Joined with branch XORG-6_8_2.lg3d-rel-0-6-2lg3d-masterlg3d-dev-0-7-1lg3d-dev-0-7-0lg3d-dev-0-6-2lg3d-dev-0-6-1-1

1 files changed, 12 insertions, 7 deletions

diff --git a/src/Attrib.c b/src/Attrib.c
index 04b843b..028c2cb 100644
--- a/src/Attrib.c
+++ b/src/Attrib.c
@@ -32,13 +32,15 @@
 *  Developed by Arnaud Le Hors                                                *
 \*****************************************************************************/
 
+/* October 2004, source code review by Thomas Biege <thomas@suse.de> */
+
 #include "XpmI.h"
 
 /* 3.2 backward compatibility code */
-LFUNC(CreateOldColorTable, int, (XpmColor *ct, int ncolors,
+LFUNC(CreateOldColorTable, int, (XpmColor *ct, unsigned int ncolors,
 				 XpmColor ***oldct));
 
-LFUNC(FreeOldColorTable, void, (XpmColor **colorTable, int ncolors));
+LFUNC(FreeOldColorTable, void, (XpmColor **colorTable, unsigned int ncolors));
 
 /*
  * Create a colortable compatible with the old style colortable
@@ -46,11 +48,14 @@ LFUNC(FreeOldColorTable, void, (XpmColor **colorTable, int ncolors));
 static int
 CreateOldColorTable(ct, ncolors, oldct)
     XpmColor *ct;
-    int ncolors;
+    unsigned int ncolors;
     XpmColor ***oldct;
 {
     XpmColor **colorTable, **color;
-    int a;
+    unsigned int a;
+
+    if (ncolors >= UINT_MAX / sizeof(XpmColor *)) 
+	return XpmNoMemory;
 
     colorTable = (XpmColor **) XpmMalloc(ncolors * sizeof(XpmColor *));
     if (!colorTable) {
@@ -66,9 +71,9 @@ CreateOldColorTable(ct, ncolors, oldct)
 static void
 FreeOldColorTable(colorTable, ncolors)
     XpmColor **colorTable;
-    int ncolors;
+    unsigned int ncolors;
 {
-    int a, b;
+    unsigned int a, b;
     XpmColor **color;
     char **sptr;
 
@@ -119,7 +124,7 @@ XpmFreeExtensions(extensions, nextensions)
     XpmExtension *ext;
     char **sptr;
 
-    if (extensions) {
+    if (extensions  && nextensions > 0) {
 	for (i = 0, ext = extensions; i < nextensions; i++, ext++) {
 	    if (ext->name)
 		XpmFree(ext->name);