1 files changed, 7 insertions, 0 deletions
diff --git a/src/Type1/afm.c b/src/Type1/afm.c
index b8ce2d3..006ff3c 100644
--- a/src/Type1/afm.c
+++ b/src/Type1/afm.c
@@ -37,6 +37,8 @@
 #include <X11/fonts/fontmisc.h>			/* for xalloc/xfree */
 #include "AFM.h"
 
+#include <limits.h>
+
 #define PBUF 256
 #define KBUF 20
 
@@ -118,6 +120,11 @@ int CIDAFM(FILE *fd, FontInfo **pfi) {
             
             fi->nChars = atoi(p);
 
+	    if (fi->nChars < 0 || fi->nChars > INT_MAX / sizeof(Metrics)) {
+		xfree(afmbuf);
+		xfree(fi);
+		return(1);
+	    }
             fi->metrics = (Metrics *)xalloc(fi->nChars * 
                 sizeof(Metrics));
             if (fi->metrics == NULL) {