Merge: Integer signedness and overflow and related fixes.

Fixes: debbugs:9079

1 files changed, 6 insertions, 4 deletions

diff --git a/src/xfaces.c b/src/xfaces.c
index 32729ce6f8d..52b125b42e6 100644
--- a/src/xfaces.c
+++ b/src/xfaces.c
@@ -940,11 +940,13 @@ the pixmap.  Bits are stored row by row, each row occupies
             }
         }
 
-      if (NATNUMP (width) && NATNUMP (height) && STRINGP (data))
+      if (STRINGP (data)
+          && INTEGERP (width) && 0 < XINT (width)
+          && INTEGERP (height) && 0 < XINT (height))
         {
-          int bytes_per_row = ((XFASTINT (width) + BITS_PER_CHAR - 1)
-                               / BITS_PER_CHAR);
-          if (SBYTES (data) >= bytes_per_row * XINT (height))
+          EMACS_INT bytes_per_row = ((XINT (width) + BITS_PER_CHAR - 1)
+                                     / BITS_PER_CHAR);
+          if (XINT (height) <= SBYTES (data) / bytes_per_row)
             pixmap_p = 1;
         }
     }