$OpenBSD: patch-libtiff_tif_dir_c,v 1.1 2004/10/20 20:37:48 brad Exp $
--- libtiff/tif_dir.c.orig	Fri Dec 26 06:56:25 2003
+++ libtiff/tif_dir.c	Wed Oct 20 14:38:11 2004
@@ -40,26 +40,33 @@
 #define DATATYPE_UINT		2       /* !unsigned integer data */
 #define DATATYPE_IEEEFP		3       /* !IEEE floating point data */
 
-void
-_TIFFsetByteArray(void** vpp, void* vp, long n)
+static void
+setByteArray(void** vpp, void* vp, size_t nmemb, size_t elem_size)
 {
 	if (*vpp)
 		_TIFFfree(*vpp), *vpp = 0;
-	if (vp && (*vpp = (void*) _TIFFmalloc(n)))
-		_TIFFmemcpy(*vpp, vp, n);
+	if (vp) {
+		tsize_t	bytes = nmemb * elem_size;
+		if (elem_size && bytes / elem_size == nmemb)
+			*vpp = (void*) _TIFFmalloc(bytes);
+		if (*vpp)
+			_TIFFmemcpy(*vpp, vp, bytes);
+	}
 }
+void _TIFFsetByteArray(void** vpp, void* vp, long n)
+    { setByteArray(vpp, vp, n, 1); }
 void _TIFFsetString(char** cpp, char* cp)
-    { _TIFFsetByteArray((void**) cpp, (void*) cp, (long) (strlen(cp)+1)); }
+    { setByteArray((void**) cpp, (void*) cp, strlen(cp)+1, 1); }
 void _TIFFsetNString(char** cpp, char* cp, long n)
-    { _TIFFsetByteArray((void**) cpp, (void*) cp, n); }
+    { setByteArray((void**) cpp, (void*) cp, n, 1); }
 void _TIFFsetShortArray(uint16** wpp, uint16* wp, long n)
-    { _TIFFsetByteArray((void**) wpp, (void*) wp, n*sizeof (uint16)); }
+    { setByteArray((void**) wpp, (void*) wp, n, sizeof (uint16)); }
 void _TIFFsetLongArray(uint32** lpp, uint32* lp, long n)
-    { _TIFFsetByteArray((void**) lpp, (void*) lp, n*sizeof (uint32)); }
+    { setByteArray((void**) lpp, (void*) lp, n, sizeof (uint32)); }
 void _TIFFsetFloatArray(float** fpp, float* fp, long n)
-    { _TIFFsetByteArray((void**) fpp, (void*) fp, n*sizeof (float)); }
+    { setByteArray((void**) fpp, (void*) fp, n, sizeof (float)); }
 void _TIFFsetDoubleArray(double** dpp, double* dp, long n)
-    { _TIFFsetByteArray((void**) dpp, (void*) dp, n*sizeof (double)); }
+    { setByteArray((void**) dpp, (void*) dp, n, sizeof (double)); }
 
 /*
  * Install extra samples information.
@@ -521,15 +528,22 @@ _TIFFVSetField(TIFF* tif, ttag_t tag, va
              */
             if( tv == NULL )
             {
-                td->td_customValueCount++;
-                if( td->td_customValueCount > 1 )
-                    td->td_customValues = (TIFFTagValue *)
-                        _TIFFrealloc(td->td_customValues,
-                                     sizeof(TIFFTagValue) * td->td_customValueCount);
-                else
-                    td->td_customValues = (TIFFTagValue *)
-                        _TIFFmalloc(sizeof(TIFFTagValue));
+		TIFFTagValue	*new_customValues;
+		
+		td->td_customValueCount++;
+		new_customValues = (TIFFTagValue *)
+			_TIFFrealloc(td->td_customValues,
+				     sizeof(TIFFTagValue) * td->td_customValueCount);
+		if (!new_customValues) {
+			TIFFError(module,
+		"%s: Failed to allocate space for list of custom values",
+				  tif->tif_name);
+			status = 0;
+			goto end;
+		}
 
+		td->td_customValues = new_customValues;
+
                 tv = td->td_customValues + (td->td_customValueCount-1);
                 tv->info = fip;
                 tv->value = NULL;
@@ -584,6 +598,8 @@ _TIFFVSetField(TIFF* tif, ttag_t tag, va
             TIFFSetFieldBit(tif, _TIFFFieldWithTag(tif, tag)->field_bit);
             tif->tif_flags |= TIFF_DIRTYDIRECT;
 	}
+
+end:
 	va_end(ap);
 	return (status);
 badvalue:
