$OpenBSD: patch-libs_xpdf_xpdf_XRef_cc,v 1.3 2005/02/21 21:36:07 sturm Exp $
--- libs/xpdf/xpdf/XRef.cc.orig	Wed Jan 19 13:09:57 2005
+++ libs/xpdf/xpdf/XRef.cc	Thu Feb 10 22:18:03 2005
@@ -28,6 +28,7 @@
 #include "Error.h"
 #include "ErrorCodes.h"
 #include "XRef.h"
+#include <limits.h>
 
 //------------------------------------------------------------------------
 
@@ -741,6 +742,10 @@ GBool XRef::constructXRef() {
     } else if (!strncmp(p, "endstream", 9)) {
       if (streamEndsLen == streamEndsSize) {
 	streamEndsSize += 64;
+  	if (streamEndsSize >= INT_MAX/sizeof(int)) {
+  	  error(-1, "Invalid 'endstream' parameter.");
+  	  return gFalse;
+  	}
 	streamEnds = (Guint *)grealloc(streamEnds,
 				       streamEndsSize * sizeof(int));
       }
