* image.c (cache_image): Check for size arithmetic overflow.

2 files changed, 6 insertions, 0 deletions

diff --git a/src/ChangeLog b/src/ChangeLog
index e1e9e24fcba..7f174bf0a21 100644
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,3 +1,7 @@
+2011-06-23  Paul Eggert  <eggert@cs.ucla.edu>
+
+        * image.c (cache_image): Check for size arithmetic overflow.
+
 2011-06-22  Paul Eggert  <eggert@cs.ucla.edu>
 
         * lread.c: Integer overflow issues.
diff --git a/src/image.c b/src/image.c
index a9785e5d00f..6e8440fb431 100644
--- a/src/image.c
+++ b/src/image.c
@@ -1836,6 +1836,8 @@ cache_image (struct frame *f, struct image *img)
   /* If no free slot found, maybe enlarge c->images.  */
   if (i == c->used && c->used == c->size)
     {
+      if (min (PTRDIFF_MAX, SIZE_MAX) / sizeof *c->images / 2 < c->size)
+        memory_full (SIZE_MAX);
       c->size *= 2;
       c->images = (struct image **) xrealloc (c->images,
                                               c->size * sizeof *c->images);