* xterm.c (scroll_bar_windows_size): Now size_t, not int.

(x_send_scroll_bar_event): Use size_t, not int, for sizes.
Check for overflow.

2 files changed, 8 insertions, 3 deletions

diff --git a/src/ChangeLog b/src/ChangeLog
index 6a7f35f64f8..99447fd8748 100644
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -2,6 +2,9 @@
 
         * xterm.c (x_scroll_bar_to_input_event) [!USE_GTK]:
         Remove var that is set but not used.
+        (scroll_bar_windows_size): Now size_t, not int.
+        (x_send_scroll_bar_event): Use size_t, not int, for sizes.
+        Check for overflow.
 
         * xfaces.c (realize_named_face): Remove vars that are set but not used.
         (map_tty_color) [!defined MSDOS]: Likewise.
diff --git a/src/xterm.c b/src/xterm.c
index 6bfe503c97e..92df7ae8746 100644
--- a/src/xterm.c
+++ b/src/xterm.c
@@ -4165,7 +4165,7 @@ xt_action_hook (Widget widget, XtPointer client_data, String action_name,
    x_send_scroll_bar_event and x_scroll_bar_to_input_event.  */
 
 static struct window **scroll_bar_windows;
-static int scroll_bar_windows_size;
+static size_t scroll_bar_windows_size;
 
 
 /* Send a client message with message type Xatom_Scrollbar for a
@@ -4180,7 +4180,7 @@ x_send_scroll_bar_event (Lisp_Object window, int part, int portion, int whole)
   XClientMessageEvent *ev = (XClientMessageEvent *) &event;
   struct window *w = XWINDOW (window);
   struct frame *f = XFRAME (w->frame);
-  int i;
+  size_t i;
 
   BLOCK_INPUT;
 
@@ -4201,10 +4201,12 @@ x_send_scroll_bar_event (Lisp_Object window, int part, int portion, int whole)
 
   if (i == scroll_bar_windows_size)
     {
-      int new_size = max (10, 2 * scroll_bar_windows_size);
+      size_t new_size = max (10, 2 * scroll_bar_windows_size);
       size_t nbytes = new_size * sizeof *scroll_bar_windows;
       size_t old_nbytes = scroll_bar_windows_size * sizeof *scroll_bar_windows;
 
+      if ((size_t) -1 / sizeof *scroll_bar_windows < new_size)
+        memory_full ();
       scroll_bar_windows = (struct window **) xrealloc (scroll_bar_windows,
                                                         nbytes);
       memset (&scroll_bar_windows[i], 0, nbytes - old_nbytes);