1 files changed, 17 insertions, 14 deletions

diff --git a/src/tparam.c b/src/tparam.c
index 6aae0b97db9..ac21667d65b 100644
--- a/src/tparam.c
+++ b/src/tparam.c
@@ -79,24 +79,25 @@ tparam1 (const char *string, char *outstring, int len,
   register const char *p = string;
   register char *op = outstring;
   char *outend;
-  int outlen = 0;
+  char *new = 0;
+  ptrdiff_t outlen = 0;
 
   register int tem;
   int *old_argp = argp;                 /* can move */
   int *fixed_argp = argp;               /* never moves */
   int explicit_param_p = 0;             /* set by %p */
-  int doleft = 0;
-  int doup = 0;
+  ptrdiff_t doleft = 0;
+  ptrdiff_t doup = 0;
+  ptrdiff_t append_len = 0;
 
   outend = outstring + len;
 
   while (1)
     {
       /* If the buffer might be too short, make it bigger.  */
-      if (op + 5 >= outend)
+      while (outend - op - append_len <= 5)
         {
-          register char *new;
-          int offset = op - outstring;
+          ptrdiff_t offset = op - outstring;
 
           if (outlen == 0)
             {
@@ -106,8 +107,7 @@ tparam1 (const char *string, char *outstring, int len,
             }
           else
             {
-              outlen *= 2;
-              new = (char *) xrealloc (outstring, outlen);
+              new = xpalloc (outstring, &outlen, 1, -1, 1);
             }
 
           op = new + offset;
@@ -167,11 +167,15 @@ tparam1 (const char *string, char *outstring, int len,
                      and this is one of them, increment it.  */
                   while (tem == 0 || tem == '\n' || tem == '\t')
                     {
+                      ptrdiff_t append_len_incr;
                       tem++;
                       if (argp == old_argp)
-                        doup++, outend -= strlen (up);
+                        doup++, append_len_incr = strlen (up);
                       else
-                        doleft++, outend -= strlen (left);
+                        doleft++, append_len_incr = strlen (left);
+                      if (INT_ADD_OVERFLOW (append_len, append_len_incr))
+                        memory_full (SIZE_MAX);
+                      append_len += append_len_incr;
                     }
                 }
               *op++ = tem ? tem : 0200;
@@ -265,16 +269,15 @@ tparam1 (const char *string, char *outstring, int len,
 
 #ifdef DEBUG
 
-main (argc, argv)
-     int argc;
-     char **argv;
+int
+main (int argc, char **argv)
 {
   char buf[50];
   int args[3];
   args[0] = atoi (argv[2]);
   args[1] = atoi (argv[3]);
   args[2] = atoi (argv[4]);
-  tparam1 (argv[1], buf, "LEFT", "UP", args);
+  tparam1 (argv[1], buf, 50, "LEFT", "UP", args);
   printf ("%s\n", buf);
   return 0;
 }