created according to: https://github.com/libgd/libgd/commit/aba3db8 https://github.com/libgd/libgd/commit/a6a0e7feabb2a9738086a5dc96348f233c87fa79 https://github.com/libgd/libgd/commit/48bbc25 diff -urN '--exclude=cscope.*' gd-2.0.35/gd_gd2.c fixed/gd_gd2.c --- gd-2.0.35/gd_gd2.c 2007-01-04 13:40:48.000000000 +0100 +++ fixed/gd_gd2.c 2020-11-04 08:46:03.800937688 +0100 @@ -169,11 +169,17 @@ { nc = (*ncx) * (*ncy); GD2_DBG (printf ("Reading %d chunk index entries\n", nc)); + if (overflow2(sizeof(t_chunk_info), nc)) { + goto fail1; + } sidx = sizeof (t_chunk_info) * nc; + if (sidx <=0) { + goto fail1; + } cidx = gdCalloc (sidx, 1); - if (!cidx) { - goto fail1; - } + if (cidx == NULL) { + goto fail1; + } for (i = 0; i < nc; i++) { if (gdGetInt (&cidx[i].offset, in) != 1)