iliaa           Tue Jun  3 19:42:49 2003 EDT

  Modified files:              (Branch: PHP_4_3)
    /php4/ext/gd/libgd  gd_gif_in.c gdxpm.c 
  Log:
  MFH (Last set of integer overflow checks.)
  
  
Index: php4/ext/gd/libgd/gd_gif_in.c
diff -u php4/ext/gd/libgd/gd_gif_in.c:1.2.2.1 php4/ext/gd/libgd/gd_gif_in.c:1.2.2.2
--- php4/ext/gd/libgd/gd_gif_in.c:1.2.2.1       Wed Mar  5 11:04:20 2003
+++ php4/ext/gd/libgd/gd_gif_in.c       Tue Jun  3 19:42:49 2003
@@ -299,7 +299,7 @@
        rv = GetDataBlock_(fd,buf);
        if (VERBOSE) {
                if (rv > 0) {
-                       tmp = emalloc((3*sizeof(char)*rv) + 1);
+                       tmp = safe_emalloc(3 * rv, sizeof(char), 1);
                        for (i=0;i<rv;i++) {
                                sprintf(&tmp[3*sizeof(char)*i], " %02x", buf[i]);
                        }
Index: php4/ext/gd/libgd/gdxpm.c
diff -u php4/ext/gd/libgd/gdxpm.c:1.2.2.2 php4/ext/gd/libgd/gdxpm.c:1.2.2.3
--- php4/ext/gd/libgd/gdxpm.c:1.2.2.2   Wed Mar  5 11:04:20 2003
+++ php4/ext/gd/libgd/gdxpm.c   Tue Jun  3 19:42:49 2003
@@ -37,7 +37,7 @@
     return 0;
 
   number = image.ncolors;
-  colors = (int *) gdMalloc (sizeof (int) * number);
+  colors = (int *) safe_emalloc(number, sizeof(int), 0);
   for (i = 0; i < number; i++)
     {
       switch (strlen (image.colorTable[i].c_color))



-- 
PHP CVS Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php

Reply via email to