$NetBSD: patch-bi,v 1.2 2005/03/10 16:00:32 wiz Exp $

--- lib/Xm/Xpmscan.c.orig	2000-04-28 17:05:21.000000000 +0200
+++ lib/Xm/Xpmscan.c
@@ -93,7 +93,8 @@ LFUNC(MSWGetImagePixels, int, (Display *
 LFUNC(ScanTransparentColor, int, (XpmColor *color, unsigned int cpp,
 				  XpmAttributes *attributes));
 
-LFUNC(ScanOtherColors, int, (Display *display, XpmColor *colors, int ncolors,
+LFUNC(ScanOtherColors, int, (Display *display, XpmColor *colors, 
+			     unsigned int ncolors, 
 			     Pixel *pixels, unsigned int mask,
 			     unsigned int cpp, XpmAttributes *attributes));
 
@@ -220,11 +221,17 @@ XpmCreateXpmImageFromImage(display, imag
     else
 	cpp = 0;
 
+    if ((height > 0 && width >= SIZE_MAX / height) ||
+	width * height >= SIZE_MAX / sizeof(unsigned int))
+	RETURN(XpmNoMemory);
     pmap.pixelindex =
 	(unsigned int *) XpmCalloc(width * height, sizeof(unsigned int));
     if (!pmap.pixelindex)
 	RETURN(XpmNoMemory);
 
+    if (pmap.size >= SIZE_MAX / sizeof(Pixel)) 
+	RETURN(XpmNoMemory);
+
     pmap.pixels = (Pixel *) XpmMalloc(sizeof(Pixel) * pmap.size);
     if (!pmap.pixels)
 	RETURN(XpmNoMemory);
@@ -279,7 +286,8 @@ XpmCreateXpmImageFromImage(display, imag
      * get rgb values and a string of char, and possibly a name for each
      * color
      */
-
+    if (pmap.ncolors >= SIZE_MAX / sizeof(XpmColor))
+	RETURN(XpmNoMemory);
     colorTable = (XpmColor *) XpmCalloc(pmap.ncolors, sizeof(XpmColor));
     if (!colorTable)
 	RETURN(XpmNoMemory);
@@ -327,6 +335,8 @@ ScanTransparentColor(color, cpp, attribu
 
     /* first get a character string */
     a = 0;
+    if (cpp >= SIZE_MAX - 1)
+	return (XpmNoMemory);
     if (!(s = color->string = (char *) XpmMalloc(cpp + 1)))
 	return (XpmNoMemory);
     *s++ = printable[c = a % MAXPRINTABLE];
@@ -374,7 +384,7 @@ static int
 ScanOtherColors(display, colors, ncolors, pixels, mask, cpp, attributes)
     Display *display;
     XpmColor *colors;
-    int ncolors;
+    unsigned int ncolors;
     Pixel *pixels;
     unsigned int mask;
     unsigned int cpp;
@@ -418,6 +428,8 @@ ScanOtherColors(display, colors, ncolors
     }
 
     /* first get character strings and rgb values */
+    if (ncolors >= SIZE_MAX / sizeof(XColor) || cpp >= SIZE_MAX - 1)
+	return (XpmNoMemory);
     xcolors = (XColor *) XpmMalloc(sizeof(XColor) * ncolors);
     if (!xcolors)
 	return (XpmNoMemory);
@@ -585,6 +597,9 @@ GetImagePixels(image, width, height, pma
     ibpp = image->bits_per_pixel;
     offset = image->xoffset;
 
+    if (image->bitmap_unit < 0)
+	    return (XpmNoMemory);
+
     if ((image->bits_per_pixel | image->depth) == 1) {
 	ibu = image->bitmap_unit;
 	for (y = 0; y < height; y++)