* dispextern.h (struct face.stipple):

* image.c (x_bitmap_height, x_bitmap_width, x_bitmap_pixmap)
(x_bitmap_mask, x_allocate_bitmap_record)
(x_create_bitmap_from_data, x_create_bitmap_from_file)
(x_destroy_bitmap, x_destroy_all_bitmaps, x_create_bitmap_mask)
(x_create_bitmap_from_xpm_data):
* nsterm.h (struct ns_display_info.bitmaps_size, .bitmaps_last):
* w32term.h (struct w32_display_info.icon_bitmap_id, .bitmaps_size)
(.bitmaps_last):
* xfaces.c (load_pixmap):
* xterm.c (x_bitmap_icon, x_wm_set_icon_pixmap):
* xterm.h (struct x_display_info.icon_bitmap_id, .bitmaps_size)
(.bitmaps_last, struct x_output.icon_bitmap):
Use ptrdiff_t, not int, for bitmap indexes.
(x_allocate_bitmap_record): Check for size overflow.
* dispextern.h, lisp.h: Adjust to API changes elsewhere.

9 files changed, 69 insertions, 45 deletions

diff --git a/src/ChangeLog b/src/ChangeLog
index 12439754e7c..72f6b437af2 100644
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,3 +1,22 @@
+2011-06-22  Paul Eggert  <eggert@cs.ucla.edu>
+
+        * dispextern.h (struct face.stipple):
+        * image.c (x_bitmap_height, x_bitmap_width, x_bitmap_pixmap)
+        (x_bitmap_mask, x_allocate_bitmap_record)
+        (x_create_bitmap_from_data, x_create_bitmap_from_file)
+        (x_destroy_bitmap, x_destroy_all_bitmaps, x_create_bitmap_mask)
+        (x_create_bitmap_from_xpm_data):
+        * nsterm.h (struct ns_display_info.bitmaps_size, .bitmaps_last):
+        * w32term.h (struct w32_display_info.icon_bitmap_id, .bitmaps_size)
+        (.bitmaps_last):
+        * xfaces.c (load_pixmap):
+        * xterm.c (x_bitmap_icon, x_wm_set_icon_pixmap):
+        * xterm.h (struct x_display_info.icon_bitmap_id, .bitmaps_size)
+        (.bitmaps_last, struct x_output.icon_bitmap):
+        Use ptrdiff_t, not int, for bitmap indexes.
+        (x_allocate_bitmap_record): Check for size overflow.
+        * dispextern.h, lisp.h: Adjust to API changes elsewhere.
+
 2011-06-21  Paul Eggert  <eggert@cs.ucla.edu>
 
         Use ptrdiff_t, not int, for overlay counts.
diff --git a/src/dispextern.h b/src/dispextern.h
index 227d5ed58e3..02f1e5314aa 100644
--- a/src/dispextern.h
+++ b/src/dispextern.h
@@ -1532,12 +1532,12 @@ struct face
 
   /* Background stipple or bitmap used for this face.  This is
      an id as returned from load_pixmap.  */
-  int stipple;
+  ptrdiff_t stipple;
 
 #else /* not HAVE_WINDOW_SYSTEM */
 
   /* Dummy.  */
-  int stipple;
+  ptrdiff_t stipple;
 
 #endif /* not HAVE_WINDOW_SYSTEM */
 
@@ -3082,21 +3082,21 @@ void w32_reset_fringes (void);
 
 #ifdef HAVE_WINDOW_SYSTEM
 
-extern int x_bitmap_height (struct frame *, int);
-extern int x_bitmap_width (struct frame *, int);
-extern int x_bitmap_pixmap (struct frame *, int);
+extern int x_bitmap_height (struct frame *, ptrdiff_t);
+extern int x_bitmap_width (struct frame *, ptrdiff_t);
+extern int x_bitmap_pixmap (struct frame *, ptrdiff_t);
 extern void x_reference_bitmap (struct frame *, int);
-extern int x_create_bitmap_from_data (struct frame *, char *,
-                                      unsigned int, unsigned int);
-extern int x_create_bitmap_from_file (struct frame *, Lisp_Object);
+extern ptrdiff_t x_create_bitmap_from_data (struct frame *, char *,
+                                            unsigned int, unsigned int);
+extern ptrdiff_t x_create_bitmap_from_file (struct frame *, Lisp_Object);
 #if defined HAVE_XPM && defined HAVE_X_WINDOWS && !defined USE_GTK
-extern int x_create_bitmap_from_xpm_data (struct frame *f, const char **bits);
+extern ptrdiff_t x_create_bitmap_from_xpm_data (struct frame *, const char **);
 #endif
 #ifndef x_destroy_bitmap
-extern void x_destroy_bitmap (struct frame *, int);
+extern void x_destroy_bitmap (struct frame *, ptrdiff_t);
 #endif
 extern void x_destroy_all_bitmaps (Display_Info *);
-extern int x_create_bitmap_mask (struct frame * , int);
+extern int x_create_bitmap_mask (struct frame *, ptrdiff_t);
 extern Lisp_Object x_find_image_file (Lisp_Object);
 
 void x_kill_gs_process (Pixmap, struct frame *);
diff --git a/src/image.c b/src/image.c
index b5b93cb5b69..01cc95f7b38 100644
--- a/src/image.c
+++ b/src/image.c
@@ -182,20 +182,20 @@ XPutPixel (XImagePtr ximage, int x, int y, unsigned long pixel)
 /* Functions to access the contents of a bitmap, given an id.  */
 
 int
-x_bitmap_height (FRAME_PTR f, int id)
+x_bitmap_height (FRAME_PTR f, ptrdiff_t id)
 {
   return FRAME_X_DISPLAY_INFO (f)->bitmaps[id - 1].height;
 }
 
 int
-x_bitmap_width (FRAME_PTR f, int id)
+x_bitmap_width (FRAME_PTR f, ptrdiff_t id)
 {
   return FRAME_X_DISPLAY_INFO (f)->bitmaps[id - 1].width;
 }
 
 #if defined (HAVE_X_WINDOWS) || defined (HAVE_NTGUI)
 int
-x_bitmap_pixmap (FRAME_PTR f, int id)
+x_bitmap_pixmap (FRAME_PTR f, ptrdiff_t id)
 {
   return (int) FRAME_X_DISPLAY_INFO (f)->bitmaps[id - 1].pixmap;
 }
@@ -203,7 +203,7 @@ x_bitmap_pixmap (FRAME_PTR f, int id)
 
 #ifdef HAVE_X_WINDOWS
 int
-x_bitmap_mask (FRAME_PTR f, int id)
+x_bitmap_mask (FRAME_PTR f, ptrdiff_t id)
 {
   return FRAME_X_DISPLAY_INFO (f)->bitmaps[id - 1].mask;
 }
@@ -211,11 +211,11 @@ x_bitmap_mask (FRAME_PTR f, int id)
 
 /* Allocate a new bitmap record.  Returns index of new record.  */
 
-static int
+static ptrdiff_t
 x_allocate_bitmap_record (FRAME_PTR f)
 {
   Display_Info *dpyinfo = FRAME_X_DISPLAY_INFO (f);
-  int i;
+  ptrdiff_t i;
 
   if (dpyinfo->bitmaps == NULL)
     {
@@ -233,6 +233,9 @@ x_allocate_bitmap_record (FRAME_PTR f)
     if (dpyinfo->bitmaps[i].refcount == 0)
       return i + 1;
 
+  if (min (PTRDIFF_MAX, SIZE_MAX) / sizeof (Bitmap_Record) / 2
+      < dpyinfo->bitmaps_size)
+    memory_full (SIZE_MAX);
   dpyinfo->bitmaps_size *= 2;
   dpyinfo->bitmaps
     = (Bitmap_Record *) xrealloc (dpyinfo->bitmaps,
@@ -250,11 +253,11 @@ x_reference_bitmap (FRAME_PTR f, int id)
 
 /* Create a bitmap for frame F from a HEIGHT x WIDTH array of bits at BITS.  */
 
-int
+ptrdiff_t
 x_create_bitmap_from_data (struct frame *f, char *bits, unsigned int width, unsigned int height)
 {
   Display_Info *dpyinfo = FRAME_X_DISPLAY_INFO (f);
-  int id;
+  ptrdiff_t id;
 
 #ifdef HAVE_X_WINDOWS
   Pixmap bitmap;
@@ -309,7 +312,7 @@ x_create_bitmap_from_data (struct frame *f, char *bits, unsigned int width, unsi
 
 /* Create bitmap from file FILE for frame F.  */
 
-int
+ptrdiff_t
 x_create_bitmap_from_file (struct frame *f, Lisp_Object file)
 {
   Display_Info *dpyinfo = FRAME_X_DISPLAY_INFO (f);
@@ -319,7 +322,7 @@ x_create_bitmap_from_file (struct frame *f, Lisp_Object file)
 #endif /* HAVE_NTGUI */
 
 #ifdef HAVE_NS
-  int id;
+  ptrdiff_t id;
   void *bitmap = ns_image_from_file (file);
 
   if (!bitmap)
@@ -340,7 +343,8 @@ x_create_bitmap_from_file (struct frame *f, Lisp_Object file)
 #ifdef HAVE_X_WINDOWS
   unsigned int width, height;
   Pixmap bitmap;
-  int xhot, yhot, result, id;
+  int xhot, yhot, result;
+  ptrdiff_t id;
   Lisp_Object found;
   int fd;
   char *filename;
@@ -413,7 +417,7 @@ free_bitmap_record (Display_Info *dpyinfo, Bitmap_Record *bm)
 /* Remove reference to bitmap with id number ID.  */
 
 void
-x_destroy_bitmap (FRAME_PTR f, int id)
+x_destroy_bitmap (FRAME_PTR f, ptrdiff_t id)
 {
   Display_Info *dpyinfo = FRAME_X_DISPLAY_INFO (f);
 
@@ -435,7 +439,7 @@ x_destroy_bitmap (FRAME_PTR f, int id)
 void
 x_destroy_all_bitmaps (Display_Info *dpyinfo)
 {
-  int i;
+  ptrdiff_t i;
   Bitmap_Record *bm = dpyinfo->bitmaps;
 
   for (i = 0; i < dpyinfo->bitmaps_last; i++, bm++)
@@ -467,7 +471,7 @@ static void x_destroy_x_image (XImagePtr ximg);
    It's nicer with some borders in this context */
 
 int
-x_create_bitmap_mask (struct frame *f, int id)
+x_create_bitmap_mask (struct frame *f, ptrdiff_t id)
 {
   Pixmap pixmap, mask;
   XImagePtr ximg, mask_img;
@@ -3281,11 +3285,12 @@ xpm_image_p (Lisp_Object object)
 #endif /* HAVE_XPM || HAVE_NS */
 
 #if defined HAVE_XPM && defined HAVE_X_WINDOWS && !defined USE_GTK
-int
+ptrdiff_t
 x_create_bitmap_from_xpm_data (struct frame *f, const char **bits)
 {
   Display_Info *dpyinfo = FRAME_X_DISPLAY_INFO (f);
-  int id, rc;
+  ptrdiff_t id;
+  int rc;
   XpmAttributes attrs;
   Pixmap bitmap, mask;
 
diff --git a/src/lisp.h b/src/lisp.h
index 99a276c805c..4c9543bdfe8 100644
--- a/src/lisp.h
+++ b/src/lisp.h
@@ -2628,7 +2628,7 @@ extern void init_fringe_once (void);
 /* Defined in image.c */
 extern Lisp_Object QCascent, QCmargin, QCrelief;
 extern Lisp_Object QCconversion;
-extern int x_bitmap_mask (struct frame *, int);
+extern int x_bitmap_mask (struct frame *, ptrdiff_t);
 extern void syms_of_image (void);
 extern void init_image (void);
 
diff --git a/src/nsterm.h b/src/nsterm.h
index 09ec8c19b1a..7459087c988 100644
--- a/src/nsterm.h
+++ b/src/nsterm.h
@@ -468,8 +468,8 @@ struct ns_display_info
   int smallest_font_height;
 
   struct ns_bitmap_record *bitmaps;
-  int bitmaps_size;
-  int bitmaps_last;
+  ptrdiff_t bitmaps_size;
+  ptrdiff_t bitmaps_last;
 
   struct image_cache *image_cache;
 
@@ -818,4 +818,3 @@ extern char gnustep_base_version[];  /* version tracking */
 
 
 #endif  /* HAVE_NS */
-
diff --git a/src/w32term.h b/src/w32term.h
index cf6751b7d63..24a2be7dca9 100644
--- a/src/w32term.h
+++ b/src/w32term.h
@@ -103,7 +103,7 @@ struct w32_display_info
 
   /* Emacs bitmap-id of the default icon bitmap for this frame.
      Or -1 if none has been allocated yet.  */
-  int icon_bitmap_id;
+  ptrdiff_t icon_bitmap_id;
 
   /* The root window of this screen.  */
   Window root_window;
@@ -151,10 +151,10 @@ struct w32_display_info
   struct w32_bitmap_record *bitmaps;
 
   /* Allocated size of bitmaps field.  */
-  int bitmaps_size;
+  ptrdiff_t bitmaps_size;
 
   /* Last used bitmap index.  */
-  int bitmaps_last;
+  ptrdiff_t bitmaps_last;
 
   /* The frame (if any) which has the window that has keyboard focus.
      Zero if none.  This is examined by Ffocus_frame in w32fns.c.  Note
diff --git a/src/xfaces.c b/src/xfaces.c
index 951cf69a4cb..99c35fbb120 100644
--- a/src/xfaces.c
+++ b/src/xfaces.c
@@ -463,7 +463,8 @@ static Lisp_Object resolve_face_name (Lisp_Object, int);
 static void set_font_frame_param (Lisp_Object, Lisp_Object);
 static int get_lface_attributes (struct frame *, Lisp_Object, Lisp_Object *,
                                  int, struct named_merge_point *);
-static int load_pixmap (struct frame *, Lisp_Object, unsigned *, unsigned *);
+static ptrdiff_t load_pixmap (struct frame *, Lisp_Object,
+                              unsigned *, unsigned *);
 static struct frame *frame_or_selected_frame (Lisp_Object, int);
 static void load_face_colors (struct frame *, struct face *, Lisp_Object *);
 static void free_face_colors (struct frame *, struct face *);
@@ -963,10 +964,10 @@ the pixmap.  Bits are stored row by row, each row occupies
    zero.  Store the bitmap width in *W_PTR and its height in *H_PTR,
    if these pointers are not null.  */
 
-static int
+static ptrdiff_t
 load_pixmap (FRAME_PTR f, Lisp_Object name, unsigned int *w_ptr, unsigned int *h_ptr)
 {
-  int bitmap_id;
+  ptrdiff_t bitmap_id;
 
   if (NILP (name))
     return 0;
diff --git a/src/xterm.c b/src/xterm.c
index c1134521c71..32fbab55008 100644
--- a/src/xterm.c
+++ b/src/xterm.c
@@ -356,7 +356,7 @@ static int x_dispatch_event (XEvent *, Display *);
    interference with debugging failing X calls.  */
 static void x_connection_closed (Display *, const char *);
 static void x_wm_set_window_state (struct frame *, int);
-static void x_wm_set_icon_pixmap (struct frame *, int);
+static void x_wm_set_icon_pixmap (struct frame *, ptrdiff_t);
 static void x_initialize (void);
 
 
@@ -7427,7 +7427,7 @@ x_draw_window_cursor (struct window *w, struct glyph_row *glyph_row, int x, int
 int
 x_bitmap_icon (struct frame *f, Lisp_Object file)
 {
-  int bitmap_id;
+  ptrdiff_t bitmap_id;
 
   if (FRAME_X_WINDOW (f) == 0)
     return 1;
@@ -7453,7 +7453,7 @@ x_bitmap_icon (struct frame *f, Lisp_Object file)
       /* Create the GNU bitmap and mask if necessary.  */
       if (FRAME_X_DISPLAY_INFO (f)->icon_bitmap_id < 0)
         {
-          int rc = -1;
+          ptrdiff_t rc = -1;
 
 #ifdef USE_GTK
 
@@ -9601,7 +9601,7 @@ x_wm_set_window_state (struct frame *f, int state)
 }
 
 static void
-x_wm_set_icon_pixmap (struct frame *f, int pixmap_id)
+x_wm_set_icon_pixmap (struct frame *f, ptrdiff_t pixmap_id)
 {
   Pixmap icon_pixmap, icon_mask;
 
diff --git a/src/xterm.h b/src/xterm.h
index 47d7e533769..a4767361bb3 100644
--- a/src/xterm.h
+++ b/src/xterm.h
@@ -158,7 +158,7 @@ struct x_display_info
 
   /* Emacs bitmap-id of the default icon bitmap for this frame.
      Or -1 if none has been allocated yet.  */
-  int icon_bitmap_id;
+  ptrdiff_t icon_bitmap_id;
 
   /* The root window of this screen.  */
   Window root_window;
@@ -202,10 +202,10 @@ struct x_display_info
   struct x_bitmap_record *bitmaps;
 
   /* Allocated size of bitmaps field.  */
-  int bitmaps_size;
+  ptrdiff_t bitmaps_size;
 
   /* Last used bitmap index.  */
-  int bitmaps_last;
+  ptrdiff_t bitmaps_last;
 
   /* Which modifier keys are on which modifier bits?
 
@@ -490,7 +490,7 @@ struct x_output
 
   /* If >=0, a bitmap index.  The indicated bitmap is used for the
      icon. */
-  int icon_bitmap;
+  ptrdiff_t icon_bitmap;
 
   /* Default ASCII font of this frame.  */
   struct font *font;