11 files changed, 59 insertions, 35 deletions

diff --git a/glib/poppler-page.cc b/glib/poppler-page.cc
index f1dd1336..225c97b2 100644
--- a/glib/poppler-page.cc
+++ b/glib/poppler-page.cc
@@ -316,7 +316,7 @@ poppler_page_prepare_output_dev (PopplerPage *page,
 
   output_dev = page->document->output_dev;
   cairo_rowstride = cairo_width * 4;
-  cairo_data = (guchar *) gmalloc (cairo_height * cairo_rowstride);
+  cairo_data = (guchar *) gmallocn (cairo_height, cairo_rowstride);
   if (transparent)
       memset (cairo_data, 0x00, cairo_height * cairo_rowstride);
   else
diff --git a/goo/gmem.cc b/goo/gmem.cc
index 298d5ddb..af3e19ef 100644
--- a/goo/gmem.cc
+++ b/goo/gmem.cc
@@ -216,6 +216,28 @@ void *gmallocn_checkoverflow(int nObjs, int objSize) GMEM_EXCEP {
   return gmallocn(nObjs, objSize, true);
 }
 
+inline static void *gmallocn3(int a, int b, int c, bool checkoverflow) GMEM_EXCEP {
+  int n = a * b;
+  if (b <= 0 || a < 0 || a >= INT_MAX / b) {
+#if USE_EXCEPTIONS
+    throw GMemException();
+#else
+    fprintf(stderr, "Bogus memory allocation size\n");
+    if (checkoverflow) return NULL;
+    else exit(1);
+#endif
+  }
+  return gmallocn(n, c, checkoverflow);
+}
+
+void *gmallocn3(int a, int b, int c) GMEM_EXCEP {
+  return gmallocn3(a, b, c, false);
+}
+
+void *gmallocn3_checkoverflow(int a, int b, int c) GMEM_EXCEP {
+  return gmallocn3(a, b, c, true);
+}
+
 inline static void *greallocn(void *p, int nObjs, int objSize, bool checkoverflow) GMEM_EXCEP {
   int n;
 
diff --git a/goo/gmem.h b/goo/gmem.h
index 96d834de..0c16b01c 100644
--- a/goo/gmem.h
+++ b/goo/gmem.h
@@ -72,6 +72,8 @@ extern void *grealloc_checkoverflow(size_t size) GMEM_EXCEP;
  */
 extern void *gmallocn(int nObjs, int objSize) GMEM_EXCEP;
 extern void *gmallocn_checkoverflow(int nObjs, int objSize) GMEM_EXCEP;
+extern void *gmallocn3(int a, int b, int c) GMEM_EXCEP;
+extern void *gmallocn3_checkoverflow(int a, int b, int c) GMEM_EXCEP;
 extern void *greallocn(void *p, int nObjs, int objSize) GMEM_EXCEP;
 extern void *greallocn_checkoverflow(void *p, int nObjs, int objSize) GMEM_EXCEP;
 
diff --git a/poppler/ArthurOutputDev.cc b/poppler/ArthurOutputDev.cc
index 4f6a1d0f..fe562fe3 100644
--- a/poppler/ArthurOutputDev.cc
+++ b/poppler/ArthurOutputDev.cc
@@ -14,7 +14,7 @@
 // under GPL version 2 or later
 //
 // Copyright (C) 2005 Brad Hards <bradh@frogmouth.net>
-// Copyright (C) 2005-2008 Albert Astals Cid <aacid@kde.org>
+// Copyright (C) 2005-2009 Albert Astals Cid <aacid@kde.org>
 // Copyright (C) 2008 Pino Toscano <pino@kde.org>
 //
 // To see a description of the changes please see the Changelog file that
@@ -751,7 +751,7 @@ void ArthurOutputDev::drawImage(GfxState *state, Object *ref, Stream *str,
   QMatrix matrix;
   int is_identity_transform;
   
-  buffer = (unsigned char *)gmalloc (width * height * 4);
+  buffer = (unsigned char *)gmallocn3(width, height, 4);
 
   /* TODO: Do we want to cache these? */
   imgStr = new ImageStream(str, width,
diff --git a/poppler/CairoOutputDev.cc b/poppler/CairoOutputDev.cc
index 91e1d045..98adb7cb 100644
--- a/poppler/CairoOutputDev.cc
+++ b/poppler/CairoOutputDev.cc
@@ -16,7 +16,7 @@
 //
 // Copyright (C) 2005-2008 Jeff Muizelaar <jeff@infidigm.net>
 // Copyright (C) 2005, 2006 Kristian Høgsberg <krh@redhat.com>
-// Copyright (C) 2005 Albert Astals Cid <aacid@kde.org>
+// Copyright (C) 2005, 2009 Albert Astals Cid <aacid@kde.org>
 // Copyright (C) 2005 Nickolay V. Shmyrev <nshmyrev@yandex.ru>
 // Copyright (C) 2006-2008 Carlos Garcia Campos <carlosgc@gnome.org>
 // Copyright (C) 2008 Carl Worth <cworth@cworth.org>
@@ -611,7 +611,7 @@ void CairoOutputDev::beginString(GfxState *state, GooString *s)
   if (!currentFont)
     return;
 
-  glyphs = (cairo_glyph_t *) gmalloc (len * sizeof (cairo_glyph_t));
+  glyphs = (cairo_glyph_t *) gmallocn (len, sizeof (cairo_glyph_t));
   glyphCount = 0;
 }
 
@@ -1461,7 +1461,7 @@ void CairoOutputDev::drawMaskedImage(GfxState *state, Object *ref,
 
   int row_stride = (maskWidth + 3) & ~3;
   unsigned char *maskBuffer;
-  maskBuffer = (unsigned char *)gmalloc (row_stride * maskHeight);
+  maskBuffer = (unsigned char *)gmallocn (row_stride, maskHeight);
   unsigned char *maskDest;
   cairo_surface_t *maskImage;
   cairo_pattern_t *maskPattern;
@@ -1497,7 +1497,7 @@ void CairoOutputDev::drawMaskedImage(GfxState *state, Object *ref,
   cairo_matrix_t matrix;
   int is_identity_transform;
 
-  buffer = (unsigned char *)gmalloc (width * height * 4);
+  buffer = (unsigned char *)gmallocn3 (width, height, 4);
 
   /* TODO: Do we want to cache these? */
   imgStr = new ImageStream(str, width,
@@ -1586,7 +1586,7 @@ void CairoOutputDev::drawSoftMaskedImage(GfxState *state, Object *ref, Stream *s
 
   int row_stride = (maskWidth + 3) & ~3;
   unsigned char *maskBuffer;
-  maskBuffer = (unsigned char *)gmalloc (row_stride * maskHeight);
+  maskBuffer = (unsigned char *)gmallocn (row_stride, maskHeight);
   unsigned char *maskDest;
   cairo_surface_t *maskImage;
   cairo_pattern_t *maskPattern;
@@ -1613,7 +1613,7 @@ void CairoOutputDev::drawSoftMaskedImage(GfxState *state, Object *ref, Stream *s
   cairo_matrix_t maskMatrix;
   int is_identity_transform;
 
-  buffer = (unsigned char *)gmalloc (width * height * 4);
+  buffer = (unsigned char *)gmallocn3 (width, height, 4);
 
   /* TODO: Do we want to cache these? */
   imgStr = new ImageStream(str, width,
@@ -1705,7 +1705,7 @@ void CairoOutputDev::drawImage(GfxState *state, Object *ref, Stream *str,
   cairo_matrix_t matrix;
   int is_identity_transform;
   
-  buffer = (unsigned char *)gmalloc (width * height * 4);
+  buffer = (unsigned char *)gmallocn3 (width, height, 4);
 
   /* TODO: Do we want to cache these? */
   imgStr = new ImageStream(str, width,
diff --git a/poppler/GfxState.cc b/poppler/GfxState.cc
index 8fc8feb5..1ca32895 100644
--- a/poppler/GfxState.cc
+++ b/poppler/GfxState.cc
@@ -1849,7 +1849,7 @@ void GfxIndexedColorSpace::getRGBLine(Guchar *in, unsigned int *out, int length)
   int i, j, n;
 
   n = base->getNComps();
-  line = (Guchar *) gmalloc (length * n);
+  line = (Guchar *) gmallocn (length, n);
   for (i = 0; i < length; i++)
     for (j = 0; j < n; j++)
       line[i * n + j] = lookup[in[i] * n + j];
@@ -4072,7 +4072,7 @@ GfxImageColorMap::GfxImageColorMap(int bitsA, Object *decode,
     nComps2 = colorSpace2->getNComps();
     lookup2 = indexedCS->getLookup();
     colorSpace2->getDefaultRanges(x, y, indexHigh);
-    byte_lookup = (Guchar *)gmalloc ((maxPixel + 1) * nComps2);
+    byte_lookup = (Guchar *)gmallocn ((maxPixel + 1), nComps2);
     for (k = 0; k < nComps2; ++k) {
       lookup[k] = (GfxColorComp *)gmallocn(maxPixel + 1,
                                            sizeof(GfxColorComp));
@@ -4220,7 +4220,7 @@ void GfxImageColorMap::getGrayLine(Guchar *in, Guchar *out, int length) {
   switch (colorSpace->getMode()) {
   case csIndexed:
   case csSeparation:
-    tmp_line = (Guchar *) gmalloc (length * nComps2);
+    tmp_line = (Guchar *) gmallocn (length, nComps2);
     for (i = 0; i < length; i++) {
       for (j = 0; j < nComps2; j++) {
         tmp_line[i * nComps2 + j] = byte_lookup[in[i] * nComps2 + j];
@@ -4250,7 +4250,7 @@ void GfxImageColorMap::getRGBLine(Guchar *in, unsigned int *out, int length) {
   switch (colorSpace->getMode()) {
   case csIndexed:
   case csSeparation:
-    tmp_line = (Guchar *) gmalloc (length * nComps2);
+    tmp_line = (Guchar *) gmallocn (length, nComps2);
     for (i = 0; i < length; i++) {
       for (j = 0; j < nComps2; j++) {
         tmp_line[i * nComps2 + j] = byte_lookup[in[i] * nComps2 + j];
diff --git a/poppler/PSOutputDev.cc b/poppler/PSOutputDev.cc
index 9477762e..f02bd98a 100644
--- a/poppler/PSOutputDev.cc
+++ b/poppler/PSOutputDev.cc
@@ -15,7 +15,7 @@
 //
 // Copyright (C) 2005 Martin Kretzschmar <martink@gnome.org>
 // Copyright (C) 2005, 2006 Kristian Høgsberg <krh@redhat.com>
-// Copyright (C) 2006-2008 Albert Astals Cid <aacid@kde.org>
+// Copyright (C) 2006-2009 Albert Astals Cid <aacid@kde.org>
 // Copyright (C) 2006 Jeff Muizelaar <jeff@infidigm.net>
 // Copyright (C) 2007, 2008 Brad Hards <bradh@kde.org>
 // Copyright (C) 2008 Koji Otani <sho@bbr.jp>
@@ -2324,7 +2324,7 @@ GooString *PSOutputDev::setupExternalCIDTrueTypeFont(GfxFont *font, GooString *f
   if ((ffTT = FoFiTrueType::load(fileName->getCString(), faceIndex))) {
       int n = ((GfxCIDFont *)font)->getCIDToGIDLen();
       if (n) {
-        codeToGID = (Gushort *)gmalloc(n * sizeof(Gushort));
+        codeToGID = (Gushort *)gmallocn(n, sizeof(Gushort));
         memcpy(codeToGID, ((GfxCIDFont *)font)->getCIDToGID(), n * sizeof(Gushort));
       } else {
         codeToGID = ((GfxCIDFont *)font)->getCodeToGIDMap(ffTT, &n);
@@ -4503,7 +4503,7 @@ void PSOutputDev::doImageL1Sep(GfxImageColorMap *colorMap,
              width, -height, height);
 
   // allocate a line buffer
-  lineBuf = (Guchar *)gmalloc(4 * width);
+  lineBuf = (Guchar *)gmallocn(width, 4);
 
   // set up to process the data stream
   imgStr = new ImageStream(str, width, colorMap->getNumPixelComps(),
diff --git a/poppler/SplashOutputDev.cc b/poppler/SplashOutputDev.cc
index 8d4758a6..dc4661a9 100644
--- a/poppler/SplashOutputDev.cc
+++ b/poppler/SplashOutputDev.cc
@@ -15,7 +15,7 @@
 //
 // Copyright (C) 2005 Takashi Iwai <tiwai@suse.de>
 // Copyright (C) 2006 Stefan Schweizer <genstef@gentoo.org>
-// Copyright (C) 2006-2008 Albert Astals Cid <aacid@kde.org>
+// Copyright (C) 2006-2009 Albert Astals Cid <aacid@kde.org>
 // Copyright (C) 2006 Krzysztof Kowalczyk <kkowalczyk@gmail.com>
 // Copyright (C) 2006 Scott Turner <scotty1024@mac.com>
 // Copyright (C) 2007 Koji Otani <sho@bbr.jp>
@@ -2013,7 +2013,7 @@ void SplashOutputDev::drawImage(GfxState *state, Object *ref, Stream *str,
       break;
     case splashModeRGB8:
     case splashModeBGR8:
-      imgData.lookup = (SplashColorPtr)gmalloc(3 * n);
+      imgData.lookup = (SplashColorPtr)gmallocn(n, 3);
       for (i = 0; i < n; ++i) {
         pix = (Guchar)i;
         colorMap->getRGB(&pix, &rgb);
@@ -2023,7 +2023,7 @@ void SplashOutputDev::drawImage(GfxState *state, Object *ref, Stream *str,
       }
       break;
     case splashModeXBGR8:
-      imgData.lookup = (SplashColorPtr)gmalloc(4 * n);
+      imgData.lookup = (SplashColorPtr)gmallocn(n, 4);
       for (i = 0; i < n; ++i) {
         pix = (Guchar)i;
         colorMap->getRGB(&pix, &rgb);
@@ -2035,7 +2035,7 @@ void SplashOutputDev::drawImage(GfxState *state, Object *ref, Stream *str,
       break;
 #if SPLASH_CMYK
     case splashModeCMYK8:
-      imgData.lookup = (SplashColorPtr)gmalloc(4 * n);
+      imgData.lookup = (SplashColorPtr)gmallocn(n, 4);
       for (i = 0; i < n; ++i) {
         pix = (Guchar)i;
         colorMap->getCMYK(&pix, &cmyk);
@@ -2278,7 +2278,7 @@ void SplashOutputDev::drawMaskedImage(GfxState *state, Object *ref,
         break;
       case splashModeRGB8:
       case splashModeBGR8:
-        imgData.lookup = (SplashColorPtr)gmalloc(3 * n);
+        imgData.lookup = (SplashColorPtr)gmallocn(n, 3);
         for (i = 0; i < n; ++i) {
           pix = (Guchar)i;
           colorMap->getRGB(&pix, &rgb);
@@ -2288,7 +2288,7 @@ void SplashOutputDev::drawMaskedImage(GfxState *state, Object *ref,
         }
         break;
       case splashModeXBGR8:
-        imgData.lookup = (SplashColorPtr)gmalloc(4 * n);
+        imgData.lookup = (SplashColorPtr)gmallocn(n, 4);
         for (i = 0; i < n; ++i) {
           pix = (Guchar)i;
           colorMap->getRGB(&pix, &rgb);
@@ -2300,7 +2300,7 @@ void SplashOutputDev::drawMaskedImage(GfxState *state, Object *ref,
         break;
 #if SPLASH_CMYK
       case splashModeCMYK8:
-        imgData.lookup = (SplashColorPtr)gmalloc(4 * n);
+        imgData.lookup = (SplashColorPtr)gmallocn(n, 4);
         for (i = 0; i < n; ++i) {
           pix = (Guchar)i;
           colorMap->getCMYK(&pix, &cmyk);
@@ -2421,7 +2421,7 @@ void SplashOutputDev::drawSoftMaskedImage(GfxState *state, Object *ref,
       break;
     case splashModeRGB8:
     case splashModeBGR8:
-      imgData.lookup = (SplashColorPtr)gmalloc(3 * n);
+      imgData.lookup = (SplashColorPtr)gmallocn(n, 3);
       for (i = 0; i < n; ++i) {
         pix = (Guchar)i;
         colorMap->getRGB(&pix, &rgb);
@@ -2431,7 +2431,7 @@ void SplashOutputDev::drawSoftMaskedImage(GfxState *state, Object *ref,
       }
       break;
     case splashModeXBGR8:
-      imgData.lookup = (SplashColorPtr)gmalloc(4 * n);
+      imgData.lookup = (SplashColorPtr)gmallocn(n, 4);
       for (i = 0; i < n; ++i) {
         pix = (Guchar)i;
         colorMap->getRGB(&pix, &rgb);
@@ -2443,7 +2443,7 @@ void SplashOutputDev::drawSoftMaskedImage(GfxState *state, Object *ref,
       break;
 #if SPLASH_CMYK
     case splashModeCMYK8:
-      imgData.lookup = (SplashColorPtr)gmalloc(4 * n);
+      imgData.lookup = (SplashColorPtr)gmallocn(n, 4);
       for (i = 0; i < n; ++i) {
         pix = (Guchar)i;
         colorMap->getCMYK(&pix, &cmyk);
diff --git a/splash/Splash.cc b/splash/Splash.cc
index c93ef408..a1deb854 100644
--- a/splash/Splash.cc
+++ b/splash/Splash.cc
@@ -11,7 +11,7 @@
 // All changes made under the Poppler project to this file are licensed
 // under GPL version 2 or later
 //
-// Copyright (C) 2005-2008 Albert Astals Cid <aacid@kde.org>
+// Copyright (C) 2005-2009 Albert Astals Cid <aacid@kde.org>
 // Copyright (C) 2005 Marco Pesenti Gritti <mpg@redhat.com>
 //
 // To see a description of the changes please see the Changelog file that
@@ -2001,7 +2001,7 @@ SplashError Splash::fillImageMask(SplashImageMaskSource src, void *srcData,
   xq = w % scaledWidth;
 
   // allocate pixel buffer
-  pixBuf = (SplashColorPtr)gmalloc((yp + 1) * w);
+  pixBuf = (SplashColorPtr)gmallocn((yp + 1), w);
 
   // initialize the pixel pipe
   pipeInit(&pipe, 0, 0, state->fillPattern, NULL, state->fillAlpha,
@@ -2301,9 +2301,9 @@ SplashError Splash::drawImage(SplashImageSource src, void *srcData,
   xq = w % scaledWidth;
 
   // allocate pixel buffers
-  colorBuf = (SplashColorPtr)gmalloc((yp + 1) * w * nComps);
+  colorBuf = (SplashColorPtr)gmallocn3((yp + 1), w, nComps);
   if (srcAlpha) {
-    alphaBuf = (Guchar *)gmalloc((yp + 1) * w);
+    alphaBuf = (Guchar *)gmallocn((yp + 1), w);
   } else {
     alphaBuf = NULL;
   }
diff --git a/splash/SplashBitmap.cc b/splash/SplashBitmap.cc
index 97d622cf..6cf2aea9 100644
--- a/splash/SplashBitmap.cc
+++ b/splash/SplashBitmap.cc
@@ -11,7 +11,7 @@
 // All changes made under the Poppler project to this file are licensed
 // under GPL version 2 or later
 //
-// Copyright (C) 2006 Albert Astals Cid <aacid@kde.org>
+// Copyright (C) 2006, 2009 Albert Astals Cid <aacid@kde.org>
 // Copyright (C) 2007 Ilmari Heikkinen <ilmari.heikkinen@gmail.com>
 //
 // To see a description of the changes please see the Changelog file that
@@ -62,13 +62,13 @@ SplashBitmap::SplashBitmap(int widthA, int heightA, int rowPad,
   }
   rowSize += rowPad - 1;
   rowSize -= rowSize % rowPad;
-  data = (SplashColorPtr)gmalloc(rowSize * height);
+  data = (SplashColorPtr)gmallocn(rowSize, height);
   if (!topDown) {
     data += (height - 1) * rowSize;
     rowSize = -rowSize;
   }
   if (alphaA) {
-    alpha = (Guchar *)gmalloc(width * height);
+    alpha = (Guchar *)gmallocn(width, height);
   } else {
     alpha = NULL;
   }
diff --git a/splash/SplashFTFont.cc b/splash/SplashFTFont.cc
index 0039feb6..c3b298af 100644
--- a/splash/SplashFTFont.cc
+++ b/splash/SplashFTFont.cc
@@ -243,7 +243,7 @@ GBool SplashFTFont::makeGlyph(int c, int xFrac, int yFrac,
   } else {
     rowSize = (bitmap->w + 7) >> 3;
   }
-  bitmap->data = (Guchar *)gmalloc(rowSize * bitmap->h);
+  bitmap->data = (Guchar *)gmallocn(rowSize, bitmap->h);
   bitmap->freeData = gTrue;
   for (i = 0, p = bitmap->data, q = slot->bitmap.buffer;
        i < bitmap->h;