--- /dev/null
+Index: cgi-bin/var.c
+===================================================================
+RCS file: /development/cvs/cups/cgi-bin/var.c,v
+retrieving revision 1.21
+retrieving revision 1.22
+diff -u -r1.21 -r1.22
+--- cgi-bin/var.c 2002/01/02 17:58:37 1.21
++++ cgi-bin/var.c 2002/12/12 20:56:29 1.22
+@@ -242,7 +242,7 @@
+ var_t *var; /* Returned variable */
+
+
+- if (name == NULL || value == NULL || element < 0)
++ if (name == NULL || value == NULL || element < 0 || element > 100000)
+ return;
+
+ if ((var = cgi_find_variable(name)) == NULL)
+@@ -286,7 +286,7 @@
+ var_t *var; /* Returned variable */
+
+
+- if (name == NULL || size < 0)
++ if (name == NULL || size < 0 || size > 100000)
+ return;
+
+ if ((var = cgi_find_variable(name)) == NULL)
+@@ -361,7 +361,7 @@
+ var_t *var; /* New variable */
+
+
+- if (name == NULL || value == NULL)
++ if (name == NULL || value == NULL || element < 0 || element > 100000)
+ return;
+
+ #ifdef DEBUG
+Index: conf/cupsd.conf.in
+===================================================================
+RCS file: /development/cvs/cups/conf/cupsd.conf.in,v
+retrieving revision 1.7
+retrieving revision 1.8
+diff -u -r1.7 -r1.8
+--- conf/cupsd.conf.in.orig 2001-09-14 18:52:05.000000000 +0200
++++ conf/cupsd.conf.in 2002-12-17 13:36:34.000000000 +0100
+@@ -358,6 +358,15 @@
+ #MaxClients 100
+
+ #
++# MaxClientsPerHost: controls the maximum number of simultaneous clients that
++# will be handled from a specific host. Defaults to 10 or 1/10th of the
++# MaxClients setting, whichever is larger. A value of 0 specifies the
++# automatic (10 or 1/10th) setting.
++#
++
++#MaxClientsPerHost 0
++
++#
+ # MaxRequestSize: controls the maximum size of HTTP requests and print files.
+ # Set to 0 to disable this feature (defaults to 0.)
+ #
+Index: cups/http.c
+===================================================================
+RCS file: /development/cvs/cups/cups/http.c,v
+retrieving revision 1.105
+retrieving revision 1.107
+diff -u -r1.105 -r1.107
+--- cups/http.c 2002/10/30 20:04:56 1.105
++++ cups/http.c 2002/12/12 21:44:42 1.107
+@@ -896,11 +896,16 @@
+ }
+
+ http->data_remaining = strtol(len, NULL, 16);
++ if (http->data_remaining < 0)
++ {
++ DEBUG_puts("httpRead: Negative chunk length!");
++ return (0);
++ }
+ }
+
+ DEBUG_printf(("httpRead: data_remaining = %d\n", http->data_remaining));
+
+- if (http->data_remaining == 0)
++ if (http->data_remaining <= 0)
+ {
+ /*
+ * A zero-length chunk ends a transfer; unless we are reading POST
+Index: filter/image-bmp.c
+===================================================================
+RCS file: /development/cvs/cups/filter/image-bmp.c,v
+retrieving revision 1.8
+retrieving revision 1.9
+diff -u -r1.8 -r1.9
+--- filter/image-bmp.c 2002/04/19 16:17:26 1.8
++++ filter/image-bmp.c 2002/12/13 15:52:20 1.9
+@@ -105,8 +105,15 @@
+ read_word(fp);
+ offset = read_dword(fp);
+
+- fprintf(stderr, "offset = %d\n", offset);
++ fprintf(stderr, "DEBUG: offset = %d\n", offset);
+
++ if (offset < 0)
++ {
++ fprintf(stderr, "ERROR: Bad BMP offset %d\n", offset);
++ fclose(fp);
++ return (1);
++ }
++
+ /*
+ * Then the bitmap information...
+ */
+@@ -123,15 +130,34 @@
+ colors_used = read_dword(fp);
+ colors_important = read_dword(fp);
+
++ if (img->xsize == 0 || img->xsize > IMAGE_MAX_WIDTH ||
++ img->ysize == 0 || img->ysize > IMAGE_MAX_HEIGHT ||
++ (depth != 1 && depth != 4 && depth != 8 && depth != 24))
++ {
++ fprintf(stderr, "ERROR: Bad BMP dimensions %ux%ux%d\n",
++ img->xsize, img->ysize, depth);
++ fclose(fp);
++ return (1);
++ }
++
++ if (colors_used < 0 || colors_used > 256)
++ {
++ fprintf(stderr, "ERROR: Bad BMP colormap size %d\n", colors_used);
++ fclose(fp);
++ return (1);
++ }
++
++ if (img->xppi == 0 || img->yppi == 0)
++ {
++ fprintf(stderr, "ERROR: Bad BMP resolution %dx%d PPI.\n",
++ img->xppi, img->yppi);
++ img->xppi = img->yppi = 128;
++ }
++
+ /*
+ * Make sure the resolution info is valid...
+ */
+
+- if (img->xppi == 0)
+- img->xppi = 128;
+- if (img->yppi == 0)
+- img->yppi = 128;
+-
+ fprintf(stderr, "info_size = %d, xsize = %d, ysize = %d, planes = %d, depth = %d\n",
+ info_size, img->xsize, img->ysize, planes, depth);
+ fprintf(stderr, "compression = %d, image_size = %d, xppi = %d, yppi = %d\n",
+@@ -150,7 +176,8 @@
+ if (colors_used == 0 && depth <= 8)
+ colors_used = 1 << depth;
+
+- fread(colormap, colors_used, 4, fp);
++ if (colors_used > 0)
++ fread(colormap, colors_used, 4, fp);
+
+ /*
+ * Setup image and buffers...
+
+
+
+Index: filter/image-gif.c
+===================================================================
+RCS file: /development/cvs/cups/filter/image-gif.c,v
+retrieving revision 1.13
+retrieving revision 1.15
+diff -u -r1.13 -r1.15
+--- filter/image-gif.c 2002/11/27 04:43:53 1.13
++++ filter/image-gif.c 2002/12/13 15:52:20 1.15
+@@ -233,6 +233,19 @@
+ img->xsize = (buf[5] << 8) | buf[4];
+ img->ysize = (buf[7] << 8) | buf[6];
+
++ /*
++ * Check the dimensions of the image; since the dimensions are
++ * a 16-bit integer we just need to check for 0...
++ */
++
++ if (img->xsize == 0 || img->ysize == 0)
++ {
++ fprintf(stderr, "ERROR: Bad GIF image dimensions: %dx%d\n",
++ img->xsize, img->ysize);
++ fclose(fp);
++ return (1);
++ }
++
+ i = gif_read_image(fp, img, cmap, buf[8] & GIF_INTERLACE);
+ fclose(fp);
+ return (i);
+Index: filter/image-jpeg.c
+===================================================================
+RCS file: /development/cvs/cups/filter/image-jpeg.c,v
+retrieving revision 1.15
+retrieving revision 1.16
+diff -u -r1.15 -r1.16
+--- filter/image-jpeg.c 2002/04/19 16:17:26 1.15
++++ filter/image-jpeg.c 2002/12/13 15:52:20 1.16
+@@ -126,6 +126,18 @@
+
+ jpeg_calc_output_dimensions(&cinfo);
+
++ if (cinfo.output_width <= 0 || cinfo.output_width > IMAGE_MAX_WIDTH ||
++ cinfo.output_height <= 0 || cinfo.output_height > IMAGE_MAX_HEIGHT)
++ {
++ fprintf(stderr, "ERROR: Bad JPEG dimensions %dx%d!\n",
++ cinfo.output_width, cinfo.output_height);
++
++ jpeg_destroy_decompress(&cinfo);
++
++ fclose(fp);
++ return (1);
++ }
++
+ img->xsize = cinfo.output_width;
+ img->ysize = cinfo.output_height;
+
+@@ -141,6 +153,13 @@
+ img->xppi = (int)((float)cinfo.X_density * 2.54);
+ img->yppi = (int)((float)cinfo.Y_density * 2.54);
+ }
++
++ if (img->xppi == 0 || img->yppi == 0)
++ {
++ fprintf(stderr, "ERROR: Bad JPEG image resolution %dx%d PPI.\n",
++ img->xppi, img->yppi);
++ img->xppi = img->yppi = 128;
++ }
+ }
+
+ fprintf(stderr, "DEBUG: JPEG image %dx%dx%d, %dx%d PPI\n",
+Index: filter/image-pix.c
+===================================================================
+RCS file: /development/cvs/cups/filter/image-pix.c,v
+retrieving revision 1.6
+retrieving revision 1.7
+diff -u -r1.6 -r1.7
+--- filter/image-pix.c 2002/04/19 16:17:27 1.6
++++ filter/image-pix.c 2002/12/13 15:52:20 1.7
+@@ -78,6 +78,21 @@
+ read_short(fp);
+ depth = read_short(fp);
+
++ /*
++ * Check the dimensions of the image. Since the short values used for the
++ * width and height cannot exceed IMAGE_MAX_WIDTH or IMAGE_MAX_HEIGHT, we
++ * just need to verify they are positive integers.
++ */
++
++ if (width <= 0 || height <= 0 ||
++ (depth != 8 && depth != 24))
++ {
++ fprintf(stderr, "ERROR: Bad PIX image dimensions %dx%dx%d\n",
++ width, height, depth);
++ fclose(fp);
++ return (1);
++ }
++
+ if (depth == 8)
+ img->colorspace = secondary;
+ else
+Index: filter/image-png.c
+===================================================================
+RCS file: /development/cvs/cups/filter/image-png.c,v
+retrieving revision 1.14
+retrieving revision 1.15
+diff -u -r1.14 -r1.15
+--- filter/image-png.c 2002/04/19 16:17:27 1.14
++++ filter/image-png.c 2002/12/13 15:52:20 1.15
+@@ -90,6 +90,15 @@
+ else
+ img->colorspace = (primary == IMAGE_RGB_CMYK) ? IMAGE_RGB : primary;
+
++ if (info->width == 0 || info->width > IMAGE_MAX_WIDTH ||
++ info->height == 0 || info->height > IMAGE_MAX_HEIGHT)
++ {
++ fprintf(stderr, "ERROR: PNG image has invalid dimensions %ux%u!\n",
++ (unsigned)info->width, (unsigned)info->height);
++ fclose(fp);
++ return (1);
++ }
++
+ img->xsize = info->width;
+ img->ysize = info->height;
+
+@@ -98,6 +107,14 @@
+ {
+ img->xppi = (int)((float)info->x_pixels_per_unit * 0.0254);
+ img->yppi = (int)((float)info->y_pixels_per_unit * 0.0254);
++
++ if (img->xppi == 0 || img->yppi == 0)
++ {
++ fprintf(stderr, "ERROR: PNG image has invalid resolution %dx%d PPI\n",
++ img->xppi, img->yppi);
++
++ img->xppi = img->yppi = 128;
++ }
+ }
+
+ ImageSetMaxTiles(img, 0);
+Index: filter/image-pnm.c
+===================================================================
+RCS file: /development/cvs/cups/filter/image-pnm.c,v
+retrieving revision 1.10
+retrieving revision 1.11
+diff -u -r1.10 -r1.11
+--- filter/image-pnm.c 2002/04/19 16:17:27 1.10
++++ filter/image-pnm.c 2002/12/13 15:52:20 1.11
+@@ -132,6 +132,22 @@
+ else
+ maxval = 1;
+
++ if (img->xsize == 0 || img->xsize > IMAGE_MAX_WIDTH ||
++ img->ysize == 0 || img->ysize > IMAGE_MAX_HEIGHT)
++ {
++ fprintf(stderr, "ERROR: Bad PNM dimensions %dx%d!\n",
++ img->xsize, img->ysize);
++ fclose(fp);
++ return (1);
++ }
++
++ if (maxval == 0)
++ {
++ fprintf(stderr, "ERROR: Bad PNM max value %d!\n", maxval);
++ fclose(fp);
++ return (1);
++ }
++
+ if (format == 1 || format == 2 || format == 4 || format == 5)
+ img->colorspace = secondary;
+ else
+Index: filter/image-sgi.c
+===================================================================
+RCS file: /development/cvs/cups/filter/image-sgi.c,v
+retrieving revision 1.11
+retrieving revision 1.12
+diff -u -r1.11 -r1.12
+--- filter/image-sgi.c 2002/04/19 16:17:27 1.11
++++ filter/image-sgi.c 2002/12/13 15:52:20 1.12
+@@ -73,6 +73,22 @@
+ * Get the image dimensions and load the output image...
+ */
+
++ /*
++ * Check the image dimensions; since xsize and ysize are unsigned shorts,
++ * just check if they are 0 since they can't exceed IMAGE_MAX_WIDTH or
++ * IMAGE_MAX_HEIGHT...
++ */
++
++ if (sgip->xsize == 0 || sgip->ysize == 0 ||
++ sgip->zsize == 0 || sgip->zsize > 4)
++ {
++ fprintf(stderr, "ERROR: Bad SGI image dimensions %ux%ux%u!\n",
++ sgip->xsize, sgip->ysize, sgip->zsize);
++ sgiClose(sgip);
++ fclose(fp);
++ return (1);
++ }
++
+ if (sgip->zsize < 3)
+ img->colorspace = secondary;
+ else
+Index: filter/image-sun.c
+===================================================================
+RCS file: /development/cvs/cups/filter/image-sun.c,v
+retrieving revision 1.12
+retrieving revision 1.14
+diff -u -r1.12 -r1.14
+--- filter/image-sun.c 2002/10/22 18:43:45 1.12
++++ filter/image-sun.c 2002/12/13 15:52:20 1.14
+@@ -121,6 +121,15 @@
+ fprintf(stderr, "DEBUG: ras_width=%d, ras_height=%d, ras_depth=%d, ras_type=%d, ras_maplength=%d\n",
+ img->xsize, img->ysize, ras_depth, ras_type, ras_maplength);
+
++ if (ras_maplength > 768 ||
++ img->xsize == 0 || img->xsize > IMAGE_MAX_WIDTH ||
++ img->ysize == 0 || img->ysize > IMAGE_MAX_HEIGHT ||
++ ras_depth == 0 || ras_depth > 32)
++ {
++ fputs("ERROR: Raster image cannot be loaded!\n", stderr);
++ return (1);
++ }
++
+ if (ras_maplength > 0)
+ {
+ memset(cmap[0], 255, sizeof(cmap[0]));
+Index: filter/image-tiff.c
+===================================================================
+RCS file: /development/cvs/cups/filter/image-tiff.c,v
+retrieving revision 1.23
+retrieving revision 1.24
+diff -u -r1.23 -r1.24
+--- filter/image-tiff.c 2002/04/19 16:17:27 1.23
++++ filter/image-tiff.c 2002/12/13 15:52:21 1.24
+@@ -173,6 +173,12 @@
+ img->yppi = 128;
+ }
+
++ if (img->xppi == 0 || img->yppi == 0)
++ {
++ fputs("ERROR: Bad TIFF resolution.\n", stderr);
++ img->xppi = img->yppi = 128;
++ }
++
+ fprintf(stderr, "DEBUG: TIFF resolution = %fx%f, units=%d\n",
+ xres, yres, resunit);
+ fprintf(stderr, "DEBUG: Stored resolution = %dx%d PPI\n",
+@@ -189,6 +195,23 @@
+ alpha = 0;
+
+ /*
++ * Check the size of the image...
++ */
++
++ if (width == 0 || width > IMAGE_MAX_WIDTH ||
++ height == 0 || height > IMAGE_MAX_HEIGHT ||
++ (bits != 1 && bits != 2 && bits != 4 && bits != 8) ||
++ samples < 1 || samples > 4)
++ {
++ fprintf(stderr, "ERROR: Bad TIFF dimensions %ux%ux%ux%u!\n",
++ (unsigned)width, (unsigned)height, (unsigned)bits,
++ (unsigned)samples);
++ TIFFClose(tif);
++ fclose(fp);
++ return (1);
++ }
++
++ /*
+ * Setup the image size and colorspace...
+ */
+
+Index: filter/image-zoom.c
+===================================================================
+RCS file: /development/cvs/cups/filter/image-zoom.c,v
+retrieving revision 1.10
+retrieving revision 1.11
+diff -u -r1.10 -r1.11
+--- filter/image-zoom.c 2002/08/27 16:19:38 1.10
++++ filter/image-zoom.c 2002/12/13 15:52:21 1.11
+@@ -58,6 +58,12 @@
+ int flip; /* Flip on X axis? */
+
+
++ if (xsize > IMAGE_MAX_WIDTH ||
++ ysize > IMAGE_MAX_HEIGHT ||
++ (x1 - x0) > IMAGE_MAX_WIDTH ||
++ (y1 - y0) > IMAGE_MAX_HEIGHT)
++ return (NULL); /* Protect against integer overflow */
++
+ if ((z = (izoom_t *)calloc(1, sizeof(izoom_t))) == NULL)
+ return (NULL);
+
+Index: filter/image.h
+===================================================================
+RCS file: /development/cvs/cups/filter/image.h,v
+retrieving revision 1.15
+retrieving revision 1.16
+diff -u -r1.15 -r1.16
+--- filter/image.h 2002/04/29 15:56:58 1.15
++++ filter/image.h 2002/12/13 15:52:21 1.16
+@@ -40,6 +40,13 @@
+
+
+ /*
++ * Maximum image dimensions that we can handle...
++ */
++
++# define IMAGE_MAX_WIDTH 0x07ffffff /* 2^27-1 to allow for 15-channel data */
++# define IMAGE_MAX_HEIGHT 0x7fffffff /* 2^31-1 */
++
++/*
+ * Colorspaces...
+ */
+
+@@ -50,7 +57,6 @@
+ # define IMAGE_RGB 3 /* Red, green, and blue */
+ # define IMAGE_RGB_CMYK 4 /* Use RGB or CMYK */
+
+-
+ /*
+ * Tile definitions...
+ */
+Index: scheduler/client.c
+===================================================================
+RCS file: /development/cvs/cups/scheduler/client.c,v
+retrieving revision 1.128
+retrieving revision 1.130
+diff -u -r1.128 -r1.130
+--- scheduler/client.c 2002/11/21 14:58:18 1.128
++++ scheduler/client.c 2002/12/13 16:24:05 1.130
+@@ -492,6 +520,12 @@
+ LogMessage(L_DEBUG2, "ReadClient() %d, used=%d", con->http.fd,
+ con->http.used);
+
++ if (con->http.error)
++ {
++ CloseClient(con);
++ return (0);
++ }
++
+ switch (con->http.state)
+ {
+ case HTTP_WAITING :
+@@ -944,6 +978,20 @@
+
+ break;
+ }
++ else if (atoi(con->http.fields[HTTP_FIELD_CONTENT_LENGTH]) < 0)
++ {
++ /*
++ * Negative content lengths are invalid!
++ */
++
++ if (!SendError(con, HTTP_BAD_REQUEST))
++ {
++ CloseClient(con);
++ return (0);
++ }
++
++ break;
++ }
+
+ /*
+ * See what kind of POST request this is; for IPP requests the
+Index: scheduler/dirsvc.c
+===================================================================
+RCS file: /development/cvs/cups/scheduler/dirsvc.c,v
+retrieving revision 1.100
+retrieving revision 1.101
+diff -u -r1.100 -r1.101
+--- scheduler/dirsvc.c 2002/09/26 15:19:31 1.100
++++ scheduler/dirsvc.c 2002/12/12 20:56:32 1.101
+@@ -88,6 +88,31 @@
+ httpSeparate(uri, method, username, host, &port, resource);
+
+ /*
++ * Determine if the URI contains any illegal characters in it...
++ */
++
++ if (strncmp(uri, "ipp://", 6) != 0 ||
++ !host[0] ||
++ (strncmp(resource, "/printers/", 10) != 0 &&
++ strncmp(resource, "/classes/", 9) != 0))
++ {
++ LogMessage(L_ERROR, "ProcessBrowseData: Bad printer URI in browse data: %s",
++ uri);
++ return;
++ }
++
++ if (strchr(resource, '?') != NULL ||
++ (strncmp(resource, "/printers/", 10) == 0 &&
++ strchr(resource + 10, '/') != NULL) ||
++ (strncmp(resource, "/classes/", 9) == 0 &&
++ strchr(resource + 9, '/') != NULL))
++ {
++ LogMessage(L_ERROR, "ProcessBrowseData: Bad resource in browse data: %s",
++ resource);
++ return;
++ }
++
++ /*
+ * OK, this isn't a local printer; see if we already have it listed in
+ * the Printers list, and add it if not...
+ */
--- /dev/null
+--- pdftops/GfxState.cxx.pdftops 2002-12-17 11:41:20.000000000 +0000
++++ pdftops/GfxState.cxx 2002-12-17 14:13:52.000000000 +0000
+@@ -12,6 +12,7 @@
+
+ #include <config.h>
+ #include <stddef.h>
++#include <limits.h>
+ #include <math.h>
+ #include <string.h> // for memcpy()
+ #include "gmem.h"
+@@ -749,6 +750,7 @@
+ int indexHighA) {
+ base = baseA;
+ indexHigh = indexHighA;
++ // Checked in GfxIndexedColorSpace::parse
+ lookup = (Guchar *)gmalloc((indexHigh + 1) * base->getNComps() *
+ sizeof(Guchar));
+ }
+@@ -792,9 +794,13 @@
+ }
+ indexHighA = obj1.getInt();
+ obj1.free();
++ n = baseA->getNComps();
++ if ((unsigned int)(indexHighA + 1) >= INT_MAX / (n * sizeof (Guchar))) {
++ error(-1, "Bad Indexed color space (too high)");
++ goto err1;
++ }
+ cs = new GfxIndexedColorSpace(baseA, indexHighA);
+ arr->get(3, &obj1);
+- n = baseA->getNComps();
+ if (obj1.isStream()) {
+ obj1.streamReset();
+ for (i = 0; i <= indexHighA; ++i) {
+@@ -1674,6 +1680,8 @@
+ colorSpace2 = indexedCS->getBase();
+ indexHigh = indexedCS->getIndexHigh();
+ nComps2 = colorSpace2->getNComps();
++ if ((unsigned int)(indexHigh + 1) >= INT_MAX / (nComps2 * sizeof(double)))
++ goto err1;
+ lookup = (double *)gmalloc((indexHigh + 1) * nComps2 * sizeof(double));
+ lookup2 = indexedCS->getLookup();
+ for (i = 0; i <= indexHigh; ++i) {
+@@ -1686,6 +1694,8 @@
+ sepCS = (GfxSeparationColorSpace *)colorSpace;
+ colorSpace2 = sepCS->getAlt();
+ nComps2 = colorSpace2->getNComps();
++ if ((unsigned int)(maxPixel + 1) >= INT_MAX / (nComps2 * sizeof(double)))
++ goto err1;
+ lookup = (double *)gmalloc((maxPixel + 1) * nComps2 * sizeof(double));
+ sepFunc = sepCS->getFunc();
+ for (i = 0; i <= maxPixel; ++i) {
+@@ -1696,6 +1706,8 @@
+ }
+ }
+ } else {
++ if ((unsigned int)(maxPixel + 1) >= INT_MAX / (nComps * sizeof(double)))
++ goto err1;
+ lookup = (double *)gmalloc((maxPixel + 1) * nComps * sizeof(double));
+ for (i = 0; i <= maxPixel; ++i) {
+ for (k = 0; k < nComps; ++k) {
+@@ -1781,6 +1793,7 @@
+
+ GfxSubpath::GfxSubpath(double x1, double y1) {
+ size = 16;
++ // safe
+ x = (double *)gmalloc(size * sizeof(double));
+ y = (double *)gmalloc(size * sizeof(double));
+ curve = (GBool *)gmalloc(size * sizeof(GBool));
+@@ -1801,6 +1814,7 @@
+ GfxSubpath::GfxSubpath(GfxSubpath *subpath) {
+ size = subpath->size;
+ n = subpath->n;
++ // safe (subpath->size is constrained)
+ x = (double *)gmalloc(size * sizeof(double));
+ y = (double *)gmalloc(size * sizeof(double));
+ curve = (GBool *)gmalloc(size * sizeof(GBool));
+@@ -1812,6 +1826,7 @@
+
+ void GfxSubpath::lineTo(double x1, double y1) {
+ if (n >= size) {
++ if ((unsigned int)(size + 16) >= INT_MAX / sizeof (double)) return;
+ size += 16;
+ x = (double *)grealloc(x, size * sizeof(double));
+ y = (double *)grealloc(y, size * sizeof(double));
+@@ -1826,6 +1841,7 @@
+ void GfxSubpath::curveTo(double x1, double y1, double x2, double y2,
+ double x3, double y3) {
+ if (n+3 > size) {
++ if ((unsigned int)(size + 16) >= INT_MAX / sizeof (double)) return;
+ size += 16;
+ x = (double *)grealloc(x, size * sizeof(double));
+ y = (double *)grealloc(y, size * sizeof(double));
+@@ -1854,6 +1870,7 @@
+ size = 16;
+ n = 0;
+ firstX = firstY = 0;
++ // safe
+ subpaths = (GfxSubpath **)gmalloc(size * sizeof(GfxSubpath *));
+ }
+
+@@ -1875,6 +1892,7 @@
+ firstY = firstY1;
+ size = size1;
+ n = n1;
++ // not sure
+ subpaths = (GfxSubpath **)gmalloc(size * sizeof(GfxSubpath *));
+ for (i = 0; i < n; ++i)
+ subpaths[i] = subpaths1[i]->copy();
+@@ -2063,8 +2081,10 @@
+ strokePattern = state->strokePattern->copy();
+ }
+ if (lineDashLength > 0) {
+- lineDash = (double *)gmalloc(lineDashLength * sizeof(double));
+- memcpy(lineDash, state->lineDash, lineDashLength * sizeof(double));
++ if (lineDashLength < INT_MAX / sizeof (double)) {
++ lineDash = (double *)gmalloc(lineDashLength * sizeof(double));
++ memcpy(lineDash, state->lineDash, lineDashLength * sizeof(double));
++ }
+ }
+ saved = NULL;
+ }
projects / packages / cups.git / commitdiff