$OpenBSD: patch-xpdf_Catalog_cc,v 1.2 2005/09/09 17:34:53 brad Exp $
--- xpdf/Catalog.cc.orig	Wed Aug 17 07:34:31 2005
+++ xpdf/Catalog.cc	Thu Aug 18 10:15:28 2005
@@ -64,6 +64,15 @@ Catalog::Catalog(XRef *xrefA) {
   }
   pagesSize = numPages0 = (int)obj.getNum();
   obj.free();
+  // The gcc doesnt optimize this away, so this check is ok,
+  // even if it looks like a pagesSize != pagesSize check
+  if (pagesSize*sizeof(Page *)/sizeof(Page *) != pagesSize ||
+      pagesSize*sizeof(Ref)/sizeof(Ref) != pagesSize) {
+    error(-1, "Invalid 'pagesSize'");
+    ok = gFalse;
+    return;
+  }
+
   pages = (Page **)gmallocn(pagesSize, sizeof(Page *));
   pageRefs = (Ref *)gmallocn(pagesSize, sizeof(Ref));
   for (i = 0; i < pagesSize; ++i) {
@@ -195,6 +204,11 @@ int Catalog::readPageTree(Dict *pagesDic
       }
       if (start >= pagesSize) {
 	pagesSize += 32;
+         if (pagesSize*sizeof(Page *)/sizeof(Page *) != pagesSize ||
+                pagesSize*sizeof(Ref)/sizeof(Ref) != pagesSize) {
+           error(-1, "Invalid 'pagesSize' parameter.");
+           goto err3;
+         }
 	pages = (Page **)greallocn(pages, pagesSize, sizeof(Page *));
 	pageRefs = (Ref *)greallocn(pageRefs, pagesSize, sizeof(Ref));
 	for (j = pagesSize - 32; j < pagesSize; ++j) {
