* xselect.c: Integer signedness and overflow fixes.

(Fx_register_dnd_atom, x_handle_dnd_message):
Use ptrdiff_t, not size_t, since we prefer signed.
(Fx_register_dnd_atom): Check for ptrdiff_t (and size_t) overflow.
* xterm.h (struct x_display_info): Use ptrdiff_t, not size_t, for
x_dnd_atoms_size and x_dnd_atoms_length.

3 files changed, 14 insertions, 4 deletions

diff --git a/src/ChangeLog b/src/ChangeLog
index 6e63fdd6333..43d449b459b 100644
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,5 +1,12 @@
 2011-07-07  Paul Eggert  <eggert@cs.ucla.edu>
 
+        * xselect.c: Integer signedness and overflow fixes.
+        (Fx_register_dnd_atom, x_handle_dnd_message):
+        Use ptrdiff_t, not size_t, since we prefer signed.
+        (Fx_register_dnd_atom): Check for ptrdiff_t (and size_t) overflow.
+        * xterm.h (struct x_display_info): Use ptrdiff_t, not size_t, for
+        x_dnd_atoms_size and x_dnd_atoms_length.
+
         * doprnt.c: Prefer signed to unsigned when either works.
         * eval.c (verror):
         * doprnt.c (doprnt):
diff --git a/src/xselect.c b/src/xselect.c
index 7f4e0b40f62..93a5c8bfa02 100644
--- a/src/xselect.c
+++ b/src/xselect.c
@@ -2380,7 +2380,7 @@ FRAME is on.  If FRAME is nil, the selected frame is used.  */)
 {
   Atom x_atom;
   struct frame *f = check_x_frame (frame);
-  size_t i;
+  ptrdiff_t i;
   struct x_display_info *dpyinfo = FRAME_X_DISPLAY_INFO (f);
 
 
@@ -2401,6 +2401,9 @@ FRAME is on.  If FRAME is nil, the selected frame is used.  */)
 
   if (dpyinfo->x_dnd_atoms_length == dpyinfo->x_dnd_atoms_size)
     {
+      if (min (PTRDIFF_MAX, SIZE_MAX) / sizeof *dpyinfo->x_dnd_atoms / 2
+          < dpyinfo->x_dnd_atoms_size)
+        memory_full (SIZE_MAX);
       dpyinfo->x_dnd_atoms_size *= 2;
       dpyinfo->x_dnd_atoms = xrealloc (dpyinfo->x_dnd_atoms,
                                        sizeof (*dpyinfo->x_dnd_atoms)
@@ -2423,7 +2426,7 @@ x_handle_dnd_message (struct frame *f, XClientMessageEvent *event, struct x_disp
   int x, y;
   unsigned char *data = (unsigned char *) event->data.b;
   int idata[5];
-  size_t i;
+  ptrdiff_t i;
 
   for (i = 0; i < dpyinfo->x_dnd_atoms_length; ++i)
     if (dpyinfo->x_dnd_atoms[i] == event->message_type) break;
diff --git a/src/xterm.h b/src/xterm.h
index a4767361bb3..30867656710 100644
--- a/src/xterm.h
+++ b/src/xterm.h
@@ -326,8 +326,8 @@ struct x_display_info
 
   /* Atoms that are drag and drop atoms */
   Atom *x_dnd_atoms;
-  size_t x_dnd_atoms_size;
-  size_t x_dnd_atoms_length;
+  ptrdiff_t x_dnd_atoms_size;
+  ptrdiff_t x_dnd_atoms_length;
 
   /* Extended window manager hints, Atoms supported by the window manager and
      atoms for settig the window type.  */