Index: scan.c =================================================================== RCS file: /cvs/OpenBSD/XF4/xc/extras/Xpm/lib/scan.c,v retrieving revision 1.4 diff -u -r1.4 scan.c --- scan.c 17 Nov 2004 20:22:05 -0000 1.4 +++ scan.c 15 Feb 2005 21:34:05 -0000 @@ -621,8 +621,8 @@ char *dst; unsigned int *iptr; char *data; - unsigned int x, y, i; - int bits, depth, ibu, ibpp, offset; + unsigned int x, y; + int bits, depth, ibu, ibpp, offset, i; unsigned long lbt; Pixel pixel, px; @@ -632,6 +632,9 @@ lbt = low_bits_table[depth]; ibpp = image->bits_per_pixel; offset = image->xoffset; + + if (image->bitmap_unit < 0) + return (XpmNoMemory); if ((image->bits_per_pixel | image->depth) == 1) { ibu = image->bitmap_unit; Index: create.c =================================================================== RCS file: /cvs/OpenBSD/XF4/xc/extras/Xpm/lib/create.c,v retrieving revision 1.7 diff -u -r1.7 create.c --- create.c 19 Dec 2004 17:45:01 -0000 1.7 +++ create.c 15 Feb 2005 21:31:52 -0000 @@ -821,6 +821,9 @@ ErrorStatus = XpmSuccess; + if (image->bitmap_units < 0) + return (XpmNoMemory); + if (image->ncolors >= UINT_MAX / sizeof(Pixel)) return (XpmNoMemory); @@ -1215,10 +1218,10 @@ register char *src; register char *dst; register unsigned int *iptr; - register unsigned int x, y, i; + register unsigned int x, y; register char *data; Pixel pixel, px; - int nbytes, depth, ibu, ibpp; + int nbytes, depth, ibu, ibpp, i; data = image->data; iptr = pixelindex;