Pullup ticket #2749 - requested by drochner

ghostscript: security patch

Revisions pulled up:
- print/ghostscript/Makefile			1.62
- print/ghostscript/distinfo			1.24
- print/ghostscript/patches/patch-aj		1.4
---
Module Name:	pkgsrc
Committed By:	drochner
Date:		Fri Apr 17 15:05:31 UTC 2009

Modified Files:
	pkgsrc/print/ghostscript: Makefile distinfo
	pkgsrc/print/ghostscript/patches: patch-aj

Log Message:
add a patch (from Redhat bugzilla #491853) to fix more integer
overflows in the icc code (CVE-2009-0792),
bump PKGREVISION

3 files changed, 227 insertions, 64 deletions

diff --git a/print/ghostscript/Makefile b/print/ghostscript/Makefile
index 83bae5140fc..f50b7db6beb 100644
--- a/print/ghostscript/Makefile
+++ b/print/ghostscript/Makefile
@@ -1,7 +1,7 @@
-# $NetBSD: Makefile,v 1.60.2.1 2009/04/17 21:43:51 spz Exp $
+# $NetBSD: Makefile,v 1.60.2.2 2009/04/28 10:08:44 tron Exp $
 
 DISTNAME=	ghostscript-8.64
-PKGREVISION=	2
+PKGREVISION=	3
 CATEGORIES=	print
 MASTER_SITES=	${MASTER_SITE_SOURCEFORGE:=ghostscript/}
 EXTRACT_SUFX=	.tar.bz2
diff --git a/print/ghostscript/distinfo b/print/ghostscript/distinfo
index 0e40a573bb1..4336365374f 100644
--- a/print/ghostscript/distinfo
+++ b/print/ghostscript/distinfo
@@ -1,4 +1,4 @@
-$NetBSD: distinfo,v 1.22.2.1 2009/04/17 21:43:51 spz Exp $
+$NetBSD: distinfo,v 1.22.2.2 2009/04/28 10:08:44 tron Exp $
 
 SHA1 (ghostscript-8.64.tar.bz2) = 4c2a6e04145428d35da73fbc4db9c66a75e336e0
 RMD160 (ghostscript-8.64.tar.bz2) = 565134dcfe1e823b435c3761461c5eb394bd633c
@@ -11,4 +11,4 @@ SHA1 (patch-af) = e4d56f13f5eb595a3929aac6c257012961f59c2b
 SHA1 (patch-ag) = dd452d29253e20bb8fa453a1e4f139a40b2ab3e3
 SHA1 (patch-ah) = efc85dead838505ee462714167f196db2deeb0aa
 SHA1 (patch-ai) = ad69ddd4a4bd50cf2263ac6c6d17a59798ef3124
-SHA1 (patch-aj) = 5608e834189c9746f4ad40d11cc36e76609e5d6c
+SHA1 (patch-aj) = 83403be55c9fa8d22fbf3809190c381a06fa2657
diff --git a/print/ghostscript/patches/patch-aj b/print/ghostscript/patches/patch-aj
index 813f54ccbb9..08031761202 100644
--- a/print/ghostscript/patches/patch-aj
+++ b/print/ghostscript/patches/patch-aj
@@ -1,4 +1,4 @@
-$NetBSD: patch-aj,v 1.3 2009/03/25 10:42:13 drochner Exp $
+$NetBSD: patch-aj,v 1.3.2.1 2009/04/28 10:08:44 tron Exp $
 
 --- icclib/icc.c.orig	2008-05-09 06:12:01.000000000 +0200
 +++ icclib/icc.c
@@ -216,7 +216,53 @@ $NetBSD: patch-aj,v 1.3 2009/03/25 10:42:13 drochner Exp $
  			sprintf(icp->err,"icmXYZArray_alloc: malloc() of icmXYZArray data failed");
  			return icp->errc = 2;
  		}
-@@ -3001,7 +3044,7 @@ static int icmTable_setup_bwd(
+@@ -2939,7 +2982,7 @@ static int icmCurve_lookup_fwd(
+ 			rv |= 1;
+ 		}
+ 		ix = (int)floor(val);		/* Coordinate */
+-		if (ix > (p->size-2))
++		if (ix < 0 || ix > (p->size-2))
+ 			ix = (p->size-2);
+ 		w = val - (double)ix;		/* weight */
+ 		val = p->data[ix];
+@@ -2961,6 +3004,11 @@ static int icmTable_setup_bwd(
+ ) {
+ 	int i;
+ 
++	if (size > INT_MAX - 2)
++		/* Although rt->size is unsigned long, the rt data
++		 * structure uses int data types to store indices. */
++		return 2;
++
+ 	rt->size = size;		/* Stash pointers to these away */
+ 	rt->data = data;
+ 	
+@@ -2979,7 +3027,7 @@ static int icmTable_setup_bwd(
+ 	rt->qscale = (double)rt->rsize/(rt->rmax - rt->rmin);	/* Scale factor to quantize to */
+ 	
+ 	/* Initialize the reverse lookup structures, and get overall min/max */
+-	if ((rt->rlists = (int **) icp->al->calloc(icp->al, 1, rt->rsize * sizeof(int *))) == NULL) {
++	if ((rt->rlists = (int **) icp->al->calloc(icp->al, rt->rsize, sizeof(int *))) == NULL) {
+ 		return 2;
+ 	}
+ 
+@@ -2992,6 +3040,15 @@ static int icmTable_setup_bwd(
+ 			int t;
+ 			t = s; s = e; e = t;
+ 		}
++		/* s and e should both be in the range [0,rt->rsize]
++		 * now, but let's not rely on floating point
++		 * calculations -- double-check. */
++		if (s < 0)
++			s = 0;
++		if (e < 0)
++			e = 0;
++		if (s >= rt->rsize)
++			s = rt->rsize-1;
+ 		if (e >= rt->rsize)
+ 			e = rt->rsize-1;
+ 
+@@ -3001,7 +3058,7 @@ static int icmTable_setup_bwd(
  			int nf;			/* Next free slot */
  			if (rt->rlists[j] == NULL) {	/* No allocation */
  				as = 5;						/* Start with space for 5 */
@@ -225,7 +271,34 @@ $NetBSD: patch-aj,v 1.3 2009/03/25 10:42:13 drochner Exp $
  					return 2;
  				}
  				rt->rlists[j][0] = as;
-@@ -3141,6 +3184,10 @@ static unsigned int icmCurve_get_size(
+@@ -3010,6 +3067,9 @@ static int icmTable_setup_bwd(
+ 				as = rt->rlists[j][0];	/* Allocate space for this list */
+ 				nf = rt->rlists[j][1];	/* Next free location in list */
+ 				if (nf >= as) {			/* need to expand space */
++					if (as > INT_MAX / 2 / sizeof (int))
++						return 2;
++
+ 					as *= 2;
+ 					rt->rlists[j] = (int *) icp->al->realloc(icp->al,rt->rlists[j], sizeof(int) * as);
+ 					if (rt->rlists[j] == NULL) {
+@@ -3061,7 +3121,7 @@ static int icmTable_lookup_bwd(
+ 		val = rsize_1;
+ 	ix = (int)floor(val);		/* Coordinate */
+ 
+-	if (ix > (rt->size-2))
++	if (ix < 0 || ix > (rt->size-2))
+ 		ix = (rt->size-2);
+ 	if (rt->rlists[ix] != NULL)  {		/* There is a list of fwd candidates */
+ 		/* For each candidate forward range */
+@@ -3088,6 +3148,7 @@ static int icmTable_lookup_bwd(
+ 	/* We have failed to find an exact value, so return the nearest value */
+ 	/* (This is slow !) */
+ 	val = fabs(ival - rt->data[0]);
++	/* rt->size is known to be < INT_MAX */
+ 	for (k = 0, i = 1; i < rt->size; i++) {
+ 		double er;
+ 		er = fabs(ival - rt->data[i]);
+@@ -3141,6 +3202,10 @@ static unsigned int icmCurve_get_size(
  	icmCurve *p = (icmCurve *)pp;
  	unsigned int len = 0;
  	len += 12;			/* 12 bytes for tag, padding and count */
@@ -236,7 +309,7 @@ $NetBSD: patch-aj,v 1.3 2009/03/25 10:42:13 drochner Exp $
  	len += p->size * 2;	/* 2 bytes for each UInt16 */
  	return len;
  }
-@@ -3238,6 +3285,8 @@ static int icmCurve_write(
+@@ -3238,6 +3303,8 @@ static int icmCurve_write(
  
  	/* Allocate a file write buffer */
  	len = p->get_size((icmBase *)p);
@@ -245,7 +318,7 @@ $NetBSD: patch-aj,v 1.3 2009/03/25 10:42:13 drochner Exp $
  	if ((buf = (char *) icp->al->malloc(icp->al, len)) == NULL) {
  		sprintf(icp->err,"icmCurve_write malloc() failed");
  		return icp->errc = 2;
-@@ -3347,7 +3396,7 @@ static int icmCurve_allocate(
+@@ -3347,7 +3414,7 @@ static int icmCurve_allocate(
  	if (p->size != p->_size) {
  		if (p->data != NULL)
  			icp->al->free(icp->al, p->data);
@@ -254,7 +327,7 @@ $NetBSD: patch-aj,v 1.3 2009/03/25 10:42:13 drochner Exp $
  			sprintf(icp->err,"icmCurve_alloc: malloc() of icmCurve data failed");
  			return icp->errc = 2;
  		}
-@@ -3493,6 +3542,8 @@ static int icmData_write(
+@@ -3493,6 +3560,8 @@ static int icmData_write(
  
  	/* Allocate a file write buffer */
  	len = p->get_size((icmBase *)p);
@@ -263,7 +336,16 @@ $NetBSD: patch-aj,v 1.3 2009/03/25 10:42:13 drochner Exp $
  	if ((buf = (char *) icp->al->malloc(icp->al, len)) == NULL) {
  		sprintf(icp->err,"icmData_write malloc() failed");
  		return icp->errc = 2;
-@@ -3745,6 +3796,8 @@ static int icmText_write(
+@@ -3620,7 +3689,7 @@ static int icmData_allocate(
+ 	if (p->size != p->_size) {
+ 		if (p->data != NULL)
+ 			icp->al->free(icp->al, p->data);
+-		if ((p->data = (unsigned char *) icp->al->malloc(icp->al, p->size * sizeof(unsigned char))) == NULL) {
++		if ((p->data = (unsigned char *) icp->al->calloc(icp->al, p->size, sizeof(unsigned char))) == NULL) {
+ 			sprintf(icp->err,"icmData_alloc: malloc() of icmData data failed");
+ 			return icp->errc = 2;
+ 		}
+@@ -3745,6 +3814,8 @@ static int icmText_write(
  
  	/* Allocate a file write buffer */
  	len = p->get_size((icmBase *)p);
@@ -272,7 +354,16 @@ $NetBSD: patch-aj,v 1.3 2009/03/25 10:42:13 drochner Exp $
  	if ((buf = (char *) icp->al->malloc(icp->al, len)) == NULL) {
  		sprintf(icp->err,"icmText_write malloc() failed");
  		return icp->errc = 2;
-@@ -4038,6 +4091,8 @@ static int icmDateTimeNumber_write(
+@@ -3834,7 +3905,7 @@ static int icmText_allocate(
+ 	if (p->size != p->_size) {
+ 		if (p->data != NULL)
+ 			icp->al->free(icp->al, p->data);
+-		if ((p->data = (char *) icp->al->malloc(icp->al, p->size * sizeof(char))) == NULL) {
++		if ((p->data = (char *) icp->al->calloc(icp->al, p->size, sizeof(char))) == NULL) {
+ 			sprintf(icp->err,"icmText_alloc: malloc() of icmText data failed");
+ 			return icp->errc = 2;
+ 		}
+@@ -4038,6 +4109,8 @@ static int icmDateTimeNumber_write(
  
  	/* Allocate a file write buffer */
  	len = p->get_size((icmBase *)p);
@@ -281,7 +372,7 @@ $NetBSD: patch-aj,v 1.3 2009/03/25 10:42:13 drochner Exp $
  	if ((buf = (char *) icp->al->malloc(icp->al, len)) == NULL) {
  		sprintf(icp->err,"icmDateTimeNumber_write malloc() failed");
  		return icp->errc = 2;
-@@ -4128,11 +4183,15 @@ static icmBase *new_icmDateTimeNumber(
+@@ -4128,11 +4201,15 @@ static icmBase *new_icmDateTimeNumber(
  /* icmLut object */
  
  /* Utility function - raise one integer to an integer power */
@@ -300,7 +391,16 @@ $NetBSD: patch-aj,v 1.3 2009/03/25 10:42:13 drochner Exp $
  }
  
  /* - - - - - - - - - - - - - - - - */
-@@ -4268,7 +4327,7 @@ double *in		/* Input array[outputChan] *
+@@ -4242,7 +4319,7 @@ double *in		/* Input array[inputChan] */
+ 			rv |= 1;
+ 		}
+ 		ix = (int)floor(val);		/* Grid coordinate */
+-		if (ix > (p->inputEnt-2))
++		if (ix < 0 || ix > (p->inputEnt-2))
+ 			ix = (p->inputEnt-2);
+ 		w = val - (double)ix;		/* weight */
+ 		val = table[ix];
+@@ -4268,7 +4345,7 @@ double *in		/* Input array[outputChan] *
  	if (p->inputChan <= 8) {
  		gw = GW;				/* Use stack allocation */
  	} else {
@@ -309,7 +409,34 @@ $NetBSD: patch-aj,v 1.3 2009/03/25 10:42:13 drochner Exp $
  			sprintf(icp->err,"icmLut_lookup_clut: malloc() failed");
  			return icp->errc = 2;
  		}
-@@ -4819,19 +4878,50 @@ static unsigned int icmLut_get_size(
+@@ -4301,7 +4378,7 @@ double *in		/* Input array[outputChan] *
+ 				rv |= 1;
+ 			}
+ 			x = (int)floor(val);		/* Grid coordinate */
+-			if (x > clutPoints_2)
++			if (x < 0 || x > clutPoints_2)
+ 				x = clutPoints_2;
+ 			co[e] = val - (double)x;	/* 1.0 - weight */
+ 			gp += x * p->dinc[e];		/* Add index offset for base of cube */
+@@ -4374,7 +4451,7 @@ double *in		/* Input array[outputChan] *
+ 				rv |= 1;
+ 			}
+ 			x = (int)floor(val);		/* Grid coordinate */
+-			if (x > clutPoints_2)
++			if (x < 0 || x > clutPoints_2)
+ 				x = clutPoints_2;
+ 			co[e] = val - (double)x;	/* 1.0 - weight */
+ 			gp += x * p->dinc[e];		/* Add index offset for base of cube */
+@@ -4447,7 +4524,7 @@ double *in		/* Input array[outputChan] *
+ 			rv |= 1;
+ 		}
+ 		ix = (int)floor(val);		/* Grid coordinate */
+-		if (ix > (p->outputEnt-2))
++		if (ix < 0 || ix > (p->outputEnt-2))
+ 			ix = (p->outputEnt-2);
+ 		w = val - (double)ix;		/* weight */
+ 		val = table[ix];
+@@ -4819,19 +4896,50 @@ static unsigned int icmLut_get_size(
  ) {
  	icmLut *p = (icmLut *)pp;
  	unsigned int len = 0;
@@ -362,7 +489,7 @@ $NetBSD: patch-aj,v 1.3 2009/03/25 10:42:13 drochner Exp $
  }
  
  /* read the object, return 0 on success, error code on fail */
-@@ -4844,6 +4934,7 @@ static int icmLut_read(
+@@ -4844,6 +4952,7 @@ static int icmLut_read(
  	icc *icp = p->icp;
  	int rv = 0;
  	unsigned long i, j, g, size;
@@ -370,7 +497,7 @@ $NetBSD: patch-aj,v 1.3 2009/03/25 10:42:13 drochner Exp $
  	char *bp, *buf;
  
  	if (len < 4) {
-@@ -4904,6 +4995,11 @@ static int icmLut_read(
+@@ -4904,6 +5013,11 @@ static int icmLut_read(
  		return icp->errc = 1;
  	}
  
@@ -382,7 +509,7 @@ $NetBSD: patch-aj,v 1.3 2009/03/25 10:42:13 drochner Exp $
  	/* Read 3x3 transform matrix */
  	for (j = 0; j < 3; j++) {		/* Rows */
  		for (i = 0; i < 3; i++) {	/* Columns */
-@@ -4921,13 +5017,18 @@ static int icmLut_read(
+@@ -4921,13 +5035,18 @@ static int icmLut_read(
  		bp = buf+52;
  	}
  
@@ -402,7 +529,7 @@ $NetBSD: patch-aj,v 1.3 2009/03/25 10:42:13 drochner Exp $
  	size = (p->inputChan * p->inputEnt);
  	if ((rv = p->allocate((icmBase *)p)) != 0) {
  		icp->al->free(icp->al, buf);
-@@ -4942,7 +5043,14 @@ static int icmLut_read(
+@@ -4942,7 +5061,14 @@ static int icmLut_read(
  	}
  
  	/* Read the clut table */
@@ -418,7 +545,7 @@ $NetBSD: patch-aj,v 1.3 2009/03/25 10:42:13 drochner Exp $
  	if ((rv = p->allocate((icmBase *)p)) != 0) {
  		icp->al->free(icp->al, buf);
  		return rv;
-@@ -4956,6 +5064,11 @@ static int icmLut_read(
+@@ -4956,6 +5082,11 @@ static int icmLut_read(
  	}
  
  	/* Read the output tables */
@@ -430,7 +557,7 @@ $NetBSD: patch-aj,v 1.3 2009/03/25 10:42:13 drochner Exp $
  	size = (p->outputChan * p->outputEnt);
  	if ((rv = p->allocate((icmBase *)p)) != 0) {
  		icp->al->free(icp->al, buf);
-@@ -4995,12 +5108,14 @@ static int icmLut_write(
+@@ -4995,12 +5126,14 @@ static int icmLut_write(
  	icmLut *p = (icmLut *)pp;
  	icc *icp = p->icp;
  	unsigned long i,j;
@@ -446,7 +573,7 @@ $NetBSD: patch-aj,v 1.3 2009/03/25 10:42:13 drochner Exp $
  	if ((buf = (char *) icp->al->malloc(icp->al, len)) == NULL) {
  		sprintf(icp->err,"icmLut_write malloc() failed");
  		return icp->errc = 2;
-@@ -5066,6 +5181,11 @@ static int icmLut_write(
+@@ -5066,6 +5199,11 @@ static int icmLut_write(
  	}
  
  	/* Write the input tables */
@@ -458,7 +585,7 @@ $NetBSD: patch-aj,v 1.3 2009/03/25 10:42:13 drochner Exp $
  	size = (p->inputChan * p->inputEnt);
  	if (p->ttype == icSigLut8Type) {
  		for (i = 0; i < size; i++, bp += 1) {
-@@ -5086,7 +5206,14 @@ static int icmLut_write(
+@@ -5086,7 +5224,14 @@ static int icmLut_write(
  	}
  
  	/* Write the clut table */
@@ -474,7 +601,7 @@ $NetBSD: patch-aj,v 1.3 2009/03/25 10:42:13 drochner Exp $
  	if (p->ttype == icSigLut8Type) {
  		for (i = 0; i < size; i++, bp += 1) {
  			if ((rv = write_DCS8Number(p->clutTable[i], bp)) != 0) {
-@@ -5106,6 +5233,11 @@ static int icmLut_write(
+@@ -5106,6 +5251,11 @@ static int icmLut_write(
  	}
  
  	/* Write the output tables */
@@ -486,7 +613,7 @@ $NetBSD: patch-aj,v 1.3 2009/03/25 10:42:13 drochner Exp $
  	size = (p->outputChan * p->outputEnt);
  	if (p->ttype == icSigLut8Type) {
  		for (i = 0; i < size; i++, bp += 1) {
-@@ -5177,7 +5309,14 @@ static void icmLut_dump(
+@@ -5177,7 +5327,14 @@ static void icmLut_dump(
  		if (p->inputChan > MAX_CHAN) {
  			fprintf(op,"  !!Can't dump > %d input channel CLUT table!!\n",MAX_CHAN);
  		} else {
@@ -502,7 +629,7 @@ $NetBSD: patch-aj,v 1.3 2009/03/25 10:42:13 drochner Exp $
  			for (j = 0; j < p->inputChan; j++)
  				ii[j] = 0;
  			for (i = 0; i < size;) {
-@@ -5216,7 +5355,7 @@ static void icmLut_dump(
+@@ -5216,7 +5373,7 @@ static void icmLut_dump(
  static int icmLut_allocate(
  	icmBase *pp
  ) {
@@ -511,7 +638,7 @@ $NetBSD: patch-aj,v 1.3 2009/03/25 10:42:13 drochner Exp $
  	icmLut *p = (icmLut *)pp;
  	icc *icp = p->icp;
  
-@@ -5231,6 +5370,10 @@ static int icmLut_allocate(
+@@ -5231,6 +5388,10 @@ static int icmLut_allocate(
  		return icp->errc = 1;
  	}
  
@@ -522,7 +649,7 @@ $NetBSD: patch-aj,v 1.3 2009/03/25 10:42:13 drochner Exp $
  	size = (p->inputChan * p->inputEnt);
  	if (size != p->inputTable_size) {
  		if (p->inputTable != NULL)
-@@ -5241,7 +5384,13 @@ static int icmLut_allocate(
+@@ -5241,7 +5402,13 @@ static int icmLut_allocate(
  		}
  		p->inputTable_size = size;
  	}
@@ -537,7 +664,7 @@ $NetBSD: patch-aj,v 1.3 2009/03/25 10:42:13 drochner Exp $
  	if (size != p->clutTable_size) {
  		if (p->clutTable != NULL)
  			icp->al->free(icp->al, p->clutTable);
-@@ -5251,6 +5400,10 @@ static int icmLut_allocate(
+@@ -5251,6 +5418,10 @@ static int icmLut_allocate(
  		}
  		p->clutTable_size = size;
  	}
@@ -548,7 +675,7 @@ $NetBSD: patch-aj,v 1.3 2009/03/25 10:42:13 drochner Exp $
  	size = (p->outputChan * p->outputEnt);
  	if (size != p->outputTable_size) {
  		if (p->outputTable != NULL)
-@@ -5441,6 +5594,8 @@ static int icmMeasurement_write(
+@@ -5441,6 +5612,8 @@ static int icmMeasurement_write(
  
  	/* Allocate a file write buffer */
  	len = p->get_size((icmBase *)p);
@@ -557,7 +684,7 @@ $NetBSD: patch-aj,v 1.3 2009/03/25 10:42:13 drochner Exp $
  	if ((buf = (char *) icp->al->malloc(icp->al, len)) == NULL) {
  		sprintf(icp->err,"icmMeasurement_write malloc() failed");
  		return icp->errc = 2;
-@@ -5712,13 +5867,20 @@ static unsigned int icmNamedColor_get_si
+@@ -5712,13 +5885,20 @@ static unsigned int icmNamedColor_get_si
  			len += p->nDeviceCoords * 1;	/* bytes for each named color */
  		}
  	} else {	/* Named Color 2 */
@@ -579,7 +706,7 @@ $NetBSD: patch-aj,v 1.3 2009/03/25 10:42:13 drochner Exp $
  	}
  	return len;
  }
-@@ -5882,6 +6044,8 @@ static int icmNamedColor_write(
+@@ -5882,6 +6062,8 @@ static int icmNamedColor_write(
  
  	/* Allocate a file write buffer */
  	len = p->get_size((icmBase *)p);
@@ -588,7 +715,7 @@ $NetBSD: patch-aj,v 1.3 2009/03/25 10:42:13 drochner Exp $
  	if ((buf = (char *) icp->al->malloc(icp->al, len)) == NULL) {
  		sprintf(icp->err,"icmNamedColor_write malloc() failed");
  		return icp->errc = 2;
-@@ -6109,9 +6273,22 @@ static unsigned int icmTextDescription_g
+@@ -6109,9 +6291,22 @@ static unsigned int icmTextDescription_g
  ) {
  	icmTextDescription *p = (icmTextDescription *)pp;
  	unsigned int len = 0;
@@ -612,7 +739,7 @@ $NetBSD: patch-aj,v 1.3 2009/03/25 10:42:13 drochner Exp $
  	len += 3 + 67;		/* ScriptCode code, length string */
  	return len;
  }
-@@ -6294,6 +6471,8 @@ static int icmTextDescription_write(
+@@ -6294,6 +6489,8 @@ static int icmTextDescription_write(
  
  	/* Allocate a file write buffer */
  	len = p->get_size((icmBase *)p);
@@ -621,7 +748,16 @@ $NetBSD: patch-aj,v 1.3 2009/03/25 10:42:13 drochner Exp $
  	if ((buf = (char *) icp->al->malloc(icp->al, len)) == NULL) {
  		sprintf(icp->err,"icmTextDescription_write malloc() failed");
  		return icp->errc = 2;
-@@ -6544,7 +6723,7 @@ static int icmTextDescription_allocate(
+@@ -6535,7 +6732,7 @@ static int icmTextDescription_allocate(
+ 	if (p->size != p->_size) {
+ 		if (p->desc != NULL)
+ 			icp->al->free(icp->al, p->desc);
+-		if ((p->desc = (char *) icp->al->malloc(icp->al, p->size * sizeof(char))) == NULL) {
++		if ((p->desc = (char *) icp->al->calloc(icp->al, p->size, sizeof(char))) == NULL) {
+ 			sprintf(icp->err,"icmTextDescription_alloc: malloc() of Ascii description failed");
+ 			return icp->errc = 2;
+ 		}
+@@ -6544,7 +6741,7 @@ static int icmTextDescription_allocate(
  	if (p->ucSize != p->uc_size) {
  		if (p->ucDesc != NULL)
  			icp->al->free(icp->al, p->ucDesc);
@@ -630,7 +766,7 @@ $NetBSD: patch-aj,v 1.3 2009/03/25 10:42:13 drochner Exp $
  			sprintf(icp->err,"icmTextDescription_alloc: malloc() of Unicode description failed");
  			return icp->errc = 2;
  		}
-@@ -6820,6 +6999,12 @@ static int icmProfileSequenceDesc_read(
+@@ -6820,6 +7017,12 @@ static int icmProfileSequenceDesc_read(
  	bp += 8;	/* Skip padding */
  
  	p->count = read_UInt32Number(bp);	/* Number of sequence descriptions */
@@ -643,7 +779,7 @@ $NetBSD: patch-aj,v 1.3 2009/03/25 10:42:13 drochner Exp $
  	bp += 4;
  
  	/* Read all the sequence descriptions */
-@@ -6852,6 +7037,8 @@ static int icmProfileSequenceDesc_write(
+@@ -6852,6 +7055,8 @@ static int icmProfileSequenceDesc_write(
  
  	/* Allocate a file write buffer */
  	len = p->get_size((icmBase *)p);
@@ -652,7 +788,7 @@ $NetBSD: patch-aj,v 1.3 2009/03/25 10:42:13 drochner Exp $
  	if ((buf = (char *) icp->al->malloc(icp->al, len)) == NULL) {
  		sprintf(icp->err,"icmProfileSequenceDesc_write malloc() failed");
  		return icp->errc = 2;
-@@ -6922,7 +7109,7 @@ static int icmProfileSequenceDesc_alloca
+@@ -6922,7 +7127,7 @@ static int icmProfileSequenceDesc_alloca
  	if (p->count != p->_count) {
  		if (p->data != NULL)
  			icp->al->free(icp->al, p->data);
@@ -661,7 +797,7 @@ $NetBSD: patch-aj,v 1.3 2009/03/25 10:42:13 drochner Exp $
  			sprintf(icp->err,"icmProfileSequenceDesc_allocate Allocation of DescStruct array failed");
  			return icp->errc = 2;
  		}
-@@ -7041,6 +7228,8 @@ static int icmSignature_write(
+@@ -7041,6 +7246,8 @@ static int icmSignature_write(
  
  	/* Allocate a file write buffer */
  	len = p->get_size((icmBase *)p);
@@ -670,7 +806,7 @@ $NetBSD: patch-aj,v 1.3 2009/03/25 10:42:13 drochner Exp $
  	if ((buf = (char *) icp->al->malloc(icp->al, len)) == NULL) {
  		sprintf(icp->err,"icmSignature_write malloc() failed");
  		return icp->errc = 2;
-@@ -7156,6 +7345,10 @@ static unsigned int icmScreening_get_siz
+@@ -7156,6 +7363,10 @@ static unsigned int icmScreening_get_siz
  	icmScreening *p = (icmScreening *)pp;
  	unsigned int len = 0;
  	len += 16;				/* 16 bytes for tag, padding, flag & channeles */
@@ -681,7 +817,7 @@ $NetBSD: patch-aj,v 1.3 2009/03/25 10:42:13 drochner Exp $
  	len += p->channels * 12;	/* 12 bytes for each channel */
  	return len;
  }
-@@ -7235,6 +7428,8 @@ static int icmScreening_write(
+@@ -7235,6 +7446,8 @@ static int icmScreening_write(
  
  	/* Allocate a file write buffer */
  	len = p->get_size((icmBase *)p);
@@ -690,7 +826,7 @@ $NetBSD: patch-aj,v 1.3 2009/03/25 10:42:13 drochner Exp $
  	if ((buf = (char *) icp->al->malloc(icp->al, len)) == NULL) {
  		sprintf(icp->err,"icmScreening_write malloc() failed");
  		return icp->errc = 2;
-@@ -7315,7 +7510,7 @@ static int icmScreening_allocate(
+@@ -7315,7 +7528,7 @@ static int icmScreening_allocate(
  	if (p->channels != p->_channels) {
  		if (p->data != NULL)
  			icp->al->free(icp->al, p->data);
@@ -699,7 +835,7 @@ $NetBSD: patch-aj,v 1.3 2009/03/25 10:42:13 drochner Exp $
  			sprintf(icp->err,"icmScreening_alloc: malloc() of icmScreening data failed");
  			return icp->errc = 2;
  		}
-@@ -7366,10 +7561,20 @@ static unsigned int icmUcrBg_get_size(
+@@ -7366,10 +7579,20 @@ static unsigned int icmUcrBg_get_size(
  	icmUcrBg *p = (icmUcrBg *)pp;
  	unsigned int len = 0;
  	len += 8;			/* 8 bytes for tag and padding */
@@ -720,7 +856,7 @@ $NetBSD: patch-aj,v 1.3 2009/03/25 10:42:13 drochner Exp $
  }
  
  /* read the object, return 0 on success, error code on fail */
-@@ -7498,6 +7703,8 @@ static int icmUcrBg_write(
+@@ -7498,6 +7721,8 @@ static int icmUcrBg_write(
  
  	/* Allocate a file write buffer */
  	len = p->get_size((icmBase *)p);
@@ -729,7 +865,7 @@ $NetBSD: patch-aj,v 1.3 2009/03/25 10:42:13 drochner Exp $
  	if ((buf = (char *) icp->al->malloc(icp->al, len)) == NULL) {
  		sprintf(icp->err,"icmUcrBg_write malloc() failed");
  		return icp->errc = 2;
-@@ -7663,7 +7870,7 @@ static int icmUcrBg_allocate(
+@@ -7663,7 +7888,7 @@ static int icmUcrBg_allocate(
  	if (p->UCRcount != p->UCR_count) {
  		if (p->UCRcurve != NULL)
  			icp->al->free(icp->al, p->UCRcurve);
@@ -738,7 +874,7 @@ $NetBSD: patch-aj,v 1.3 2009/03/25 10:42:13 drochner Exp $
  			sprintf(icp->err,"icmUcrBg_allocate: malloc() of UCR curve data failed");
  			return icp->errc = 2;
  		}
-@@ -7672,7 +7879,7 @@ static int icmUcrBg_allocate(
+@@ -7672,7 +7897,7 @@ static int icmUcrBg_allocate(
  	if (p->BGcount != p->BG_count) {
  		if (p->BGcurve != NULL)
  			icp->al->free(icp->al, p->BGcurve);
@@ -747,7 +883,16 @@ $NetBSD: patch-aj,v 1.3 2009/03/25 10:42:13 drochner Exp $
  			sprintf(icp->err,"icmUcrBg_allocate: malloc() of BG curve data failed");
  			return icp->errc = 2;
  		}
-@@ -7743,6 +7950,15 @@ static unsigned int icmVideoCardGamma_ge
+@@ -7681,7 +7906,7 @@ static int icmUcrBg_allocate(
+ 	if (p->size != p->_size) {
+ 		if (p->string != NULL)
+ 			icp->al->free(icp->al, p->string);
+-		if ((p->string = (char *) icp->al->malloc(icp->al, p->size * sizeof(char))) == NULL) {
++		if ((p->string = (char *) icp->al->calloc(icp->al, p->size, sizeof(char))) == NULL) {
+ 			sprintf(icp->err,"icmUcrBg_allocate: malloc() of string data failed");
+ 			return icp->errc = 2;
+ 		}
+@@ -7743,6 +7968,15 @@ static unsigned int icmVideoCardGamma_ge
  		len += 2;       /* 2 bytes for channels */
  		len += 2;       /* 2 for entry count */
  		len += 2;       /* 2 for entry size */
@@ -763,7 +908,7 @@ $NetBSD: patch-aj,v 1.3 2009/03/25 10:42:13 drochner Exp $
  		len += ( p->u.table.channels *     /* compute table size */
  				 p->u.table.entryCount *
  				 p->u.table.entrySize );
-@@ -7762,10 +7978,11 @@ static int icmVideoCardGamma_read(
+@@ -7762,10 +7996,11 @@ static int icmVideoCardGamma_read(
  ) {
  	icmVideoCardGamma *p = (icmVideoCardGamma *)pp;
  	icc *icp = p->icp;
@@ -776,7 +921,7 @@ $NetBSD: patch-aj,v 1.3 2009/03/25 10:42:13 drochner Exp $
  
  	if (len < 18) {
  		sprintf(icp->err,"icmVideoCardGamma_read: Tag too small to be legal");
-@@ -7803,6 +8020,16 @@ static int icmVideoCardGamma_read(
+@@ -7803,6 +8038,16 @@ static int icmVideoCardGamma_read(
  		p->u.table.channels   = read_UInt16Number(bp+12);
  		p->u.table.entryCount = read_UInt16Number(bp+14);
  		p->u.table.entrySize  = read_UInt16Number(bp+16);
@@ -793,7 +938,7 @@ $NetBSD: patch-aj,v 1.3 2009/03/25 10:42:13 drochner Exp $
  		if (len-18 < p->u.table.channels*p->u.table.entryCount*p->u.table.entrySize) {
  			sprintf(icp->err,"icmVideoCardGamma_read: Tag too small to be legal");
  			return icp->errc = 1;
-@@ -7871,6 +8098,8 @@ static int icmVideoCardGamma_write(
+@@ -7871,6 +8116,8 @@ static int icmVideoCardGamma_write(
  
  	/* Allocate a file write buffer */
  	len = p->get_size((icmBase *)p);
@@ -802,7 +947,7 @@ $NetBSD: patch-aj,v 1.3 2009/03/25 10:42:13 drochner Exp $
  	if ((buf = (char *) icp->al->malloc(icp->al, len)) == NULL) {
  		sprintf(icp->err,"icmViewingConditions_write malloc() failed");
  		return icp->errc = 2;
-@@ -8049,7 +8278,7 @@ static int icmVideoCardGamma_allocate(
+@@ -8049,7 +8296,7 @@ static int icmVideoCardGamma_allocate(
  ) {
  	icmVideoCardGamma *p = (icmVideoCardGamma *)pp;
  	icc *icp = p->icp;
@@ -811,7 +956,7 @@ $NetBSD: patch-aj,v 1.3 2009/03/25 10:42:13 drochner Exp $
  
  	/* note: allocation is only relevant for table type
  	 * and in that case the channels, entryCount, and entrySize
-@@ -8059,6 +8288,11 @@ static int icmVideoCardGamma_allocate(
+@@ -8059,6 +8306,11 @@ static int icmVideoCardGamma_allocate(
  	if (p->tagType == icmVideoCardGammaTableType) {
  		if (p->u.table.data != NULL)
  			icp->al->free(icp->al, p->u.table.data);
@@ -823,7 +968,7 @@ $NetBSD: patch-aj,v 1.3 2009/03/25 10:42:13 drochner Exp $
  		size = (p->u.table.channels *
  				p->u.table.entryCount);
  		switch (p->u.table.entrySize) {
-@@ -8066,6 +8300,10 @@ static int icmVideoCardGamma_allocate(
+@@ -8066,6 +8318,10 @@ static int icmVideoCardGamma_allocate(
  			size *= sizeof(unsigned char);
  			break;
  		case 2:
@@ -834,7 +979,7 @@ $NetBSD: patch-aj,v 1.3 2009/03/25 10:42:13 drochner Exp $
  			size *= sizeof(unsigned short);
  			break;
  		default:
-@@ -8201,6 +8439,8 @@ static int icmViewingConditions_write(
+@@ -8201,6 +8457,8 @@ static int icmViewingConditions_write(
  
  	/* Allocate a file write buffer */
  	len = p->get_size((icmBase *)p);
@@ -843,7 +988,7 @@ $NetBSD: patch-aj,v 1.3 2009/03/25 10:42:13 drochner Exp $
  	if ((buf = (char *) icp->al->malloc(icp->al, len)) == NULL) {
  		sprintf(icp->err,"icmViewingConditions_write malloc() failed");
  		return icp->errc = 2;
-@@ -8433,6 +8673,8 @@ static int icmCrdInfo_write(
+@@ -8433,6 +8691,8 @@ static int icmCrdInfo_write(
  
  	/* Allocate a file write buffer */
  	len = p->get_size((icmBase *)p);
@@ -852,7 +997,25 @@ $NetBSD: patch-aj,v 1.3 2009/03/25 10:42:13 drochner Exp $
  	if ((buf = (char *) icp->al->malloc(icp->al, len)) == NULL) {
  		sprintf(icp->err,"icmCrdInfo_write malloc() failed");
  		return icp->errc = 2;
-@@ -8736,6 +8978,8 @@ static int icmHeader_write(
+@@ -8585,7 +8845,7 @@ static int icmCrdInfo_allocate(
+ 	if (p->ppsize != p->_ppsize) {
+ 		if (p->ppname != NULL)
+ 			icp->al->free(icp->al, p->ppname);
+-		if ((p->ppname = (char *) icp->al->malloc(icp->al, p->ppsize * sizeof(char))) == NULL) {
++		if ((p->ppname = (char *) icp->al->calloc(icp->al, p->ppsize, sizeof(char))) == NULL) {
+ 			sprintf(icp->err,"icmCrdInfo_alloc: malloc() of string data failed");
+ 			return icp->errc = 2;
+ 		}
+@@ -8595,7 +8855,7 @@ static int icmCrdInfo_allocate(
+ 		if (p->crdsize[t] != p->_crdsize[t]) {
+ 			if (p->crdname[t] != NULL)
+ 				icp->al->free(icp->al, p->crdname[t]);
+-			if ((p->crdname[t] = (char *) icp->al->malloc(icp->al, p->crdsize[t] * sizeof(char))) == NULL) {
++			if ((p->crdname[t] = (char *) icp->al->calloc(icp->al, p->crdsize[t], sizeof(char))) == NULL) {
+ 				sprintf(icp->err,"icmCrdInfo_alloc: malloc() of CRD%d name string failed",t);
+ 				return icp->errc = 2;
+ 			}
+@@ -8736,6 +8996,8 @@ static int icmHeader_write(
  	int rv = 0;
  
  	len = p->get_size(p);
@@ -861,7 +1024,7 @@ $NetBSD: patch-aj,v 1.3 2009/03/25 10:42:13 drochner Exp $
  	if ((buf = (char *) icp->al->calloc(icp->al,1,len)) == NULL) {			/* Zero it - some CMS are fussy */
  		sprintf(icp->err,"icmHeader_write calloc() failed");
  		return icp->errc = 2;
-@@ -9245,13 +9489,23 @@ static int icc_read(
+@@ -9245,13 +9507,23 @@ static int icc_read(
  	}
  
  	p->count = read_UInt32Number(tcbuf);		/* Tag count */
@@ -886,7 +1049,7 @@ $NetBSD: patch-aj,v 1.3 2009/03/25 10:42:13 drochner Exp $
  		len = 4 + p->count * 12;
  		if ((buf = (char *) p->al->malloc(p->al, len)) == NULL) {
  			sprintf(p->err,"icc_read: Tag table read buffer malloc() failed");
-@@ -9281,6 +9535,14 @@ static int icc_read(
+@@ -9281,6 +9553,14 @@ static int icc_read(
  	    	    return p->errc = 1;
  	    	}
  	    	p->data[i].size = read_UInt32Number(bp + 8);	
@@ -901,7 +1064,7 @@ $NetBSD: patch-aj,v 1.3 2009/03/25 10:42:13 drochner Exp $
  			if (   p->fp->seek(p->fp, of + p->data[i].offset) != 0
  			    || p->fp->read(p->fp, tcbuf, 1, 4) != 4) {
  				sprintf(p->err,"icc_read: fseek() or fread() failed on tag headers");
-@@ -9321,8 +9583,14 @@ static unsigned int icc_get_size(
+@@ -9321,8 +9601,14 @@ static unsigned int icc_get_size(
  	}
  
  	size += p->header->get_size(p->header);
@@ -916,7 +1079,7 @@ $NetBSD: patch-aj,v 1.3 2009/03/25 10:42:13 drochner Exp $
  	size += 4 + p->count * 12;	/* Tag table length */
  	
  	/* Reset touched flag for each tag type */
-@@ -9337,8 +9605,13 @@ static unsigned int icc_get_size(
+@@ -9337,8 +9623,13 @@ static unsigned int icc_get_size(
  	/* Get size for each tag type, skipping links */
  	for (i = 0; i < p->count; i++) {
  		if (p->data[i].objp->touched == 0) { /* Not alllowed for previously */
@@ -931,7 +1094,7 @@ $NetBSD: patch-aj,v 1.3 2009/03/25 10:42:13 drochner Exp $
  			p->data[i].objp->touched = 1;	/* Don't account for this again */
  		}
  	}
-@@ -9373,9 +9646,19 @@ static int icc_write(
+@@ -9373,9 +9664,19 @@ static int icc_write(
  	}
  
  	size += p->header->get_size(p->header);
@@ -951,7 +1114,7 @@ $NetBSD: patch-aj,v 1.3 2009/03/25 10:42:13 drochner Exp $
  	size += len;
  	
  	/* Allocate memory buffer for tag table */
-@@ -9406,6 +9689,12 @@ static int icc_write(
+@@ -9406,6 +9707,12 @@ static int icc_write(
  			size = DO_ALIGN(size);
  			p->data[i].offset = size;			/* Profile relative target */
  			p->data[i].size = p->data[i].objp->get_size(p->data[i].objp);
@@ -964,7 +1127,7 @@ $NetBSD: patch-aj,v 1.3 2009/03/25 10:42:13 drochner Exp $
  			size += p->data[i].size;
  			p->data[i].objp->touched = 1;	/* Allocated space for it */
  		} else { /* must be linked - copy allocation */
-@@ -9529,6 +9818,11 @@ static icmBase *icc_add_tag(
+@@ -9529,6 +9836,11 @@ static icmBase *icc_add_tag(
  	}
  
  	/* Make space in tag table for new tag item */
@@ -976,7 +1139,7 @@ $NetBSD: patch-aj,v 1.3 2009/03/25 10:42:13 drochner Exp $
  	if (p->data == NULL)
  		tp = p->al->malloc(p->al, (p->count+1) * sizeof(icmTag));
  	else
-@@ -9612,6 +9906,11 @@ static icmBase *icc_link_tag(
+@@ -9612,6 +9924,11 @@ static icmBase *icc_link_tag(
  	}
  
  	/* Make space in tag table for new tag item */