1 files changed, 22 insertions, 16 deletions

diff --git a/src/ftfont.c b/src/ftfont.c
index 4e313a89021..7858a31be21 100644
--- a/src/ftfont.c
+++ b/src/ftfont.c
@@ -214,6 +214,10 @@ ftfont_pattern_entity (FcPattern *p, Lisp_Object extra)
 
       for (i = 0; i < FONT_OBJLIST_INDEX; i++)
         ASET (val, i, AREF (entity, i));
+
+      ASET (val, FONT_EXTRA_INDEX, Fcopy_sequence (extra));
+      font_put_extra (val, QCfont_entity, key);
+
       return val;
     }
   entity = font_make_entity ();
@@ -682,7 +686,10 @@ ftfont_get_open_type_spec (Lisp_Object otf_spec)
       if (NILP (val))
         continue;
       len = Flength (val);
-      spec->features[i] = malloc (sizeof (int) * XINT (len));
+      spec->features[i] =
+        (min (PTRDIFF_MAX, SIZE_MAX) / sizeof (int) < XINT (len)
+         ? 0
+         : malloc (sizeof (int) * XINT (len)));
       if (! spec->features[i])
         {
           if (i > 0 && spec->features[0])
@@ -1761,15 +1768,10 @@ static OTF_GlyphString otf_gstring;
 static void
 setup_otf_gstring (int size)
 {
-  if (otf_gstring.size == 0)
-    {
-      otf_gstring.glyphs = (OTF_Glyph *) xmalloc (sizeof (OTF_Glyph) * size);
-      otf_gstring.size = size;
-    }
-  else if (otf_gstring.size < size)
+  if (otf_gstring.size < size)
     {
-      otf_gstring.glyphs = xrealloc (otf_gstring.glyphs,
-                                     sizeof (OTF_Glyph) * size);
+      otf_gstring.glyphs = xnrealloc (otf_gstring.glyphs,
+                                      size, sizeof (OTF_Glyph));
       otf_gstring.size = size;
     }
   otf_gstring.used = size;
@@ -2445,17 +2447,19 @@ ftfont_shape_by_flt (Lisp_Object lgstring, struct font *font,
         }
     }
 
+  if (INT_MAX / 2 < len)
+    memory_full (SIZE_MAX);
+
   if (gstring.allocated == 0)
     {
-      gstring.allocated = len * 2;
       gstring.glyph_size = sizeof (MFLTGlyph);
-      gstring.glyphs = xmalloc (sizeof (MFLTGlyph) * gstring.allocated);
+      gstring.glyphs = xnmalloc (len * 2, sizeof (MFLTGlyph));
+      gstring.allocated = len * 2;
     }
   else if (gstring.allocated < len * 2)
     {
+      gstring.glyphs = xnrealloc (gstring.glyphs, len * 2, sizeof (MFLTGlyph));
       gstring.allocated = len * 2;
-      gstring.glyphs = xrealloc (gstring.glyphs,
-                                 sizeof (MFLTGlyph) * gstring.allocated);
     }
   memset (gstring.glyphs, 0, sizeof (MFLTGlyph) * len);
   for (i = 0; i < len; i++)
@@ -2504,9 +2508,11 @@ ftfont_shape_by_flt (Lisp_Object lgstring, struct font *font,
       int result = mflt_run (&gstring, 0, len, &flt_font_ft.flt_font, flt);
       if (result != -2)
         break;
-      gstring.allocated += gstring.allocated;
-      gstring.glyphs = xrealloc (gstring.glyphs,
-                                 sizeof (MFLTGlyph) * gstring.allocated);
+      if (INT_MAX / 2 < gstring.allocated)
+        memory_full (SIZE_MAX);
+      gstring.glyphs = xnrealloc (gstring.glyphs,
+                                  gstring.allocated, 2 * sizeof (MFLTGlyph));
+      gstring.allocated *= 2;
     }
   if (gstring.used > LGSTRING_GLYPH_LEN (lgstring))
     return Qnil;