbm-9.25.orig/pnm/pstopnm.c netpbm-9.25/pnm/pstopnm.c
--- netpbm-9.25.orig/pnm/pstopnm.c	2001-09-07 17:49:59.000000000 +0200
+++ netpbm-9.25/pnm/pstopnm.c	2004-05-12 11:53:57.751576664 +0200
@@ -175,6 +175,7 @@
     else {
         char *filespec_plus_ps;
 
+        overflow_add(strlen(orig_filespec), 4);
         filespec_plus_ps = malloc(strlen(orig_filespec) + 4);
         strcpy(filespec_plus_ps, orig_filespec);
         strcat(filespec_plus_ps, ".ps");
@@ -416,6 +417,7 @@
 
     char *retval;  /* malloc'ed */
 
+    overflow_add(strlen(cmdline.input_filespec), 10);
     retval = malloc(strlen(cmdline.input_filespec) + 10);
 
     if (cmdline.goto_stdout)
diff -urN netpbm-9.25.orig/pnm/rletopnm.c netpbm-9.25/pnm/rletopnm.c
--- netpbm-9.25.orig/pnm/rletopnm.c	2002-03-13 04:50:54.000000000 +0100
+++ netpbm-9.25/pnm/rletopnm.c	2004-05-12 11:52:28.498145248 +0200
@@ -19,6 +19,8 @@
  * If you modify this software, you should include a notice giving the
  * name of the person performing the modification, the date of modification,
  * and the reason for such modification.
+ *
+ *  2002-12-19: Fix maths wrapping bugs. Alan Cox <alan@redhat.com>
  */
 /*
  * rletopnm - A conversion program to convert from Utah's "rle" image format
@@ -187,7 +189,7 @@
    pixelrow = ppm_allocrow(width);
    alpharow = pgm_allocrow(width);
 
-   scanlines = (rle_pixel ***)malloc( height * sizeof(rle_pixel **) );
+   scanlines = (rle_pixel ***)malloc2( height,  sizeof(rle_pixel **) );
    RLE_CHECK_ALLOC( hdr.cmd, scanlines, "scanline pointers" );
 
    for ( scan = 0; scan < height; scan++ )
@@ -286,7 +288,7 @@
    pixelrow = pgm_allocrow(width);
    alpharow = pgm_allocrow(width);
 
-   scanlines = (rle_pixel ***)malloc( height * sizeof(rle_pixel **) );
+   scanlines = (rle_pixel ***)malloc2( height, sizeof(rle_pixel **) );
    RLE_CHECK_ALLOC( hdr.cmd, scanlines, "scanline pointers" );
 
    for ( scan = 0; scan < height; scan++ )
diff -urN netpbm-9.25.orig/pnm/sgitopnm.c netpbm-9.25/pnm/sgitopnm.c
--- netpbm-9.25.orig/pnm/sgitopnm.c	2002-01-04 18:29:11.000000000 +0100
+++ netpbm-9.25/pnm/sgitopnm.c	2004-05-12 11:52:28.474148896 +0200
@@ -44,8 +44,8 @@
 static short get_big_short ARGS((FILE *f));
 static short get_byte_as_short ARGS((FILE *f));
 static void readerr ARGS((FILE *f));
-static void * xmalloc ARGS((int bytes));
-#define MALLOC(n, type)     (type *)xmalloc((n) * sizeof(type))
+static void * xmalloc2 ARGS((int x, int y));
+#define MALLOC(n, type)     (type *)xmalloc2((n), sizeof(type))
 static char * compression_name ARGS((char compr));
 static void       read_bytes ARGS((FILE *ifp, int n, char *buf));
 static Header *   read_header ARGS((FILE *ifp, int channel));
@@ -252,12 +252,18 @@
 
     if (ochan < 0) {
         maxchannel = (head->zsize < 3) ? head->zsize : 3;
+        overflow2(head->ysize, maxchannel);
         image = MALLOC(head->ysize * maxchannel, ScanLine);
     } else {
         maxchannel = ochan + 1;
         image = MALLOC(head->ysize, ScanLine);
     }
-    if( table ) temp = MALLOC(WORSTCOMPR(head->xsize), ScanElem);
+    if( table )
+    {
+       overflow2(head->xsize, 2);
+       overflow_add(head->xsize*2, 2);
+       temp = MALLOC(WORSTCOMPR(head->xsize), ScanElem);
+    }
 
     for( channel = 0; channel < maxchannel;  channel++ ) {
 #ifdef DEBUG
@@ -447,17 +453,19 @@
 
 
 static void *
-xmalloc(bytes)
-    int bytes;
+xmalloc2(x, y)
+    int x;
+    int y;
 {
     void *mem;
 
-    if( bytes == 0 )
+    overflow2(x, y);
+    if( x * y == 0 )
         return NULL;
 
-    mem = malloc(bytes);
+    mem = malloc2(x, y);
     if( mem == NULL )
-        pm_error("out of memory allocating %d bytes", bytes);
+        pm_error("out of memory allocating %d bytes", x * y);
     return mem;
 }
 
diff -urN netpbm-9.25.orig/pnm/sirtopnm.c netpbm-9.25/pnm/sirtopnm.c
--- netpbm-9.25.orig/pnm/sirtopnm.c	2002-01-04 18:22:45.000000000 +0100
+++ netpbm-9.25/pnm/sirtopnm.c	2004-05-12 11:52:28.460151024 +0200
@@ -69,6 +69,7 @@
 	    }
 	    break;
 	case PPM_TYPE:
+	    overflow3(cols, rows, 3);
 	    picsize = cols * rows * 3;
 	    planesize = cols * rows;
             if ( !( sirarray = (unsigned char*) malloc( picsize ) ) ) 
diff -urN netpbm-9.25.orig/pnm/tifftopnm.c netpbm-9.25/pnm/tifftopnm.c
--- netpbm-9.25.orig/pnm/tifftopnm.c	2002-03-03 18:24:54.000000000 +0100
+++ netpbm-9.25/pnm/tifftopnm.c	2004-05-12 11:52:28.490146464 +0200
@@ -597,7 +597,7 @@
     if (scanbuf == NULL)
         pm_error("can't allocate memory for scanline buffer");
 
-    samplebuf = (unsigned short *) malloc(cols * sizeof(unsigned short) * spp);
+    samplebuf = (unsigned short *) malloc3(cols , sizeof(unsigned short) , spp);
     if (samplebuf == NULL)
         pm_error ("can't allocate memory for row buffer");
 
diff -urN netpbm-9.25.orig/pnm/xwdtopnm.c netpbm-9.25/pnm/xwdtopnm.c
--- netpbm-9.25.orig/pnm/xwdtopnm.c	2002-01-17 00:15:55.000000000 +0100
+++ netpbm-9.25/pnm/xwdtopnm.c	2004-05-12 11:52:28.491146312 +0200
@@ -186,8 +186,8 @@
 	if ( h10P->window_ncolors != 0 )
 	    {
 	    /* Read X10 colormap. */
-	    x10colors = (X10Color*) malloc(
-		h10P->window_ncolors * sizeof(X10Color) );
+	    x10colors = (X10Color*) malloc2(
+		h10P->window_ncolors, sizeof(X10Color) );
 	    if ( x10colors == 0 )
 		pm_error( "out of memory" );
 	    for ( i = 0; i < h10P->window_ncolors; ++i )
@@ -214,6 +214,9 @@
 	    *colorsP = pnm_allocrow( 2 );
 	    PNM_ASSIGN1( (*colorsP)[0], 0 );
 	    PNM_ASSIGN1( (*colorsP)[1], *maxvalP );
+	    overflow_add(h10P->pixmap_width, 15);
+	    if(h10P->pixmap_width < 0)
+		pm_error("assert: negative width");
 	    *padrightP =
 		( ( h10P->pixmap_width + 15 ) / 16 ) * 16 - h10P->pixmap_width;
 	    *bits_per_itemP = 16;
@@ -224,9 +227,13 @@
 	    *formatP = PGM_TYPE;
 	    *visualclassP = StaticGray;
 	    *maxvalP = ( 1 << h10P->display_planes ) - 1;
+	    overflow_add(*maxvalP, 1);
 	    *colorsP = pnm_allocrow( *maxvalP + 1 );
 	    for ( i = 0; i <= *maxvalP; ++i )
 		PNM_ASSIGN1( (*colorsP)[i], i );
+	    overflow_add(h10P->pixmap_width, 15);
+	    if(h10P->pixmap_width < 0)
+		pm_error("assert: negative width");
 	    *padrightP =
 		( ( h10P->pixmap_width + 15 ) / 16 ) * 16 - h10P->pixmap_width;
 	    *bits_per_itemP = 16;
@@ -321,8 +328,8 @@
 	if ( h11P->ncolors > 0 )
 	    {
 	    /* Read X11 colormap. */
-	    x11colors = (X11XColor*) malloc(
-		h11P->ncolors * sizeof(X11XColor) );
+	    x11colors = (X11XColor*) malloc2(
+		h11P->ncolors, sizeof(X11XColor) );
 	    if ( x11colors == 0 )
 		pm_error( "out of memory" );
 	    if ( fread( x11colors, sizeof(X11XColor), h11P->ncolors, file ) !=
@@ -384,6 +391,7 @@
 	    {
 	    *formatP = PGM_TYPE;
 	    *maxvalP = ( 1 << h11P->bits_per_pixel ) - 1;
+	    overflow_add(*maxvalP, 1);
 	    *colorsP = pnm_allocrow( *maxvalP + 1 );
 	    for ( i = 0; i <= *maxvalP; ++i )
 		PNM_ASSIGN1( (*colorsP)[i], i );
@@ -405,6 +413,7 @@
 
 	*colsP = h11P->pixmap_width;
 	*rowsP = h11P->pixmap_height;
+	overflow2(h11P->bytes_per_line, 8);
 	*padrightP =
 	    h11P->bytes_per_line * 8 / h11P->bits_per_pixel -
 	    h11P->pixmap_width;
diff -urN netpbm-9.25.orig/ppm/411toppm.c netpbm-9.25/ppm/411toppm.c
--- netpbm-9.25.orig/ppm/411toppm.c	2001-05-16 18:26:22.000000000 +0200
+++ netpbm-9.25/ppm/411toppm.c	2004-05-12 11:53:57.806568304 +0200
@@ -147,17 +147,18 @@
          uint8 *** const orig_cbP) {
     int y;
 
-    *orig_yP = (uint8 **) malloc(sizeof(uint8 *) * height);
+    *orig_yP = (uint8 **) malloc2(sizeof(uint8 *), height);
     for (y = 0; y < height; y++) {
-        (*orig_yP)[y] = (uint8 *) malloc(sizeof(uint8) * width);
+        (*orig_yP)[y] = (uint8 *) malloc2(sizeof(uint8), width);
     }
 
-    *orig_crP = (uint8 **) malloc(sizeof(uint8 *) * height);
+    overflow2(width, sizeof(uint8 *));
+    *orig_crP = (uint8 **) malloc2(sizeof(uint8 *),  height);
     for (y = 0; y < height; y++) {
         (*orig_crP)[y] = (uint8 *) malloc(sizeof(uint8) * width / 4);
     }
 
-    *orig_cbP = (uint8 **) malloc(sizeof(uint8 *) * height);
+    *orig_cbP = (uint8 **) malloc2(sizeof(uint8 *),  height);
     for (y = 0; y < height; y++) {
         (*orig_cbP)[y] = (uint8 *) malloc(sizeof(uint8) * width / 4);
     }
@@ -177,19 +178,20 @@
 
     /* first, allocate tons of memory */
 
-    Y = (int **) malloc(sizeof(int *) * height);
+    Y = (int **) malloc2(sizeof(int *),  height);
     for (y = 0; y < height; y++) {
-        Y[y] = (int *) malloc(sizeof(int) * width);
+	Y[y] = (int *) malloc2(sizeof(int),  width);
     }
     
-    U = (int **) malloc(sizeof(int *) * height);
+    U = (int **) malloc2(sizeof(int *) , height);
+    overflow2(sizeof(int), width);
     for (y = 0; y < height; y++) {
         U[y] = (int *) malloc(sizeof(int) * width / 4);
     }
 
-    V = (int **) malloc(sizeof(int *) * height);
+    V = (int **) malloc2(sizeof(int *),  height);
     for (y = 0; y < height; y++) {
-        V[y] = (int *) malloc(sizeof(int) * width / 4);
+	V[y] = (int *) malloc2(sizeof(int),  width / 4);
     }
 
 	for ( y = 0; y < height; y ++ ) {
diff -urN netpbm-9.25.orig/ppm/ilbmtoppm.c netpbm-9.25/ppm/ilbmtoppm.c
--- netpbm-9.25.orig/ppm/ilbmtoppm.c	2002-01-04 16:26:40.000000000 +0100
+++ netpbm-9.25/ppm/ilbmtoppm.c	2004-05-12 11:53:57.761575144 +0200
@@ -123,7 +123,8 @@
 static ColorMap * alloc_cmap ARGS((void));
 static void check_cmap ARGS((BitMapHeader *bmhd, ColorMap *cmap));
 static void * xmalloc ARGS((int bytes));
-#define MALLOC(n, type)     (type *)xmalloc((n) * sizeof(type))
+static void * xmalloc2 ARGS((int x, int y));
+#define MALLOC(n, type)     (type *)xmalloc2((n), sizeof(type))
 
 #define FACTOR_4BIT     17      /* scale factor maxval 15 -> maxval 255 */
 
@@ -348,6 +349,7 @@
                 }
 
                 if( typeid == ID_ILBM ) {
+                    overflow_add(bmhd->w, 15);
                     ilbmrow = MALLOC(RowBytes(bmhd->w), unsigned char);
                     viewportmodes |= fakeviewport;      /* -isham/-isehb */
 
@@ -932,6 +934,9 @@
     if( redmaxval != maxval || greenmaxval != maxval || bluemaxval != maxval )
         pm_message("scaling colors to %d bits", pm_maxvaltobits(maxval));
 
+    overflow_add(redmaxval, 1);
+    overflow_add(greenmaxval, 1);
+    overflow_add(bluemaxval, 1);
     redtable   = MALLOC(redmaxval  +1, pixval);
     greentable = MALLOC(greenmaxval+1, pixval);
     bluetable  = MALLOC(bluemaxval +1, pixval);
@@ -1281,6 +1286,7 @@
     rawtype *chp;
 
     cols = bmhd->w;
+    overflow_add(cols, 15);
     bytes = RowBytes(cols);
     for( plane = 0; plane < nPlanes; plane++ ) {
         int mask;
@@ -1321,6 +1327,7 @@
         case mskNone:
             break;
         case mskHasMask:        /* mask plane */
+            overflow_add(cols, 15);
             read_ilbm_plane(ifp, chunksizeP, RowBytes(cols), bmhd->compression);
             if( maskfile ) {
                 ilp = ilbmrow;
@@ -1394,6 +1401,23 @@
     return mem;
 }
 
+static void *
+xmalloc2(x, y)
+    int x;
+    int y;
+{
+    void *mem;
+
+    overflow2(x,y);
+    if( x * y == 0 )
+        return NULL;
+
+    mem = malloc2(x,y);
+    if( mem == NULL )
+        pm_error("out of memory allocating %d bytes", x * y);
+    return mem;
+}
+
 
 static char *
 ID2string(id)
@@ -1582,6 +1606,9 @@
         cmap->mp_change[i] = NULL;
     if( PCHG.StartLine < 0 ) {
         int nch;
+        if(PCHG.MaxReg < PCHG.MinReg)
+        	pm_error("assert: MinReg > MaxReg");
+        overflow_add(PCHG.MaxReg-PCHG.MinReg, 2);
         nch = PCHG.MaxReg - PCHG.MinReg +1;
         cmap->mp_init = MALLOC(nch + 1, PaletteChange);
         for( i = 0; i < nch; i++ )
@@ -1712,7 +1739,9 @@
             ChangeCount32 = *data++;
             datasize -= 2;
 
+	    overflow_add(ChangeCount16, ChangeCount32);
             changes = ChangeCount16 + ChangeCount32;
+            overflow_add(changes, 1);
             cmap->mp_change[row] = MALLOC(changes + 1, PaletteChange);
             for( i = 0; i < changes; i++ ) {
                 if( totalchanges >= PCHG->TotalChanges ) goto fail;
@@ -1798,6 +1827,7 @@
             if( datasize < 2 ) goto fail;
             changes = BIG_WORD(data); data += 2; datasize -= 2;
 
+	    overflow_add(changes, 1);
             cmap->mp_change[row] = MALLOC(changes + 1, PaletteChange);
             for( i = 0; i < changes; i++ ) {
                 if( totalchanges >= PCHG->TotalChanges ) goto fail;
diff -urN netpbm-9.25.orig/ppm/imgtoppm.c netpbm-9.25/ppm/imgtoppm.c
--- netpbm-9.25.orig/ppm/imgtoppm.c	2002-01-04 16:24:57.000000000 +0100
+++ netpbm-9.25/ppm/imgtoppm.c	2004-05-12 11:53:57.762574992 +0200
@@ -83,6 +83,7 @@
             len = atoi((char*) buf );
             if ( fread( buf, len, 1, ifp ) != 1 )
                 pm_error( "bad colormap buf" );
+            overflow2(cmaplen, 3);
             if ( cmaplen * 3 != len )
             {
                 pm_message(
@@ -104,6 +105,7 @@
                 pm_error( "bad pixel data header" );
             buf[8] = '\0';
             len = atoi((char*) buf );
+            overflow2(cols, rows);
             if ( len != cols * rows )
                 pm_message(
                     "pixel data length (%d) does not match image size (%d)",
diff -urN netpbm-9.25.orig/ppm/libppm5.c netpbm-9.25/ppm/libppm5.c
--- netpbm-9.25.orig/ppm/libppm5.c	2000-03-23 05:27:06.000000000 +0100
+++ netpbm-9.25/ppm/libppm5.c	2004-05-12 11:53:57.769573928 +0200
@@ -440,7 +440,7 @@
     if ( fh == 0 )
 	pm_error( "out of memory allocating a fillhandle" );
     fh->n = 0;
-    fh->coords = (coord*) malloc( SOME * sizeof(coord) );
+    fh->coords = (coord*) malloc2( SOME , sizeof(coord) );
     if ( fh->coords == 0 )
 	pm_error( "out of memory allocating a fillhandle" );
     fh->size = SOME;
@@ -481,9 +481,10 @@
     /* Ok, these are new; check if there's room for two more coords. */
     if ( fh->n + 1 >= fh->size )
 	{
+	overflow_add(fh->size, SOME);
 	fh->size += SOME;
-	fh->coords = (coord*) realloc(
-	    (char*) fh->coords, fh->size * sizeof(coord) );
+	fh->coords = (coord*) realloc2(
+	    (char*) fh->coords, fh->size,  sizeof(coord) );
 	if ( fh->coords == 0 )
 	    pm_error( "out of memory enlarging a fillhandle" );
 	}
diff -urN netpbm-9.25.orig/ppm/pcxtoppm.c netpbm-9.25/ppm/pcxtoppm.c
--- netpbm-9.25.orig/ppm/pcxtoppm.c	2002-02-10 19:39:26.000000000 +0100
+++ netpbm-9.25/ppm/pcxtoppm.c	2004-05-12 11:53:57.795569976 +0200
@@ -548,6 +548,8 @@
     /*
      * clear the pixel buffer
      */
+
+    overflow2(bytesperline, 8);
     npixels = (bytesperline * 8) / bitsperpixel;
     p    = pixels;
     while (--npixels >= 0)
diff -urN netpbm-9.25.orig/ppm/picttoppm.c netpbm-9.25/ppm/picttoppm.c
--- netpbm-9.25.orig/ppm/picttoppm.c	2002-01-04 16:26:12.000000000 +0100
+++ netpbm-9.25/ppm/picttoppm.c	2004-05-12 11:53:57.772573472 +0200
@@ -1,3 +1,5 @@
+#error "Unfixable. Don't ship me"
+
 /*
  * picttoppm.c -- convert a MacIntosh PICT file to PPM format.
  *
diff -urN netpbm-9.25.orig/ppm/pjtoppm.c netpbm-9.25/ppm/pjtoppm.c
--- netpbm-9.25.orig/ppm/pjtoppm.c	2000-03-03 06:32:09.000000000 +0100
+++ netpbm-9.25/ppm/pjtoppm.c	2004-05-12 11:53:57.774573168 +0200
@@ -127,17 +127,21 @@
 		case 'W':	/* send last plane */
 		    if (rows == -1 || r >= rows || image == NULL) {
 			if (rows == -1 || r >= rows)
+			{
+			    overflow_add(rows, 100);
 			    rows += 100;
+			}
 			if (image == NULL) {
 			    image = (unsigned char **) 
-				malloc(rows * planes * sizeof(unsigned char *));
-			    imlen = (int *) malloc(rows * planes * sizeof(int));
+			        malloc3(rows , planes , sizeof(unsigned char *));
+			    imlen = (int *) malloc3(rows , planes,  sizeof(int));
 			}
 			else {
+			    overflow2(rows,planes);
 			    image = (unsigned char **) 
-				realloc(image, rows * planes * 
+			        realloc2(image, rows * planes,
 					sizeof(unsigned char *));
-			    imlen = (int *) realloc(imlen, rows * planes * 
+			    imlen = (int *) realloc2(imlen, rows * planes,
 						    sizeof(int));
 			}
 		    }
@@ -148,7 +152,7 @@
 		    cols = cols > val ? cols : val;
 		    imlen[r * planes + p] = val;
 		    image[r * planes + p] = (unsigned char *) 
-			malloc(val * sizeof(unsigned char));
+		        malloc2(val , sizeof(unsigned char));
 		    if (image[r * planes + p] == NULL) 
 			pm_error("out of memory");
 		    if (fread(image[r * planes + p], 1, val, fp) != val) 
@@ -205,7 +209,7 @@
 	    if (image[r * planes] == NULL)
 		continue;
 	    for (p = 0; p < planes; p++) {
-		buf = (unsigned char *) malloc(newcols * 
+	        buf = (unsigned char *) malloc2(newcols ,
 					       sizeof(unsigned char *));
 		if (buf == NULL) 
 		    pm_error("out of memory");
@@ -213,7 +217,10 @@
 		    for (cmd = image[p + r * planes][c],
 			 val = image[p + r * planes][c+1]; 
 			 cmd >= 0 && i < newcols; cmd--, i++) 
+		    {
 			 buf[i] = val;
+			 overflow_add(i, 1);
+		    }
 		cols = cols > i ? cols : i;
 		free(image[p + r * planes]);
 		/* 
@@ -224,6 +231,7 @@
 		image[p + r * planes] = (unsigned char *) realloc(buf, i);
 	    }
 	}
+	overflow2(cols, 8);
 	cols *= 8;
     }
 			
diff -urN netpbm-9.25.orig/ppm/ppmdist.c netpbm-9.25/ppm/ppmdist.c
--- netpbm-9.25.orig/ppm/ppmdist.c	2000-03-03 06:41:40.000000000 +0100
+++ netpbm-9.25/ppm/ppmdist.c	2004-05-12 11:53:57.788571040 +0200
@@ -90,7 +90,7 @@
 
     /* copy the colors into another structure for sorting */
     colorToGrayMap = (struct colorToGrayEntry *)
-	malloc(sizeof(struct colorToGrayEntry) * colors);
+	malloc2(sizeof(struct colorToGrayEntry),  colors);
     for (color = 0; color < colors; color++) {
 	colorToGrayMap[color].color = hist[color].color;
 	colorToGrayMap[color].frequency = hist[color].value;
diff -urN netpbm-9.25.orig/ppm/ppmdither.c netpbm-9.25/ppm/ppmdither.c
--- netpbm-9.25.orig/ppm/ppmdither.c	2002-02-22 05:56:35.000000000 +0100
+++ netpbm-9.25/ppm/ppmdither.c	2004-05-12 11:53:57.774573168 +0200
@@ -93,6 +93,10 @@
         const unsigned int dith_mat_sz = 
             (dith_dim * sizeof(int *)) + /* pointers */
             (dith_dim * dith_dim * sizeof(int)); /* data */
+
+        overflow2(dith_dim, sizeof(int *));
+        overflow3(dith_dim, dith_dim, sizeof(int));
+        overflow_add(dith_dim * sizeof(int *), dith_dim * dith_dim * sizeof(int));
         dith_mat = (unsigned int **) malloc(dith_mat_sz);
 
         if (dith_mat == NULL) 
@@ -139,7 +143,9 @@
     if (dith_nb < 2) 
 	pm_error("too few shades for blue, minimum of 2");
 
-    *ptab_p = malloc(dith_nr * dith_ng * dith_nb * sizeof(pixel));
+    overflow2(dith_nr, dith_ng);
+    *ptab_p = malloc3(dith_nr * dith_ng, dith_nb, sizeof(pixel));
+
     if (*ptab_p == NULL) 
         pm_error("Unable to allocate space for the color lookup table "
                  "(%d by %d by %d pixels).", dith_nr, dith_ng, dith_nb);
diff -urN netpbm-9.25.orig/ppm/ppmquantall netpbm-9.25/ppm/ppmquantall
--- netpbm-9.25.orig/ppm/ppmquantall	2001-04-16 09:49:37.000000000 +0200
+++ netpbm-9.25/ppm/ppmquantall	2004-05-12 11:53:57.822565872 +0200
@@ -66,6 +66,97 @@
 done
 
 #all=`tempfile -p pqa.all -m 600`
+#all=.tmp.pqa.all.$$
+#rm -f $all
+all=$(mktemp -t pqa.all.XXXXXXXXXX) || exit 1 #219019
+
+pnmcat -topbottom -jleft -white ${files[@]} | ppmquant $newcolors > $all
+if [ $? != 0 ]; then
+    exit $?
+fi
+
+y=0
+i=0
+
+while [ $i -lt $nfiles ]; do
+    pnmcut -left 0 -top $y -width ${widths[$i]} -height ${heights[$i]} $all \
+        > ${files[$i]}$ext
+    if [ $? != 0 ]; then
+        exit $?
+    fi
+    y=$(($y + ${heights[$i]}))
+    i=$(($i + 1))
+done
+
+rm -f $all
+#!/bin/sh
+#
+# ppmquantall - run ppmquant on a bunch of files all at once, so they share
+#               a common colormap
+#
+# WARNING: overwrites the source files with the results!!!
+#
+# Verbose explanation: Let's say you've got a dozen pixmaps that you want
+# to display on the screen all at the same time.  Your screen can only
+# display 256 different colors, but the pixmaps have a total of a thousand
+# or so different colors.  For a single pixmap you solve this problem with
+# ppmquant; this script solves it for multiple pixmaps.  All it does is
+# concatenate them together into one big pixmap, run ppmquant on that, and
+# then split it up into little pixmaps again.
+
+usage()
+{
+    echo "usage: $0 [-ext extension] <newcolours> <ppmfile> ..."
+    exit 1
+}
+
+ext=
+
+while :; do
+
+    case "$1" in
+    -ext*)
+        if [ $# -lt 2 ]; then
+            usage
+        fi
+        ext=".$2"
+        shift
+        shift
+    ;;
+
+    *)  
+        break
+    ;;
+
+    esac
+done
+
+if [ $# -lt 2 ]; then
+    usage
+fi
+
+newcolors=$1
+shift
+nfiles=$#
+files=($@)
+
+# Extract the width and height of each of the images.
+# Here, we make the assumption that the width and height are on the
+# second line, even though the PPM format doesn't require that.
+# To be robust, we need to use Pnmfile to get that information, or 
+# Put this program in C and use ppm_readppminit().
+
+set widths=()
+set heights=()
+
+for i in ${files[@]}; do
+    widths=(${widths[*]} `egrep -v '^#' $i | head -2 | tail -1 | \
+            sed 's/ .*//'` )
+    heights=(${heights[*]} `egrep -v '^#' $i | head -2 | tail -1 | \
+            sed 's/.* //'` )
+done
+
+#all=`tempfile -p pqa.all -m 600`
 all=/tmp/pqa.all.$$
 rm -f $all
 
diff -urN netpbm-9.25.orig/ppm/ppmquantall.csh netpbm-9.25/ppm/ppmquantall.csh
--- netpbm-9.25.orig/ppm/ppmquantall.csh	2000-07-28 04:29:36.000000000 +0200
+++ netpbm-9.25/ppm/ppmquantall.csh	2004-05-12 11:53:57.816566784 +0200
@@ -34,7 +34,7 @@
     set heights=( $heights `head -2 $i | tail -1 | sed 's/.* //'` )
 end
 
-set all=/tmp/pqa.all.$$
+set all=.tmp.pqa.all.$$
 rm -f $all
 pnmcat -topbottom -jleft -white $files | ppmquant -quiet $newcolors > $all
 if ( $status != 0 ) exit $status
diff -urN netpbm-9.25.orig/ppm/ppmqvga.c netpbm-9.25/ppm/ppmqvga.c
--- netpbm-9.25.orig/ppm/ppmqvga.c	2001-06-11 01:33:18.000000000 +0200
+++ netpbm-9.25/ppm/ppmqvga.c	2004-05-12 11:53:57.763574840 +0200
@@ -438,6 +438,8 @@
   ppm_writeppminit( stdout, cols, rows, maxval, 0 );
 
   if (dither) {
+    overflow_add(cols, 2);
+    overflow2(cols+2, sizeof(fs_err_array));
     fs_err_lines = (fs_err_array *) calloc((cols + 2), sizeof(fs_err_array));
 
     if (fs_err_lines == NULL) {
diff -urN netpbm-9.25.orig/ppm/ppmshadow netpbm-9.25/ppm/ppmshadow
--- netpbm-9.25.orig/ppm/ppmshadow	2000-03-24 19:37:26.000000000 +0100
+++ netpbm-9.25/ppm/ppmshadow	2004-05-12 11:53:57.801569064 +0200
@@ -22,7 +22,11 @@
 #
 #
 
-    $fname = "/tmp/_PPMshadow$$";          # Temporary filepath prefix
+#    $fname = ".tmp._PPMshadow$$";          # Temporary filepath prefix
+    chomp($fname = `mktemp -d -t PPMshadow.XXXXXX`);
+    if ($? >> 8) {
+        die "Can't create tmpdir";
+    }
 
     #   Process command line options
 
@@ -99,8 +103,8 @@
     if ((!(defined $ifile)) || ($ifile eq '-')) {
         #   Input default to standard input
         $stdin = 1;
-        $ifile = "$fname-0.ppm";
-        system("cat >$fname-0.ppm");
+        $ifile = "$fname/0.ppm";
+        system("cat >$fname/0.ppm");
     }
 
     #   Determine the size of the source image
@@ -112,15 +116,15 @@
 
     #   Create a blank background bitmap the size of the source bitmap
 
-    system("pnmcut 0 0 1 1 $ifile | pnmscale -xsize $xsize -ysize $ysize >$fname-5.ppm");
+    system("pnmcut 0 0 1 1 $ifile | pnmscale -xsize $xsize -ysize $ysize >$fname/5.ppm");
 
     #   Create positive mask file from input image
 
-    system("pnmarith -difference $ifile $fname-5.ppm | pnminvert | ppmtopgm | pgmtopbm -thresh -value 1.0 >$fname-1.ppm");
+    system("pnmarith -difference $ifile $fname/5.ppm | pnminvert | ppmtopgm | pgmtopbm -thresh -value 1.0 >$fname/1.ppm");
 
     #   Create convolution kernel file to generate shadow
 
-    open(OF, ">$fname-2.ppm");
+    open(OF, ">$fname/2.ppm");
     $ckern = $convolve <= 11 ? $convolve : 11;
     printf(OF "P2\n$ckern $ckern\n%d\n", $ckern * $ckern * 2);
     $a = ($ckern * $ckern) + 1;
@@ -136,60 +140,61 @@
         #   Convolve the input colour image with the kernel
         #   to create a translucent shadow image.
 
-        system("pnmconvol $fname-2.ppm $ifile >$fname-10.ppm");
-        system("rm $fname-2.ppm") if $purge;
+        system("pnmconvol $fname/2.ppm $ifile >$fname/10.ppm");
+#        system("rm $fname-2.ppm") if $purge;
         while ($ckern < $convolve) {
-            system("pnmsmooth $fname-10.ppm >$fname-10a.ppm");
-            system("mv $fname-10a.ppm $fname-10.ppm");
+            system("pnmsmooth $fname/10.ppm >$fname/10a.ppm");
+            system("mv $fname/10a.ppm $fname/10.ppm");
             $ckern++;
         }
     } else {
 
         #   Convolve the positive mask with the kernel to create shadow
 
-        system("pnmconvol $fname-2.ppm $fname-1.ppm >$fname-3.ppm");
-        system("rm $fname-2.ppm") if $purge;
+        system("pnmconvol $fname/2.ppm $fname/1.ppm >$fname/3.ppm");
+#        system("rm $fname-2.ppm") if $purge;
         while ($ckern < $convolve) {
-            system("pnmsmooth $fname-3.ppm >$fname-3a.ppm");
-            system("mv $fname-3a.ppm $fname-3.ppm");
+            system("pnmsmooth $fname/3.ppm >$fname/3a.ppm");
+            system("mv $fname/3a.ppm $fname/3.ppm");
             $ckern++;
         }
 
         #   Multiply the shadow by the background colour
 
-        system("pnmarith -multiply $fname-3.ppm $fname-5.ppm >$fname-10.ppm");
-        system("rm $fname-3.ppm") if $purge;
+        system("pnmarith -multiply $fname/3.ppm $fname/5.ppm >$fname/10.ppm");
+        system("rm $fname/3.ppm") if $purge;
     }
 
     #   Cut an offset rectangle from the shadow image
 
     $i = $xsize - $xoffset;
     $j = $ysize - $yoffset;
-    system("pnmcut 0 0 $i $j $fname-10.ppm >$fname-4.ppm");
-    system("rm $fname-10.ppm") if $purge;
+    system("pnmcut 0 0 $i $j $fname/10.ppm >$fname/4.ppm");
+#    system("rm $fname-10.ppm") if $purge;
 
     #   Create offset shadow image
 
-    system("pnmpaste -replace $fname-4.ppm $xoffset $yoffset $fname-5.ppm >$fname-6.ppm");
-    system("rm $fname-4.ppm $fname-5.ppm") if $purge;
+    system("pnmpaste -replace $fname/4.ppm $xoffset $yoffset $fname/5.ppm >$fname/6.ppm");
+#    system("rm $fname-4.ppm $fname-5.ppm") if $purge;
 
     #   Create inverse mask
 
-    system("pnminvert $fname-1.ppm >$fname-7.ppm");
+    system("pnminvert $fname/1.ppm >$fname/7.ppm");
 
     #   Multiply original image by inverse mask
 
-    system("pnmarith -multiply $ifile $fname-7.ppm >$fname-8.ppm");
-    system("rm $fname-7.ppm") if $purge;
-    system("rm $fname-0.ppm") if ($purge && $stdin);
+    system("pnmarith -multiply $ifile $fname/7.ppm >$fname/8.ppm");
+#    system("rm $fname-7.ppm") if $purge;
+#    system("rm $fname-0.ppm") if ($purge && $stdin);
 
     #   Multiply shadow by mask
 
-    system("pnmarith -multiply $fname-6.ppm $fname-1.ppm >$fname-9.ppm");
-    system("rm $fname-6.ppm $fname-1.ppm") if $purge;
+    system("pnmarith -multiply $fname/6.ppm $fname/1.ppm >$fname/9.ppm");
+#    system("rm $fname-6.ppm $fname-1.ppm") if $purge;
 
     #   Add masked image and shadow to obtain result, which this
     #   last call on pnmarith sends to standard output.
 
-    system("pnmarith -add $fname-8.ppm $fname-9.ppm");
-    system("rm $fname-8.ppm $fname-9.ppm") if $purge;
+    system("pnmarith -add $fname/8.ppm $fname/9.ppm");
+#    system("rm $fname-8.ppm $fname-9.ppm") if $purge;
+    system("rm -rf $fname/") if $purge;
diff -urN netpbm-9.25.orig/ppm/ppmtoeyuv.c netpbm-9.25/ppm/ppmtoeyuv.c
--- netpbm-9.25.orig/ppm/ppmtoeyuv.c	2001-09-07 17:48:09.000000000 +0200
+++ netpbm-9.25/ppm/ppmtoeyuv.c	2004-05-12 11:53:57.801569064 +0200
@@ -112,14 +112,15 @@
 
     int index;
 
-    mult299   = (float *) malloc(sizeof(float) * (maxval+1));
-    mult587   = (float *) malloc(sizeof(float) * (maxval+1));
-    mult114   = (float *) malloc(sizeof(float) * (maxval+1));
-    mult16874 = (float *) malloc(sizeof(float) * (maxval+1));
-    mult33126 = (float *) malloc(sizeof(float) * (maxval+1));
-    mult5     = (float *) malloc(sizeof(float) * (maxval+1));
-    mult41869 = (float *) malloc(sizeof(float) * (maxval+1));
-    mult08131 = (float *) malloc(sizeof(float) * (maxval+1));
+    overflow_add(maxval, 1);
+    mult299   = (float *) malloc2(sizeof(float), (maxval+1));
+    mult587   = (float *) malloc2(sizeof(float), (maxval+1));
+    mult114   = (float *) malloc2(sizeof(float), (maxval+1));
+    mult16874 = (float *) malloc2(sizeof(float), (maxval+1));
+    mult33126 = (float *) malloc2(sizeof(float), (maxval+1));
+    mult5     = (float *) malloc2(sizeof(float), (maxval+1));
+    mult41869 = (float *) malloc2(sizeof(float), (maxval+1));
+    mult08131 = (float *) malloc2(sizeof(float), (maxval+1));
 
     if (maxval == YUVMAXVAL) {
         /* fast path */
@@ -265,10 +266,10 @@
     uint8 ** orig_cr;
     uint8 ** orig_cb;
 
-    *orig_yP = (uint8 **) malloc(sizeof(uint8 *) * height);
+    *orig_yP = (uint8 **) malloc2(sizeof(uint8 *) , height);
     orig_y = *orig_yP;
     for (y = 0; y < height; y++) {
-        orig_y[y] = (uint8 *) malloc(sizeof(uint8) * width);
+        orig_y[y] = (uint8 *) malloc2(sizeof(uint8) , width);
     }
 
     *orig_crP = (uint8 **) malloc(sizeof(uint8 *) * height / 2);
diff -urN netpbm-9.25.orig/ppm/ppmtoicr.c netpbm-9.25/ppm/ppmtoicr.c
--- netpbm-9.25.orig/ppm/ppmtoicr.c	1993-10-04 10:12:38.000000000 +0100
+++ netpbm-9.25/ppm/ppmtoicr.c	2004-05-12 11:53:57.783571800 +0200
@@ -170,7 +170,7 @@
 
 	if (rleflag) {	
 		pm_message("sending run-length encoded picture data ..." );
-		testimage = (char*) malloc(rows*cols);
+		testimage = (char*) malloc2(rows, cols);
 		p = testimage;
 		for (i=0; i<rows; i++)
 			for (j=0; j<cols; j++) 
diff -urN netpbm-9.25.orig/ppm/ppmtoilbm.c netpbm-9.25/ppm/ppmtoilbm.c
--- netpbm-9.25.orig/ppm/ppmtoilbm.c	2002-01-04 16:24:55.000000000 +0100
+++ netpbm-9.25/ppm/ppmtoilbm.c	2004-05-12 11:53:57.785571496 +0200
@@ -117,7 +117,8 @@
 static pixel * next_pixrow ARGS((FILE *fp, int row));
 static int * make_val_table ARGS((int oldmaxval, int newmaxval));
 static void * xmalloc ARGS((int bytes));
-#define MALLOC(n, type)     (type *)xmalloc((n) * sizeof(type))
+static void * xmalloc2 ARGS((int x, int y));
+#define MALLOC(n, type)     (type *)xmalloc2((n) , sizeof(type))
 static void init_read ARGS((FILE *fp, int *colsP, int *rowsP, pixval *maxvalP, int *formatP, int readall));
 static void write_body_rows ARGS((void));
 static void write_camg ARGS((void));
@@ -785,11 +786,16 @@
 
     if( mode != MODE_CMAP ) {
         register int i;
+        overflow_add(cols, 15);
         coded_rowbuf = MALLOC(RowBytes(cols), unsigned char);
         for( i = 0; i < RowBytes(cols); i++ )
             coded_rowbuf[i] = 0;
         if( DO_COMPRESS )
+        {
+            overflow2(cols,2);
+            overflow_add(cols *2, 2);
             compr_rowbuf = MALLOC(WORSTCOMPR(RowBytes(cols)), unsigned char);
+        }
     }
 
     switch( mode ) {
@@ -981,7 +987,7 @@
     pm_message("initializing HAM colormap...");
 
     colors = 1<<(3*hbits);
-    hmap = malloc(colors * sizeof(hentry));
+    hmap = malloc2(colors,  sizeof(hentry));
     if (hmap == NULL)
         pm_error("Unable to allocate memory for HAM colormap.");
     hmaxval = pm_bitstomaxval(hbits);
@@ -1839,6 +1845,7 @@
 
     maskmethod = 0;     /* no masking - RGB8 uses genlock bits */
     compmethod = 4;     /* RGB8 files are always compressed */
+    overflow2(cols, 4);
     compr_row = MALLOC(cols * 4, unsigned char);
 
     if( maxval != 255 ) {
@@ -1926,6 +1933,7 @@
 
     maskmethod = 0;     /* no masking - RGBN uses genlock bits */
     compmethod = 4;     /* RGBN files are always compressed */
+    overflow2(cols, 2);
     compr_row = MALLOC(cols * 2, unsigned char);
 
     if( maxval != 15 ) {
@@ -2397,6 +2405,7 @@
     int i;
     int *table;
 
+    overflow_add(oldmaxval, 1);
     table = MALLOC(oldmaxval + 1, int);
     for(i = 0; i <= oldmaxval; i++ )
         table[i] = (i * newmaxval + oldmaxval/2) / oldmaxval;
@@ -2417,6 +2426,21 @@
     return mem;
 }
 
+static void *
+xmalloc2(x,y)
+    int x;
+    int y;
+{
+    void *mem;
+
+    overflow2(x, y);
+
+    mem = malloc2(x, y);
+    if( mem == NULL )
+        pm_error("out of memory allocating %d bytes", x * y);
+    return mem;
+}
+
 
 static int  gFormat;
 static int  gCols;
diff -urN netpbm-9.25.orig/ppm/ppmtolj.c netpbm-9.25/ppm/ppmtolj.c
--- netpbm-9.25.orig/ppm/ppmtolj.c	2000-12-03 00:36:01.000000000 +0100
+++ netpbm-9.25/ppm/ppmtolj.c	2004-05-12 11:53:57.805568456 +0200
@@ -180,6 +180,7 @@
     pixels = ppm_readppm( ifp, &cols, &rows, &maxval );
 
     pm_close( ifp );
+    overflow2(cols,6);
     obuf = (unsigned char *) pm_allocrow(cols * 3, sizeof(unsigned char));
     cbuf = (unsigned char *) pm_allocrow(cols * 6, sizeof(unsigned char));
     if (mode == C_TRANS_MODE_DELTA)
diff -urN netpbm-9.25.orig/ppm/ppmtomitsu.c netpbm-9.25/ppm/ppmtomitsu.c
--- netpbm-9.25.orig/ppm/ppmtomitsu.c	2002-01-04 16:24:55.000000000 +0100
+++ netpbm-9.25/ppm/ppmtomitsu.c	2004-05-12 11:53:57.773573320 +0200
@@ -125,6 +125,8 @@
         medias = MSize_User;
 
         if (dpi300) {
+        	overflow2(medias.maxcols, 2);
+        	overflow2(medias.maxrows, 2);
                 medias.maxcols *= 2;
                 medias.maxrows *= 2;
         }
diff -urN netpbm-9.25.orig/ppm/ppmtompeg/frame.c netpbm-9.25/ppm/ppmtompeg/frame.c
--- netpbm-9.25.orig/ppm/ppmtompeg/frame.c	2001-03-31 09:32:30.000000000 +0200
+++ netpbm-9.25/ppm/ppmtompeg/frame.c	2004-05-12 11:53:57.810567696 +0200
@@ -140,15 +140,16 @@
 omfrw->orig_y = NULL;
 Fsize_x = out_x;
 /* Allocate new frame memory */
-    omfrw->orig_y = (uint8 **) malloc(sizeof(uint8 *) * Fsize_y);
+    omfrw->orig_y = (uint8 **) malloc2(sizeof(uint8 *) , Fsize_y);
     ERRCHK(omfrw->orig_y, "malloc");
     for (y = 0; y < Fsize_y; y++) {
-	omfrw->orig_y[y] = (uint8 *) malloc(sizeof(uint8) * out_x);
+	omfrw->orig_y[y] = (uint8 *) malloc2(sizeof(uint8) , out_x);
 	ERRCHK(omfrw->orig_y[y], "malloc");
     }
 
-    omfrw->orig_cr = (uint8 **) malloc(sizeof(int8 *) * Fsize_y / 2);
+    omfrw->orig_cr = (uint8 **) malloc2(sizeof(int8 *) , Fsize_y / 2);
     ERRCHK(omfrw->orig_cr, "malloc");
+    overflow2(out_x, sizeof(int8));
     for (y = 0; y < Fsize_y / 2; y++) {
 	omfrw->orig_cr[y] = (uint8 *) malloc(sizeof(int8) * out_x / 2);
 	ERRCHK(omfrw->orig_cr[y], "malloc");
@@ -208,15 +209,17 @@
 Fsize_y = out_y;
 
 /* Allocate new frame memory */
-    omfrh->orig_y = (uint8 **) malloc(sizeof(uint8 *) * out_y);
+    omfrh->orig_y = (uint8 **) malloc2(sizeof(uint8 *),  out_y);
     ERRCHK(omfrh->orig_y, "malloc");
     for (y = 0; y < out_y; y++) {
-	omfrh->orig_y[y] = (uint8 *) malloc(sizeof(uint8) * Fsize_x);
+	omfrh->orig_y[y] = (uint8 *) malloc2(sizeof(uint8) ,  Fsize_x);
 	ERRCHK(omfrh->orig_y[y], "malloc");
     }
 
+    overflow2(out_y, sizeof(int8 *));
     omfrh->orig_cr = (uint8 **) malloc(sizeof(int8 *) * out_y / 2);
     ERRCHK(omfrh->orig_cr, "malloc");
+    overflow2(sizeof(int8), Fsize_x);
     for (y = 0; y < out_y / 2; y++) {
 	omfrh->orig_cr[y] = (uint8 *) malloc(sizeof(int8) * Fsize_x / 2);
 	ERRCHK(omfrh->orig_cr[y], "malloc");
@@ -532,11 +535,11 @@
 	return;
     }
 
-    frame->ppm_data = (uint8 **) malloc(sizeof(uint8 *) * Fsize_y);
+    frame->ppm_data = (uint8 **) malloc2(sizeof(uint8 *) ,  Fsize_y);
     ERRCHK(frame->ppm_data, "malloc");
 
     for ( y = 0; y < Fsize_y; y++ ) {
-	frame->ppm_data[y] = (uint8 *) malloc(3*sizeof(uint8) * Fsize_x);
+	frame->ppm_data[y] = (uint8 *) malloc3(3, sizeof(uint8), Fsize_x);
 	ERRCHK(frame->ppm_data[y], "malloc");
     }
 }
@@ -567,20 +570,20 @@
     dctx = Fsize_x / DCTSIZE;
     dcty = Fsize_y / DCTSIZE;
 
-    frame->y_blocks = (Block **) malloc(sizeof(Block *) * dcty);
+    frame->y_blocks = (Block **) malloc2(sizeof(Block *),  dcty);
     ERRCHK(frame->y_blocks, "malloc");
     for (i = 0; i < dcty; i++) {
-	frame->y_blocks[i] = (Block *) malloc(sizeof(Block) * dctx);
+	frame->y_blocks[i] = (Block *) malloc2(sizeof(Block), dctx);
 	ERRCHK(frame->y_blocks[i], "malloc");
     }
 
-    frame->cr_blocks = (Block **) malloc(sizeof(Block *) * (dcty >> 1));
-    frame->cb_blocks = (Block **) malloc(sizeof(Block *) * (dcty >> 1));
+    frame->cr_blocks = (Block **) malloc2(sizeof(Block *) , (dcty >> 1));
+    frame->cb_blocks = (Block **) malloc2(sizeof(Block *) , (dcty >> 1));
     ERRCHK(frame->cr_blocks, "malloc");
     ERRCHK(frame->cb_blocks, "malloc");
     for (i = 0; i < (dcty >> 1); i++) {
-	frame->cr_blocks[i] = (Block *) malloc(sizeof(Block) * (dctx >> 1));
-	frame->cb_blocks[i] = (Block *) malloc(sizeof(Block) * (dctx >> 1));
+	frame->cr_blocks[i] = (Block *) malloc2(sizeof(Block) , (dctx >> 1));
+	frame->cb_blocks[i] = (Block *) malloc2(sizeof(Block) , (dctx >> 1));
 	ERRCHK(frame->cr_blocks[i], "malloc");
 	ERRCHK(frame->cb_blocks[i], "malloc");
     }
@@ -612,10 +615,10 @@
     /*
      * first, allocate tons of memory
      */
-    frame->orig_y = (uint8 **) malloc(sizeof(uint8 *) * Fsize_y);
+    frame->orig_y = (uint8 **) malloc2(sizeof(uint8 *), Fsize_y);
     ERRCHK(frame->orig_y, "malloc");
     for (y = 0; y < Fsize_y; y++) {
-	frame->orig_y[y] = (uint8 *) malloc(sizeof(uint8) * Fsize_x);
+	frame->orig_y[y] = (uint8 *) malloc2(sizeof(uint8), Fsize_x);
 	ERRCHK(frame->orig_y[y], "malloc");
     }
 
@@ -663,22 +666,24 @@
         return;
     }
 
-	frame->halfX = (uint8 **) malloc(Fsize_y*sizeof(uint8 *));
+	frame->halfX = (uint8 **) malloc2(Fsize_y, sizeof(uint8 *));
 	ERRCHK(frame->halfX, "malloc");
-	frame->halfY = (uint8 **) malloc((Fsize_y-1)*sizeof(uint8 *));
+	if(Fsize_y == 0 || Fsize_x == 0)
+		pm_error("assert: zero size");
+	frame->halfY = (uint8 **) malloc2((Fsize_y-1), sizeof(uint8 *));
 	ERRCHK(frame->halfY, "malloc");
-	frame->halfBoth = (uint8 **) malloc((Fsize_y-1)*sizeof(uint8 *));
+	frame->halfBoth = (uint8 **) malloc2((Fsize_y-1), sizeof(uint8 *));
 	ERRCHK(frame->halfBoth, "malloc");
 	for ( y = 0; y < Fsize_y; y++ ) {
-	    frame->halfX[y] = (uint8 *) malloc((Fsize_x-1)*sizeof(uint8));
+	    frame->halfX[y] = (uint8 *) malloc2((Fsize_x-1), sizeof(uint8));
 	    ERRCHK(frame->halfX[y], "malloc");
 	}
 	for ( y = 0; y < Fsize_y-1; y++ ) {
-	    frame->halfY[y] = (uint8 *) malloc(Fsize_x*sizeof(uint8));
+	    frame->halfY[y] = (uint8 *) malloc2(Fsize_x, sizeof(uint8));
 	    ERRCHK(frame->halfY[y], "malloc");
 	}
 	for ( y = 0; y < Fsize_y-1; y++ ) {
-	    frame->halfBoth[y] = (uint8 *) malloc((Fsize_x-1)*sizeof(uint8));
+	    frame->halfBoth[y] = (uint8 *) malloc2((Fsize_x-1), sizeof(uint8));
 	    ERRCHK(frame->halfBoth[y], "malloc");
 	}
 }
@@ -712,24 +717,24 @@
        it for some reason, so do it this way at least for now -- more
        flexible
      */
-    frame->decoded_y = (uint8 **) malloc(sizeof(uint8 *) * Fsize_y);
+    frame->decoded_y = (uint8 **) malloc2(sizeof(uint8 *),  Fsize_y);
     ERRCHK(frame->decoded_y, "malloc");
     for (y = 0; y < Fsize_y; y++) {
-	frame->decoded_y[y] = (uint8 *) malloc(sizeof(uint8) * Fsize_x);
+	frame->decoded_y[y] = (uint8 *) malloc2(sizeof(uint8), Fsize_x);
 	ERRCHK(frame->decoded_y[y], "malloc");
     }
 
-    frame->decoded_cr = (uint8 **) malloc(sizeof(int8 *) * (Fsize_y >> 1));
+    frame->decoded_cr = (uint8 **) malloc2(sizeof(int8 *), (Fsize_y >> 1));
     ERRCHK(frame->decoded_cr, "malloc");
     for (y = 0; y < (Fsize_y >> 1); y++) {
-	frame->decoded_cr[y] = (uint8 *) malloc(sizeof(uint8) * (Fsize_x >> 1));
+	frame->decoded_cr[y] = (uint8 *) malloc2(sizeof(uint8),  (Fsize_x >> 1));
 	ERRCHK(frame->decoded_cr[y], "malloc");
     }
 
-    frame->decoded_cb = (uint8 **) malloc(sizeof(int8 *) * (Fsize_y >> 1));
+    frame->decoded_cb = (uint8 **) malloc2(sizeof(int8 *), (Fsize_y >> 1));
     ERRCHK(frame->decoded_cb, "malloc");
     for (y = 0; y < (Fsize_y >> 1); y++) {
-	frame->decoded_cb[y] = (uint8 *) malloc(sizeof(uint8) * (Fsize_x >> 1));
+	frame->decoded_cb[y] = (uint8 *) malloc2(sizeof(uint8), (Fsize_x >> 1));
 	ERRCHK(frame->decoded_cb[y], "malloc");
     }
 
diff -urN netpbm-9.25.orig/ppm/ppmtompeg/iframe.c netpbm-9.25/ppm/ppmtompeg/iframe.c
--- netpbm-9.25.orig/ppm/ppmtompeg/iframe.c	1995-08-15 00:30:06.000000000 +0200
+++ netpbm-9.25/ppm/ppmtompeg/iframe.c	2004-05-12 11:53:57.812567392 +0200
@@ -857,6 +857,8 @@
     int ysz = (Fsize_y>>3) * sizeof(int32 *);
     int xsz = (Fsize_x>>3);
     
+    overflow2(Fsize_y>>3, sizeof(int32 *));
+
     needs_init = FALSE;
     for (y=0; y<3; y++) {
       varDiff[y] = ratio[y] = total[y] = 0.0;
@@ -875,6 +877,7 @@
       fprintf(stderr, "Out of memory in BlockComputeSNR\n");
       exit(-1);
     }
+    overflow2(xsz, 4);
     for (y = 0; y < ySize[0]>>3; y++) {
       SignalY[y]  = (int32 *) calloc(xsz,4);
       SignalCr[y]  = (int32 *) calloc(xsz,4);
@@ -1030,27 +1033,27 @@
     dctx = Fsize_x / DCTSIZE;
     dcty = Fsize_y / DCTSIZE;
 
-    dct = (Block **) malloc(sizeof(Block *) * dcty);
+    dct = (Block **) malloc2(sizeof(Block *), dcty);
     ERRCHK(dct, "malloc");
     for (i = 0; i < dcty; i++) {
-	dct[i] = (Block *) malloc(sizeof(Block) * dctx);
+	dct[i] = (Block *) malloc2(sizeof(Block), dctx);
 	ERRCHK(dct[i], "malloc");
     }
 
-    dct_data = (dct_data_type **) malloc(sizeof(dct_data_type *) * dcty);
+    dct_data = (dct_data_type **) malloc2(sizeof(dct_data_type *), dcty);
     ERRCHK(dct_data, "malloc");
     for (i = 0; i < dcty; i++) {
-	dct_data[i] = (dct_data_type *) malloc(sizeof(dct_data_type) * dctx);
+	dct_data[i] = (dct_data_type *) malloc2(sizeof(dct_data_type),dctx);
 	ERRCHK(dct[i], "malloc");
     }
 
-    dctr = (Block **) malloc(sizeof(Block *) * (dcty >> 1));
-    dctb = (Block **) malloc(sizeof(Block *) * (dcty >> 1));
+    dctr = (Block **) malloc2(sizeof(Block *), (dcty >> 1));
+    dctb = (Block **) malloc2(sizeof(Block *), (dcty >> 1));
     ERRCHK(dctr, "malloc");
     ERRCHK(dctb, "malloc");
     for (i = 0; i < (dcty >> 1); i++) {
-	dctr[i] = (Block *) malloc(sizeof(Block) * (dctx >> 1));
-	dctb[i] = (Block *) malloc(sizeof(Block) * (dctx >> 1));
+	dctr[i] = (Block *) malloc2(sizeof(Block), (dctx >> 1));
+	dctb[i] = (Block *) malloc2(sizeof(Block), (dctx >> 1));
 	ERRCHK(dctr[i], "malloc");
 	ERRCHK(dctb[i], "malloc");
     }
diff -urN netpbm-9.25.orig/ppm/ppmtompeg/jpeg.c netpbm-9.25/ppm/ppmtompeg/jpeg.c
--- netpbm-9.25.orig/ppm/ppmtompeg/jpeg.c	2001-08-31 22:48:06.000000000 +0200
+++ netpbm-9.25/ppm/ppmtompeg/jpeg.c	2004-05-12 11:53:57.812567392 +0200
@@ -228,7 +228,7 @@
       exit(1);
     }  
 
-  inoffsets = (int *)malloc(no_frames*sizeof(int));
+  inoffsets = (int *)malloc2(no_frames, sizeof(int));
     
   if (fread (&(width),sizeof(int),1,inFile) != 1)
     {
diff -urN netpbm-9.25.orig/ppm/ppmtompeg/parallel.c netpbm-9.25/ppm/ppmtompeg/parallel.c
--- netpbm-9.25.orig/ppm/ppmtompeg/parallel.c	2001-08-31 22:48:30.000000000 +0200
+++ netpbm-9.25/ppm/ppmtompeg/parallel.c	2004-05-12 11:53:57.814567088 +0200
@@ -343,7 +343,7 @@
 	  free(bigBuffer);
 	}
 
-	bigBuffer = (unsigned char *) malloc(bigBufferSize*
+	bigBuffer = (unsigned char *) malloc2(bigBufferSize,
 					     sizeof(unsigned char));
       }
 
@@ -663,7 +663,7 @@
   
   TransmitPortNum(parallelHostName, portNum, combinePortNum);
   
-  frameDone = (boolean *) malloc(numInputFiles*sizeof(boolean));
+  frameDone = (boolean *) malloc2(numInputFiles, sizeof(boolean));
   memset((char *)frameDone, 0, numInputFiles*sizeof(boolean));
   
   if ( (ofp = fopen(outputFileName, "wb")) == NULL ) {
@@ -1269,6 +1269,8 @@
 
     /* should keep list of port numbers to notify when frames become ready */
 
+    overflow2(numInputFiles, sizeof(int));
+    overflow2(numInputFiles, sizeof(boolean));
     ready = (boolean *) calloc(numInputFiles, sizeof(boolean));
     waitMachine = (int *) calloc(numInputFiles, sizeof(int));
     waitPort = (int *) malloc(numMachines*sizeof(int));
diff -urN netpbm-9.25.orig/ppm/ppmtompeg/psearch.c netpbm-9.25/ppm/ppmtompeg/psearch.c
--- netpbm-9.25.orig/ppm/ppmtompeg/psearch.c	2001-09-26 17:11:53.000000000 +0200
+++ netpbm-9.25/ppm/ppmtompeg/psearch.c	2004-05-12 11:53:57.815566936 +0200
@@ -299,6 +299,13 @@
     ((searchRangeP>searchRangeB)?searchRangeP:searchRangeB)
       : ((searchRangeB>searchRangeB)?searchRangeB:searchRangeB);
     
+    overflow2(searchRangeP, 2);
+    overflow2(searchRangeB, 2);
+    overflow_add(searchRangeP*2, 3);
+    overflow_add(searchRangeB*2, 3);
+    overflow2(2*searchRangeB+3, sizeof(int));
+    overflow2(2*searchRangeP+3, sizeof(int));
+
     pmvHistogram = (int **) malloc((2*searchRangeP+3)*sizeof(int *));
     bbmvHistogram = (int **) malloc((2*searchRangeB+3)*sizeof(int *));
     bfmvHistogram = (int **) malloc((2*searchRangeB+3)*sizeof(int *));
@@ -891,6 +898,9 @@
     int *columnTotals;
     int rowTotal;
 
+    overflow2(searchRangeP, 2);
+    overflow_add(searchRangeP*2,  3);
+    overflow2(searchRangeP*2+3, sizeof(int));
     columnTotals = (int *) calloc(2*searchRangeP+3, sizeof(int));
 
 #ifdef COMPLETE_DISPLAY
@@ -938,6 +948,9 @@
 
     fprintf(fpointer, "B-frame Backwards:\n");
 
+    overflow2(searchRangeB, 2);
+    overflow_add(searchRangeB*2,  3);
+    overflow2(searchRangeB*2+3, sizeof(int));
     columnTotals = (int *) calloc(2*searchRangeB+3, sizeof(int));
 
 #ifdef COMPLETE_DISPLAY
@@ -985,6 +998,9 @@
 
     fprintf(fpointer, "B-frame Forwards:\n");
 
+    overflow2(searchRangeB, 2);
+    overflow_add(searchRangeB*2,  3);
+    overflow2(searchRangeB*2+3, sizeof(int));
     columnTotals = (int *) calloc(2*searchRangeB+3, sizeof(int));
 
 #ifdef COMPLETE_DISPLAY
diff -urN netpbm-9.25.orig/ppm/ppmtompeg/rgbtoycc.c netpbm-9.25/ppm/ppmtompeg/rgbtoycc.c
--- netpbm-9.25.orig/ppm/ppmtompeg/rgbtoycc.c	2000-06-05 04:31:33.000000000 +0200
+++ netpbm-9.25/ppm/ppmtompeg/rgbtoycc.c	2004-05-12 11:53:57.816566784 +0200
@@ -96,6 +96,8 @@
         } 
         table_maxval = maxval;
 
+	overflow_add(table_maxval, 1);
+	overflow2(table_maxval+1, sizeof(float));
         mult299   = malloc((table_maxval+1)*sizeof(float));
         mult587   = malloc((table_maxval+1)*sizeof(float));
         mult114   = malloc((table_maxval+1)*sizeof(float));
diff -urN netpbm-9.25.orig/ppm/ppmtopcx.c netpbm-9.25/ppm/ppmtopcx.c
--- netpbm-9.25.orig/ppm/ppmtopcx.c	2002-02-10 19:34:06.000000000 +0100
+++ netpbm-9.25/ppm/ppmtopcx.c	2004-05-12 11:53:57.797569672 +0200
@@ -185,6 +185,8 @@
         else                    Planes = 1;
     }
 
+    overflow2(BitsPerPixel, cols);
+    overflow_add(BitsPerPixel * cols, 7);
     BytesPerLine    = ((cols * BitsPerPixel) + 7) / 8;
     rawrow = (unsigned char *)pm_allocrow(cols, sizeof(unsigned char));
     planesrow = (unsigned char *)
diff -urN netpbm-9.25.orig/ppm/ppmtopict.c netpbm-9.25/ppm/ppmtopict.c
--- netpbm-9.25.orig/ppm/ppmtopict.c	1993-10-04 10:12:45.000000000 +0100
+++ netpbm-9.25/ppm/ppmtopict.c	2004-05-12 11:53:57.786571344 +0200
@@ -246,6 +246,8 @@
 	putShort(stdout, 0);			/* mode */
 
 	/* Finally, write out the data. */
+	overflow_add(cols/MAX_COUNT, 1);
+        overflow_add(cols, cols/MAX_COUNT+1);
 	packed = (char*) malloc((unsigned)(cols+cols/MAX_COUNT+1));
 	oc = 0;
 	for (row = 0; row < rows; row++)
diff -urN netpbm-9.25.orig/ppm/ppmtopj.c netpbm-9.25/ppm/ppmtopj.c
--- netpbm-9.25.orig/ppm/ppmtopj.c	2000-03-03 07:09:24.000000000 +0100
+++ netpbm-9.25/ppm/ppmtopj.c	2004-05-12 11:53:57.787571192 +0200
@@ -176,6 +176,7 @@
 	pixels = ppm_readppm( ifp, &cols, &rows, &maxval );
 
 	pm_close( ifp );
+	overflow2(cols,2);
 	obuf = (unsigned char *) pm_allocrow(cols, sizeof(unsigned char));
 	cbuf = (unsigned char *) pm_allocrow(cols * 2, sizeof(unsigned char));
 
diff -urN netpbm-9.25.orig/ppm/ppmtouil.c netpbm-9.25/ppm/ppmtouil.c
--- netpbm-9.25.orig/ppm/ppmtouil.c	2002-01-04 16:24:54.000000000 +0100
+++ netpbm-9.25/ppm/ppmtouil.c	2004-05-12 11:53:57.787571192 +0200
@@ -201,6 +201,7 @@
     int d;
 
     /* Allocate memory for printed number.  Abort if error. */
+    overflow_add(digits, 1);
     str = (char*) malloc( digits + 1 );
     if ( str == 0 )
 	pm_error( "out of memory allocating number string" );
@@ -268,6 +269,7 @@
 	    }
 
 	/* Copy it. */
+	overflow_add(strlen(colorname), 1);
 	cmap[i].rgbname = (char*) malloc( strlen( colorname ) + 1 );
 	if ( cmap[i].rgbname == 0 )
 	    pm_error( "out of memory allocating color name" );
diff -urN netpbm-9.25.orig/ppm/ppmtowinicon.c netpbm-9.25/ppm/ppmtowinicon.c
--- netpbm-9.25.orig/ppm/ppmtowinicon.c	2002-01-28 04:42:08.000000000 +0100
+++ netpbm-9.25/ppm/ppmtowinicon.c	2004-05-12 11:53:57.803568760 +0200
@@ -27,6 +27,8 @@
  */
 
 #include <math.h>
+#include <string.h>
+#include <stdlib.h>
 #include "winico.h"
 #include "ppm.h"
 #include "ppmcmap.h"
@@ -193,12 +195,12 @@
       wt = (wt & ~3) + 4;
    }
    xBytes = wt;
-   rowData = malloc ( rows * sizeof (char *));
+   rowData = malloc2 ( rows,  sizeof (char *));
    icBitmap->xBytes = xBytes;
    icBitmap->data   = rowData;
    icBitmap->size   = xBytes * rows;
    for (y=0;y<rows;y++) {
-      u1 * row = malloc ( xBytes * sizeof (u1));
+      u1 * row = malloc2 ( xBytes , sizeof (u1));
       int byteOn = 0;
       int bitOn = 128;
       int value;
@@ -250,13 +252,15 @@
       wt = (wt & ~3) + 4;
    }
    xBytes = wt;
-   rowData = malloc ( rows * sizeof (char *));
+   rowData = malloc2 ( rows , sizeof (char *));
    icBitmap->xBytes = xBytes;
    icBitmap->data   = rowData;
+   overflow2(xBytes, rows);
    icBitmap->size   = xBytes * rows;
+   overflow2(xBytes, rows);
 
    for (y=0;y<rows;y++) {
-      u1 * row = malloc ( xBytes * sizeof (u1));
+      u1 * row = malloc2 ( xBytes, sizeof (u1));
       int byteOn = 0;
       int nibble = 1;   /* high nibble = 1, low nibble = 0; */
       int value;
@@ -304,13 +308,14 @@
       wt = (wt & ~3) + 4;
    }
    xBytes = wt;
-   rowData = malloc ( rows * sizeof (char *));
+   rowData = malloc2 ( rows,  sizeof (char *));
    icBitmap->xBytes = xBytes;
    icBitmap->data   = rowData;
    icBitmap->size   = xBytes * rows;
+   overflow2(xBytes, rows);
 
    for (y=0;y<rows;y++) {
-      u1 * row = malloc ( xBytes * sizeof (u1));
+      u1 * row = malloc2 ( xBytes, sizeof (u1));
       memset (row, 0, xBytes);
       rowData[rows-y-1] = row;
       /* 
@@ -351,7 +356,7 @@
 createCleanPalette(void) {
    IC_Palette palette = malloc ( sizeof (* palette) );
    int x;
-   palette->colors = malloc (MAXCOLORS * sizeof(IC_Color *));
+   palette->colors = malloc(MAXCOLORS * sizeof(IC_Color *));
    for (x=0;x<MAXCOLORS;x++ ){
       palette->colors[x] = NULL;
    }
diff -urN netpbm-9.25.orig/ppm/ppmtoxpm.c netpbm-9.25/ppm/ppmtoxpm.c
--- netpbm-9.25.orig/ppm/ppmtoxpm.c	2002-03-13 04:23:45.000000000 +0100
+++ netpbm-9.25/ppm/ppmtoxpm.c	2004-05-12 11:53:57.764574688 +0200
@@ -207,6 +207,7 @@
         continue;
     }
     /* Allocate memory for ascii name.  Abort if error. */
+    overflow_add(strlen(name), 1);
     if (!(rgbname = (char *) malloc(strlen(name) + 1)))
         pm_error("out of memory allocating rgb name");
         
@@ -251,6 +252,7 @@
     int i;
 
     /* Allocate memory for printed number.  Abort if error. */
+    overflow_add(digits, 1);
     if (!(str = (char *) malloc(digits + 1)))
         pm_error("out of memory");
 
@@ -292,7 +294,8 @@
     char *str;
     cixel_map * cmap;  /* malloc'ed */
 
-    cmap = malloc(sizeof(cixel_map) * (ncolors+1));
+    overflow_add(ncolors,1);
+    cmap = malloc2(sizeof(cixel_map), (ncolors+1));
     if (cmapP == NULL)
         pm_error("Out of memory allocating %d bytes for a color map.",
                  sizeof(cixel_map) * (ncolors+1));
@@ -384,6 +387,7 @@
         if (r == rgbn[j].r && g == rgbn[j].g && b == rgbn[j].b) {
 
             /* Matched.  Allocate string, copy mnemonic, and exit. */
+            overflow_add(strlen(rgbn[j].name), 1);
             if (!(str = (char *) malloc(strlen(rgbn[j].name) + 1)))
             pm_error("out of memory");
             strcpy(str, rgbn[j].name);
diff -urN netpbm-9.25.orig/ppm/qrttoppm.c netpbm-9.25/ppm/qrttoppm.c
--- netpbm-9.25.orig/ppm/qrttoppm.c	1993-10-04 10:12:56.000000000 +0100
+++ netpbm-9.25/ppm/qrttoppm.c	2004-05-12 11:53:57.788571040 +0200
@@ -46,7 +46,7 @@
 
     ppm_writeppminit( stdout, cols, rows, maxval, 0 );
     pixelrow = ppm_allocrow( cols );
-    buf = (unsigned char *) malloc( 3 * cols );
+    buf = (unsigned char *) malloc2( 3 , cols );
     if ( buf == (unsigned char *) 0 )
 	pm_error( "out of memory" );
 
diff -urN netpbm-9.25.orig/ppm/sldtoppm.c netpbm-9.25/ppm/sldtoppm.c
--- netpbm-9.25.orig/ppm/sldtoppm.c	2000-03-03 07:15:55.000000000 +0100
+++ netpbm-9.25/ppm/sldtoppm.c	2004-05-12 11:53:57.789570888 +0200
@@ -303,6 +303,8 @@
 
     /* Allocate image buffer and clear it to black. */
 
+    overflow_add(ixdots,1);
+    overflow_add(iydots,1);
     pixels = ppm_allocarray(pixcols = ixdots + 1, pixrows = iydots + 1);
     PPM_ASSIGN(rgbcolour, 0, 0, 0);
     ppmd_filledrectangle(pixels, pixcols, pixrows, pixmaxval, 0, 0,
diff -urN netpbm-9.25.orig/ppm/ximtoppm.c netpbm-9.25/ppm/ximtoppm.c
--- netpbm-9.25.orig/ppm/ximtoppm.c	2000-06-09 09:33:33.000000000 +0200
+++ netpbm-9.25/ppm/ximtoppm.c	2004-05-12 11:53:57.794570128 +0200
@@ -239,6 +239,7 @@
     header->bits_channel = atoi(a_head.bits_per_channel);
     header->alpha_flag = atoi(a_head.alpha_channel);
     if (strlen(a_head.author)) {
+    	overflow_add(strlen(a_head.author),1);
         if (!(header->author = calloc((unsigned int)strlen(a_head.author)+1,
                 1))) {
             pm_message("ReadXimHeader: can't calloc author string" );
@@ -248,6 +249,7 @@
         strncpy(header->author, a_head.author, strlen(a_head.author));
     }
     if (strlen(a_head.date)) {
+        overflow_add(strlen(a_head.date),1);
         if (!(header->date =calloc((unsigned int)strlen(a_head.date)+1,1))){
             pm_message("ReadXimHeader: can't calloc date string" );
             return(0);
@@ -256,6 +258,7 @@
         strncpy(header->date, a_head.date, strlen(a_head.date));
     }
     if (strlen(a_head.program)) {
+        overflow_add(strlen(a_head.program),1);
         if (!(header->program = calloc(
                     (unsigned int)strlen(a_head.program) + 1, 1))) {
             pm_message("ReadXimHeader: can't calloc program string" );
@@ -282,6 +285,7 @@
     if (header->nchannels == 3 && header->bits_channel == 8)
         header->ncolors = 0;
     else if (header->nchannels == 1 && header->bits_channel == 8) {
+	overflow2(header->ncolors, sizeof(Color));
         header->colors = (Color *)calloc((unsigned int)header->ncolors,
                 sizeof(Color));
         if (header->colors == NULL) {
diff -urN netpbm-9.25.orig/ppm/xpmtoppm.c netpbm-9.25/ppm/xpmtoppm.c
--- netpbm-9.25.orig/ppm/xpmtoppm.c	2002-01-04 16:34:39.000000000 +0100
+++ netpbm-9.25/ppm/xpmtoppm.c	2004-05-12 11:53:57.799569368 +0200
@@ -528,7 +528,7 @@
     } else {
         /* Over two chars per pixel, we fall back on linear search. */
         *colorsP = ppm_allocrow(*ncolorsP);
-        *ptabP = (int *) malloc(*ncolorsP * sizeof(int));
+        *ptabP = (int *) malloc2(*ncolorsP, sizeof(int));
     }
 
     /* Read color table. */
@@ -674,8 +674,9 @@
                        &ncolors, colorsP, &ptab);
         *transparentP = -1;  /* No transparency in version 1 */
     }
+    overflow2(*widthP, *heightP);
     totalpixels = *widthP * *heightP;
-    *dataP = (int *) malloc(totalpixels * sizeof(int));
+    *dataP = (int *) malloc2(totalpixels, sizeof(int));
     if (*dataP == NULL)
         pm_error("Could not get %d bytes of memory for image", totalpixels);
     cursor = *dataP;
diff -urN netpbm-9.25.orig/ppm/yuvtoppm.c netpbm-9.25/ppm/yuvtoppm.c
--- netpbm-9.25.orig/ppm/yuvtoppm.c	2000-07-27 01:35:16.000000000 +0200
+++ netpbm-9.25/ppm/yuvtoppm.c	2004-05-12 11:53:57.794570128 +0200
@@ -71,7 +71,8 @@
 
 	ppm_writeppminit(stdout, cols, rows, (pixval) 255, 0);
 	pixrow = ppm_allocrow(cols);
-	yuvbuf = malloc(((cols+1)/2)*sizeof(struct yuv));
+	overflow_add(cols, 1);
+	yuvbuf = malloc2(((cols+1)/2), sizeof(struct yuv));
 
 	for (row = 0; row < rows; ++row) {
 		int    col;
diff -urN netpbm-9.25.orig/urt/README netpbm-9.25/urt/README
--- netpbm-9.25.orig/urt/README	2000-06-02 22:53:04.000000000 +0200
+++ netpbm-9.25/urt/README	2004-05-12 11:53:57.830564656 +0200
@@ -18,3 +18,8 @@
 defines stdout as a variable, so that wouldn't compile.  So I changed
 it to NULL and added a line to rle_hdr_init to set that field to
 'stdout' dynamically.  2000.06.02 BJH.
+
+Redid the code to check for maths overflows and other crawly horrors.
+Removed pipe through and compress support (unsafe)
+
+Alan Cox <alan@redhat.com>
diff -urN netpbm-9.25.orig/urt/Runput.c netpbm-9.25/urt/Runput.c
--- netpbm-9.25.orig/urt/Runput.c	2002-03-13 05:24:43.000000000 +0100
+++ netpbm-9.25/urt/Runput.c	2004-05-12 11:53:57.827565112 +0200
@@ -17,6 +17,8 @@
  *
  *  Modified at BRL 16-May-88 by Mike Muuss to avoid Alliant STDC desire
  *  to have all "void" functions so declared.
+ *
+ *  2002-12-19: Fix maths wrapping bugs. Alan Cox <alan@redhat.com>
  */
 /* 
  * Runput.c - General purpose Run Length Encoding.
@@ -200,9 +202,11 @@
     if ( the_hdr->background != 0 )
     {
 	register int i;
-	register rle_pixel *background =
-	    (rle_pixel *)malloc( (unsigned)(the_hdr->ncolors + 1) );
+	register rle_pixel *background;
 	register int *bg_color;
+
+	overflow_add(the_hdr->ncolors,1);
+	background = (rle_pixel *)malloc( (unsigned)(the_hdr->ncolors + 1) );
 	/* 
 	 * If even number of bg color bytes, put out one more to get to 
 	 * 16 bit boundary.
@@ -222,7 +226,7 @@
 	/* Big-endian machines are harder */
 	register int i, nmap = (1 << the_hdr->cmaplen) *
 			       the_hdr->ncmap;
-	register char *h_cmap = (char *)malloc( nmap * 2 );
+	register char *h_cmap = (char *)malloc2( nmap, 2 );
 	if ( h_cmap == NULL )
 	{
 	    fprintf( stderr,
diff -urN netpbm-9.25.orig/urt/rle.h netpbm-9.25/urt/rle.h
--- netpbm-9.25.orig/urt/rle.h	2002-03-13 16:32:34.000000000 +0100
+++ netpbm-9.25/urt/rle.h	2004-05-12 11:53:57.827565112 +0200
@@ -14,6 +14,9 @@
  * If you modify this software, you should include a notice giving the
  * name of the person performing the modification, the date of modification,
  * and the reason for such modification.
+ *
+ *  2002-12-19: Fix maths wrapping bugs. Alan Cox <alan@redhat.com>
+ *  Header declarations needed
  */
 /* 
  * rle.h - Global declarations for Utah Raster Toolkit RLE programs.
@@ -169,6 +172,16 @@
  */
 extern rle_hdr rle_dflt_hdr;
 
+/*
+ * Provided by pm library
+ */
+
+extern void overflow_add(int, int);
+extern void overflow2(int, int);
+extern void overflow3(int, int, int);
+extern void *malloc2(int, int);
+extern void *malloc3(int, int, int);
+extern void *realloc2(void *, int, int);
 
 /* Declare RLE library routines. */
 
diff -urN netpbm-9.25.orig/urt/rle_addhist.c netpbm-9.25/urt/rle_addhist.c
--- netpbm-9.25.orig/urt/rle_addhist.c	1992-04-30 16:07:45.000000000 +0200
+++ netpbm-9.25/urt/rle_addhist.c	2004-05-12 11:53:57.829564808 +0200
@@ -14,6 +14,8 @@
  * If you modify this software, you should include a notice giving the
  * name of the person performing the modification, the date of modification,
  * and the reason for such modification.
+ *
+ *  2002-12-19: Fix maths wrapping bugs. Alan Cox <alan@redhat.com>
  */
 /* 
  * rle_addhist.c - Add to the HISTORY comment in header
@@ -68,19 +70,29 @@
 
 	length=0;
 	for(i=0;argv[i];i++)
+	{
+		overflow_add(length, strlen(argv[i]));
+		overflow_add(length+1, strlen(argv[i]));
 		length+= strlen(argv[i]) +1;					/* length of each arg plus space. */
-
+	}
 	(void)time (&temp);
 	timedate=ctime(&temp);
 	length+= strlen(timedate);						/* length of date and time in ASCII. */
 
+	overflow_add(strlen(padding), 4);
+	overflow_add(strlen(padding)+4, strlen(histoire));
+	overflow_add(length, strlen(padding)+4 + strlen(histoire));
 	length+= strlen(padding) + 3 + strlen(histoire) + 1;			/* length of padding, "on "  and length of history name plus "="*/
 	if(in_hdr)								/* if we are interested in the old comments... */
 		old=rle_getcom(histoire,in_hdr);				/* get old comment. */
 
-	if((old) && (*old)) length+= strlen(old);				/* add length if there. */
+	if((old) && (*old))
+	{
+		overflow_add(length, strlen(old));
+		length+= strlen(old);				/* add length if there. */
+	}
 
-	length++;								/*Cater for the null. */
+	overflow_add(length, 1);
 
 	if((newc=(char *)malloc((unsigned int) length)) == NULL)return;
 
@@ -94,5 +106,4 @@
 	(void)strcat(newc,padding);							/* to line up multiple histories.*/
 
 	(void)rle_putcom(newc,out_hdr);
-
 }
diff -urN netpbm-9.25.orig/urt/rle_getrow.c netpbm-9.25/urt/rle_getrow.c
--- netpbm-9.25.orig/urt/rle_getrow.c	2002-03-13 05:24:04.000000000 +0100
+++ netpbm-9.25/urt/rle_getrow.c	2004-05-12 11:53:57.825565416 +0200
@@ -17,6 +17,8 @@
  *
  *  Modified at BRL 16-May-88 by Mike Muuss to avoid Alliant STDC desire
  *  to have all "void" functions so declared.
+ *
+ *  2002-12-19: Fix maths wrapping bugs. Alan Cox <alan@redhat.com>
  */
 /* 
  * rle_getrow.c - Read an RLE file in.
@@ -100,10 +102,8 @@
 
     if ( !(setup.h_flags & H_NO_BACKGROUND) && setup.h_ncolors > 0 )
     {
-	the_hdr->bg_color = (int *)malloc(
-	    (unsigned)(sizeof(int) * setup.h_ncolors) );
-	bg_color = (rle_pixel *)malloc(
-	    (unsigned)(1 + (setup.h_ncolors / 2) * 2) );
+	the_hdr->bg_color = (int *)malloc2(sizeof(int), setup.h_ncolors);
+	bg_color = (rle_pixel *)malloc2(1 + (setup.h_ncolors / 2),2);
 	RLE_CHECK_ALLOC( the_hdr->cmd, the_hdr->bg_color && bg_color,
 			 "background color" );
 	fread( (char *)bg_color, 1, 1 + (setup.h_ncolors / 2) * 2, infile );
@@ -145,9 +145,8 @@
 	register int i;
 	register char *maptemp;
 
-	the_hdr->cmap = (rle_map *)malloc(
-	    (unsigned)(sizeof(rle_map) * maplen) );
-	maptemp = (char *)malloc( 2 * maplen );
+	the_hdr->cmap = (rle_map *)malloc2(sizeof(rle_map), maplen);
+	maptemp = (char *)malloc2(2, maplen);
 	if ( the_hdr->cmap == NULL || maptemp == NULL )
 	{
 	    fprintf( stderr,
@@ -170,6 +169,8 @@
 	register char * cp;
 
 	VAXSHORT( comlen, infile );	/* get comment length */
+
+	overflow_add(comlen, 1);
 	evenlen = (comlen + 1) & ~1;	/* make it even */
 	if ( evenlen )
 	{
@@ -190,7 +191,7 @@
 	    i++;			/* extra for NULL pointer at end */
 	    /* Get space to put pointers to comments */
 	    the_hdr->comments =
-		(CONST_DECL char **)malloc( (unsigned)(i * sizeof(char *)) );
+		(CONST_DECL char **)malloc2(i, sizeof(char *));
 	    if ( the_hdr->comments == NULL )
 	    {
 		fprintf( stderr,
diff -urN netpbm-9.25.orig/urt/rle_hdr.c netpbm-9.25/urt/rle_hdr.c
--- netpbm-9.25.orig/urt/rle_hdr.c	2000-06-09 09:49:51.000000000 +0200
+++ netpbm-9.25/urt/rle_hdr.c	2004-05-12 11:53:57.826565264 +0200
@@ -14,6 +14,8 @@
  * If you modify this software, you should include a notice giving the
  * name of the person performing the modification, the date of modification,
  * and the reason for such modification.
+ *
+ *  2002-12-19: Fix maths wrapping bugs. Alan Cox <alan@redhat.com>
  */
 /* 
  * rle_hdr.c - Functions to manipulate rle_hdr structures.
@@ -77,7 +79,10 @@
     /* Fill in with copies of the strings. */
     if ( the_hdr->cmd != pgmname )
     {
-	char *tmp = (char *)malloc( strlen( pgmname ) + 1 );
+	char *tmp ;
+
+	overflow_add(strlen(pgmname), 1);
+	tmp = malloc( strlen( pgmname ) + 1 );
 	RLE_CHECK_ALLOC( pgmname, tmp, 0 );
 	strcpy( tmp, pgmname );
 	the_hdr->cmd = tmp;
@@ -85,7 +90,9 @@
 
     if ( the_hdr->file_name != fname )
     {
-	char *tmp = (char *)malloc( strlen( fname ) + 1 );
+	char *tmp;
+	overflow_add(strlen(fname), 1);
+	tmp = malloc( strlen( fname ) + 1 );
 	RLE_CHECK_ALLOC( pgmname, tmp, 0 );
 	strcpy( tmp, fname );
 	the_hdr->file_name = tmp;
@@ -150,6 +157,7 @@
     if ( to_hdr->bg_color )
     {
 	int size = to_hdr->ncolors * sizeof(int);
+	overflow2(to_hdr->ncolors, sizeof(int));
 	to_hdr->bg_color = (int *)malloc( size );
 	RLE_CHECK_ALLOC( to_hdr->cmd, to_hdr->bg_color, "background color" );
 	memcpy( to_hdr->bg_color, from_hdr->bg_color, size );
@@ -158,7 +166,7 @@
     if ( to_hdr->cmap )
     {
 	int size = to_hdr->ncmap * (1 << to_hdr->cmaplen) * sizeof(rle_map);
-	to_hdr->cmap = (rle_map *)malloc( size );
+	to_hdr->cmap = (rle_map *)malloc3( to_hdr->ncmap, 1<<to_hdr->cmaplen, sizeof(rle_map));
 	RLE_CHECK_ALLOC( to_hdr->cmd, to_hdr->cmap, "color map" );
 	memcpy( to_hdr->cmap, from_hdr->cmap, size );
     }
@@ -171,11 +179,16 @@
 	int size = 0;
 	CONST_DECL char **cp;
 	for ( cp=to_hdr->comments; *cp; cp++ )
+	{
+	    overflow_add(size, 1);
 	    size++;		/* Count the comments. */
+ 	}
 	/* Check if there are really any comments. */
 	if ( size )
 	{
+	    overflow_add(size, 1);
 	    size++;		/* Copy the NULL pointer, too. */
+	    overflow2(size, sizeof(char *));
 	    size *= sizeof(char *);
 	    to_hdr->comments = (CONST_DECL char **)malloc( size );
 	    RLE_CHECK_ALLOC( to_hdr->cmd, to_hdr->comments, "comments" );
diff -urN netpbm-9.25.orig/urt/rle_open_f.c netpbm-9.25/urt/rle_open_f.c
--- netpbm-9.25.orig/urt/rle_open_f.c	2002-03-13 16:35:54.000000000 +0100
+++ netpbm-9.25/urt/rle_open_f.c	2004-05-12 11:53:57.824565568 +0200
@@ -6,6 +6,9 @@
  * 		University of Michigan
  * Date:	11/14/89
  * Copyright (c) 1990, University of Michigan
+ *
+ *  2002-12-19: Fix maths wrapping bugs. Alan Cox <alan@redhat.com>
+ *  Killed of crazy unsafe pipe/compress stuff
  */
 
 #include "rle.h"
@@ -130,7 +133,7 @@
 	    
 	cp = file_name + strlen( (char*) file_name ) - 2;
 	/* Pipe case. */
-	if ( *file_name == '|' )
+	if ( *file_name == '|'  && 0 /* BOLLOCKS ARE WE DOING THIS ANY MORE */)
 	{
 	    int thepid;		/* PID from my_popen */
 	    if ( (fp = my_popen( file_name + 1, mode, &thepid )) == NULL )
@@ -150,9 +153,10 @@
 	}
 
 	/* Compress case. */
-	else if ( cp > file_name && *cp == '.' && *(cp + 1) == 'Z' )
+	else if (/* SMOKING SOMETHING */ 0 &&  cp > file_name && *cp == '.' && *(cp + 1) == 'Z' )
 	{
 	    int thepid;		/* PID from my_popen. */
+	    overflow_add(20, strlen(file_name));
 	    combuf = (char *)malloc( 20 + strlen( file_name ) );
 	    if ( combuf == NULL )
 	    {
diff -urN netpbm-9.25.orig/urt/rle_putcom.c netpbm-9.25/urt/rle_putcom.c
--- netpbm-9.25.orig/urt/rle_putcom.c	2000-05-19 01:12:22.000000000 +0200
+++ netpbm-9.25/urt/rle_putcom.c	2004-05-12 11:53:57.830564656 +0200
@@ -14,6 +14,8 @@
  * If you modify this software, you should include a notice giving the
  * name of the person performing the modification, the date of modification,
  * and the reason for such modification.
+ *
+ *  2002-12-19: Fix maths wrapping bugs. Alan Cox <alan@redhat.com>
  */
 /* 
  * rle_putcom.c - Add a picture comment to the header struct.
@@ -89,19 +91,22 @@
 
     if ( the_hdr->comments == NULL )
     {
-	the_hdr->comments = (CONST_DECL char **)malloc( 2 * sizeof(char *) );
+	the_hdr->comments = (CONST_DECL char **)malloc2( 2, sizeof(char *) );
 	the_hdr->comments[0] = value;
 	the_hdr->comments[1] = NULL;
     }
     else
     {
 	for ( i = 2, cp = the_hdr->comments; *cp != NULL; i++, cp++ )
+	{
+	    overflow_add(i, 1);
 	    if ( match( value, *cp ) != NULL )
 	    {
 		v = *cp;
 		*cp = value;
 		return v;
 	    }
+	}
 	/* Not found */
 	/* Can't realloc because somebody else might be pointing to this
 	 * comments block.  Of course, if this were true, then the
@@ -111,7 +116,7 @@
 	 * could copy the pointers, too.
 	 */
 	old_comments = the_hdr->comments;
-	the_hdr->comments = (CONST_DECL char **)malloc(i * sizeof(char *) );
+	the_hdr->comments = (CONST_DECL char **)malloc2(i , sizeof(char *) );
 	the_hdr->comments[--i] = NULL;
 	the_hdr->comments[--i] = value;
 	for ( i--; i >= 0; i-- )
diff -urN netpbm-9.25.orig/urt/scanargs.c netpbm-9.25/urt/scanargs.c
--- netpbm-9.25.orig/urt/scanargs.c	2002-03-13 05:28:13.000000000 +0100
+++ netpbm-9.25/urt/scanargs.c	2004-05-12 11:53:57.828564960 +0200
@@ -38,6 +38,8 @@
  *
  *  Modified at BRL 16-May-88 by Mike Muuss to avoid Alliant STDC desire
  *  to have all "void" functions so declared.
+ *
+ *  2002-12-19: Fix maths wrapping bugs. Alan Cox <alan@redhat.com>
  */
 
 #include "rle.h"
@@ -63,8 +65,8 @@
 /* 
  * Storage allocation macros
  */
-#define NEW( type, cnt )	(type *) malloc( (cnt) * sizeof( type ) )
-#define RENEW( type, ptr, cnt )	(type *) realloc( ptr, (cnt) * sizeof( type ) )
+#define NEW( type, cnt )	(type *) malloc2( (cnt) , sizeof( type ) )
+#define RENEW( type, ptr, cnt )	(type *) realloc2( ptr, (cnt), sizeof( type ) )
 
 #if defined(c_plusplus) && !defined(USE_PROTOTYPES)
 #define USE_PROTOTYPES
diff -urN netpbm-9.25.orig/ppm/Makefile netpbm-9.25/ppm/Makefile
--- netpbm-9.25.orig/ppm/Makefile	Wed Mar 13 03:09:21 2002
+++ netpbm-9.25/ppm/Makefile	Wed May 12 12:23:40 2004
@@ -36,7 +36,7 @@
 
 PORTBINARIES =	411toppm eyuvtoppm gouldtoppm ilbmtoppm imgtoppm \
 		leaftoppm mtvtoppm neotoppm \
-		pcxtoppm pgmtoppm pi1toppm picttoppm \
+		pcxtoppm pgmtoppm pi1toppm \
 		pjtoppm \
 		ppm3d ppmbrighten ppmchange ppmcolormask ppmcolors \
 		ppmdim ppmdist ppmdither \