Merge patch from Mathieu Herrb to fix several integer overflows and otherXORG-6_8_1

    security errors in libXpm.

1 files changed, 5 insertions, 2 deletions

diff --git a/src/Attrib.c b/src/Attrib.c
index 04b843b..cf7081c 100644
--- a/src/Attrib.c
+++ b/src/Attrib.c
@@ -35,7 +35,7 @@
 #include "XpmI.h"
 
 /* 3.2 backward compatibility code */
-LFUNC(CreateOldColorTable, int, (XpmColor *ct, int ncolors,
+LFUNC(CreateOldColorTable, int, (XpmColor *ct, unsigned int ncolors,
 				 XpmColor ***oldct));
 
 LFUNC(FreeOldColorTable, void, (XpmColor **colorTable, int ncolors));
@@ -46,12 +46,15 @@ LFUNC(FreeOldColorTable, void, (XpmColor **colorTable, int ncolors));
 static int
 CreateOldColorTable(ct, ncolors, oldct)
     XpmColor *ct;
-    int ncolors;
+    unsigned int ncolors;
     XpmColor ***oldct;
 {
     XpmColor **colorTable, **color;
     int a;
 
+    if (ncolors >= SIZE_MAX / sizeof(XpmColor *)) 
+	return XpmNoMemory;
+
     colorTable = (XpmColor **) XpmMalloc(ncolors * sizeof(XpmColor *));
     if (!colorTable) {
 	*oldct = NULL;