* xfaces.c (Fbitmap_spec_p): Fix integer overflow bug.

Without this fix, (bitmap-spec-p '(34359738368 1 "x"))
would wrongly return t on a 64-bit host.

2 files changed, 12 insertions, 4 deletions

diff --git a/src/ChangeLog b/src/ChangeLog
index b0913ab983c..8911b6bdce2 100644
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,3 +1,9 @@
+2011-07-12  Paul Eggert  <eggert@cs.ucla.edu>
+
+        * xfaces.c (Fbitmap_spec_p): Fix integer overflow bug.
+        Without this fix, (bitmap-spec-p '(34359738368 1 "x"))
+        would wrongly return t on a 64-bit host.
+
 2011-07-11  Paul Eggert  <eggert@cs.ucla.edu>
 
         * dispnew.c (init_display): Use *_RANGE_OVERFLOW macros.
diff --git a/src/xfaces.c b/src/xfaces.c
index c1e75ab3e59..e0dc2883f33 100644
--- a/src/xfaces.c
+++ b/src/xfaces.c
@@ -940,11 +940,13 @@ the pixmap.  Bits are stored row by row, each row occupies
             }
         }
 
-      if (NATNUMP (width) && NATNUMP (height) && STRINGP (data))
+      if (STRINGP (data)
+          && INTEGERP (width) && 0 < XINT (width)
+          && INTEGERP (height) && 0 < XINT (height))
         {
-          int bytes_per_row = ((XFASTINT (width) + BITS_PER_CHAR - 1)
-                               / BITS_PER_CHAR);
-          if (SBYTES (data) >= bytes_per_row * XINT (height))
+          EMACS_INT bytes_per_row = ((XINT (width) + BITS_PER_CHAR - 1)
+                                     / BITS_PER_CHAR);
+          if (XINT (height) <= SBYTES (data) / bytes_per_row)
             pixmap_p = 1;
         }
     }