* image.c (cache_image): Check for size arithmetic overflow.

diff --git a/src/ChangeLog b/src/ChangeLog
index e1e9e24fcbad2d25c3bc55ccfdedfa143feed46a..7f174bf0a21820e1e72d51059aed0fa455e5c5f5 100644 (file)
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,3 +1,7 @@
+2011-06-23  Paul Eggert  <eggert@cs.ucla.edu>
+
+       * image.c (cache_image): Check for size arithmetic overflow.
+
 2011-06-22  Paul Eggert  <eggert@cs.ucla.edu>
 
        * lread.c: Integer overflow issues.

diff --git a/src/image.c b/src/image.c
index a9785e5d00f01961eeea2aad5c6ddb81f9f4ede4..6e8440fb4312752d3ab48004ff9fc8c6d98074ae 100644 (file)
--- a/src/image.c
+++ b/src/image.c
@@ -1836,6 +1836,8 @@ cache_image (struct frame *f, struct image *img)
   /* If no free slot found, maybe enlarge c->images.  */
   if (i == c->used && c->used == c->size)
     {
+      if (min (PTRDIFF_MAX, SIZE_MAX) / sizeof *c->images / 2 < c->size)
+       memory_full (SIZE_MAX);
       c->size *= 2;
       c->images = (struct image **) xrealloc (c->images,
                                              c->size * sizeof *c->images);