* xfaces.c: Integer and memory overflow fixes.

(Finternal_make_lisp_face): Use ptrdiff_t, not int, for sizes.
Check for size calculation overflow.
(cache_face): Do not overflow in size calculation.

2 files changed, 16 insertions, 3 deletions

diff --git a/src/ChangeLog b/src/ChangeLog
index a7bc6bdd461..3ac8c562a52 100644
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,5 +1,10 @@
 2011-07-29  Paul Eggert  <eggert@cs.ucla.edu>
 
+        * xfaces.c: Integer and memory overflow fixes.
+        (Finternal_make_lisp_face): Use ptrdiff_t, not int, for sizes.
+        Check for size calculation overflow.
+        (cache_face): Do not overflow in size calculation.
+
         * xdisp.c: Integer and memory overflow fixes.
         (store_mode_line_noprop_char, x_consider_frame_title):
         Use ptrdiff_t, not int, for sizes.
diff --git a/src/xfaces.c b/src/xfaces.c
index e0dc2883f33..996bcdaf6ad 100644
--- a/src/xfaces.c
+++ b/src/xfaces.c
@@ -2667,8 +2667,13 @@ Value is a vector of face attributes.  */)
          property `face' of the Lisp face name.  */
       if (next_lface_id == lface_id_to_name_size)
         {
-          int new_size = max (50, 2 * lface_id_to_name_size);
-          int sz = new_size * sizeof *lface_id_to_name;
+          ptrdiff_t new_size, sz;
+          if (min (min (PTRDIFF_MAX, SIZE_MAX) / 2 / sizeof *lface_id_to_name,
+                   MOST_POSITIVE_FIXNUM)
+              < lface_id_to_name_size)
+            memory_full (SIZE_MAX);
+          new_size = max (50, 2 * lface_id_to_name_size);
+          sz = new_size * sizeof *lface_id_to_name;
           lface_id_to_name = (Lisp_Object *) xrealloc (lface_id_to_name, sz);
           lface_id_to_name_size = new_size;
         }
@@ -4411,7 +4416,10 @@ cache_face (struct face_cache *c, struct face *face, unsigned int hash)
       if (c->used == c->size)
         {
           int new_size, sz;
-          new_size = min (2 * c->size, MAX_FACE_ID);
+          new_size =
+            min (2 * c->size,
+                 min (MAX_FACE_ID,
+                      min (PTRDIFF_MAX, SIZE_MAX) / sizeof *c->faces_by_id));
           if (new_size == c->size)
             abort ();  /* Alternatives?  ++kfs */
           sz = new_size * sizeof *c->faces_by_id;