diff -ruNp a/analyzer/pgmtexture.c b/analyzer/pgmtexture.c

--- a/analyzer/pgmtexture.c	2021-06-02 15:53:59.866205957 +0200

+++ b/analyzer/pgmtexture.c	2021-06-02 16:13:04.906252648 +0200

@@ -54,6 +54,7 @@ vector(unsigned int const nl,

     assert(nh >= nl);

+    overflow_add(nh - nl, 1);

     MALLOCARRAY(v, (unsigned) (nh - nl + 1));

     if (v == NULL)

@@ -85,6 +86,7 @@ matrix (unsigned int const nrl,

     assert(nrh >= nrl);

     /* allocate pointers to rows */

+    overflow_add(nrh - nrl, 1);

     MALLOCARRAY(m, (unsigned) (nrh - nrl + 1));

     if (m == NULL)

         pm_error("Unable to allocate memory for a matrix.");

@@ -93,6 +95,7 @@ matrix (unsigned int const nrl,

     assert (nch >= ncl);

+    overflow_add(nch - ncl, 1);

     /* allocate rows and set pointers to them */

     for (i = nrl; i <= nrh; ++i) {

         MALLOCARRAY(m[i], (unsigned) (nch - ncl + 1));

diff -ruNp a/converter/other/gemtopnm.c b/converter/other/gemtopnm.c

--- a/converter/other/gemtopnm.c	2021-06-02 15:53:59.835205659 +0200

+++ b/converter/other/gemtopnm.c	2021-06-02 16:15:29.598641385 +0200

@@ -106,6 +106,7 @@ main(argc, argv)

     pnm_writepnminit( stdout, cols, rows, MAXVAL, type, 0 );

+    overflow_add(cols, padright);

     {

         /* allocate input row data structure */

         int plane;

diff -ruNp a/converter/other/jpegtopnm.c b/converter/other/jpegtopnm.c

--- a/converter/other/jpegtopnm.c	2021-06-02 15:53:59.833205640 +0200

+++ b/converter/other/jpegtopnm.c	2021-06-02 16:16:28.520206914 +0200

@@ -862,6 +862,8 @@ convertImage(FILE *

     /* Calculate output image dimensions so we can allocate space */

     jpeg_calc_output_dimensions(cinfoP);

+    overflow2(cinfoP->output_width, cinfoP->output_components);

+

     /* Start decompressor */

     jpeg_start_decompress(cinfoP);

diff -ruNp a/converter/other/pbmtopgm.c b/converter/other/pbmtopgm.c

--- a/converter/other/pbmtopgm.c	2021-06-02 15:53:59.831205621 +0200

+++ b/converter/other/pbmtopgm.c	2021-06-02 16:17:14.248645808 +0200

@@ -60,6 +60,7 @@ main(int argc, char *argv[]) {

     outrow = pgm_allocrow(cols) ;

+    overflow2(width, height);

     maxval = MIN(PGM_OVERALLMAXVAL, width*height);

     pgm_writepgminit(stdout, cols, rows, maxval, 0) ;

diff -ruNp a/converter/other/pnmtoddif.c b/converter/other/pnmtoddif.c

--- a/converter/other/pnmtoddif.c	2021-06-02 15:53:59.832205630 +0200

+++ b/converter/other/pnmtoddif.c	2021-06-02 16:18:17.064248709 +0200

@@ -629,6 +629,7 @@ main(int argc, char *argv[]) {

     switch (PNM_FORMAT_TYPE(format)) {

     case PBM_TYPE:

         ip.bits_per_pixel = 1;

+        overflow_add(cols, 7);

         ip.bytes_per_line = (cols + 7) / 8;

         ip.spectral = 2;

         ip.components = 1;

@@ -644,6 +645,7 @@ main(int argc, char *argv[]) {

         ip.polarity = 2;

         break;

     case PPM_TYPE:

+        overflow2(cols, 3);

         ip.bytes_per_line = 3 * cols;

         ip.bits_per_pixel = 24;

         ip.spectral = 5;

diff -ruNp a/converter/other/pnmtojpeg.c b/converter/other/pnmtojpeg.c

--- a/converter/other/pnmtojpeg.c	2021-06-02 15:53:59.835205659 +0200

+++ b/converter/other/pnmtojpeg.c	2021-06-02 19:57:44.413225834 +0200

@@ -606,7 +606,11 @@ read_scan_script(j_compress_ptr const ci

            want JPOOL_PERMANENT.

         */

         const unsigned int scan_info_size = nscans * sizeof(jpeg_scan_info);

-        jpeg_scan_info * const scan_info =

+        const jpeg_scan_info * scan_info;

+

+        overflow2(nscans, sizeof(jpeg_scan_info));

+

+        scan_info =

             (jpeg_scan_info *)

             (*cinfo->mem->alloc_small) ((j_common_ptr) cinfo, JPOOL_IMAGE,

                                         scan_info_size);

@@ -938,6 +942,9 @@ compute_rescaling_array(JSAMPLE ** const

   const long half_maxval = maxval / 2;

   long val;

+  overflow_add(maxval, 1);

+  overflow2(maxval+1, sizeof(JSAMPLE));

+

   *rescale_p = (JSAMPLE *)

     (cinfo.mem->alloc_small) ((j_common_ptr) &cinfo, JPOOL_IMAGE,

                               (size_t) (((long) maxval + 1L) *

@@ -1016,6 +1023,7 @@ convert_scanlines(struct jpeg_compress_s

     */

   /* Allocate the libpnm output and compressor input buffers */

+  overflow2(cinfo_p->image_width, cinfo_p->input_components);

   buffer = (*cinfo_p->mem->alloc_sarray)

     ((j_common_ptr) cinfo_p, JPOOL_IMAGE,

      (unsigned int) cinfo_p->image_width * cinfo_p->input_components,

diff -ruNp a/converter/other/pnmtops.c b/converter/other/pnmtops.c

--- a/converter/other/pnmtops.c	2021-06-02 15:53:59.835205659 +0200

+++ b/converter/other/pnmtops.c	2021-06-02 20:02:06.055502227 +0200

@@ -294,17 +294,21 @@ parseCommandLine(int argc, const char **

     validateCompDimension(width, 72, "-width value");

     validateCompDimension(height, 72, "-height value");

+    overflow2(width, 72);

     cmdlineP->width  = width * 72;

+    overflow2(height, 72);

     cmdlineP->height = height * 72;

     if (imagewidthSpec) {

         validateCompDimension(imagewidth, 72, "-imagewidth value");

+        overflow2(imagewidth, 72);

         cmdlineP->imagewidth = imagewidth * 72;

     }

     else

         cmdlineP->imagewidth = 0;

     if (imageheightSpec) {

-        validateCompDimension(imagewidth, 72, "-imageheight value");

+        validateCompDimension(imageheight, 72, "-imageheight value");

+        overflow2(imageheight, 72);

         cmdlineP->imageheight = imageheight * 72;

     }

     else

diff -ruNp a/converter/other/rletopnm.c b/converter/other/rletopnm.c

--- a/converter/other/rletopnm.c	2021-06-02 15:53:59.834205650 +0200

+++ b/converter/other/rletopnm.c	2021-06-02 20:03:24.864187893 +0200

@@ -19,6 +19,8 @@

  * If you modify this software, you should include a notice giving the

  * name of the person performing the modification, the date of modification,

  * and the reason for such modification.

+ *

+ * 2002-12-19: Fix maths wrapping bugs. Alan Cox <alan@redhat.com>

  */

 /*

  * rletopnm - A conversion program to convert from Utah's "rle" image format

diff -ruNp a/converter/other/sirtopnm.c b/converter/other/sirtopnm.c

--- a/converter/other/sirtopnm.c	2021-06-02 15:53:59.833205640 +0200

+++ b/converter/other/sirtopnm.c	2021-06-02 20:03:50.280409024 +0200

@@ -69,6 +69,7 @@ char* argv[];

 	    }

 	    break;

 	case PPM_TYPE:

+        overflow3(cols, rows, 3);

 	    picsize = cols * rows * 3;

 	    planesize = cols * rows;

             if ( !( sirarray = (unsigned char*) malloc( picsize ) ) ) 

diff -ruNp a/converter/other/tifftopnm.c b/converter/other/tifftopnm.c

--- a/converter/other/tifftopnm.c	2021-06-02 15:53:59.834205650 +0200

+++ b/converter/other/tifftopnm.c	2021-06-02 20:04:47.721908789 +0200

@@ -1372,7 +1372,9 @@ convertRasterByRows(pnmOut *       const

     if (scanbuf == NULL)

         pm_error("can't allocate memory for scanline buffer");

-    MALLOCARRAY(samplebuf, cols * spp);

+    /* samplebuf is unsigned int * !!! */

+    samplebuf = (unsigned int *) malloc3(cols , sizeof(unsigned int) , spp);

+

     if (samplebuf == NULL)

         pm_error("can't allocate memory for row buffer");

diff -ruNp a/converter/other/xwdtopnm.c b/converter/other/xwdtopnm.c

--- a/converter/other/xwdtopnm.c	2021-06-02 15:53:59.833205640 +0200

+++ b/converter/other/xwdtopnm.c	2021-06-02 20:23:21.807634239 +0200

@@ -210,6 +210,10 @@ processX10Header(X10WDFileHeader *  cons

         *colorsP = pnm_allocrow(2);

         PNM_ASSIGN1((*colorsP)[0], 0);

         PNM_ASSIGN1((*colorsP)[1], *maxvalP);

+        overflow_add(h10P->pixmap_width, 15);

+        if(h10P->pixmap_width < 0)

+            pm_error("assert: negative width");

+        overflow2((((h10P->pixmap_width + 15) / 16) * 16 - h10P->pixmap_width), 8);

         *padrightP =

             (((h10P->pixmap_width + 15) / 16) * 16 - h10P->pixmap_width) * 8;

         *bits_per_itemP = 16;

@@ -635,6 +639,7 @@ processX11Header(X11WDFileHeader *  cons

     *colsP = h11FixedP->pixmap_width;

     *rowsP = h11FixedP->pixmap_height;

+    overflow2(h11FixedP->bytes_per_line, 8);

     *padrightP =

         h11FixedP->bytes_per_line * 8 -

         h11FixedP->pixmap_width * h11FixedP->bits_per_pixel;

diff -ruNp a/converter/pbm/mdatopbm.c b/converter/pbm/mdatopbm.c

--- a/converter/pbm/mdatopbm.c	2021-06-02 15:53:59.826205573 +0200

+++ b/converter/pbm/mdatopbm.c	2021-06-02 20:23:21.807634239 +0200

@@ -245,10 +245,13 @@ main(int argc, char **argv) {

         pm_readlittleshort(infile, &yy;; nInCols = yy;

     }

+    overflow2(nOutCols, 8);

     nOutCols = 8 * nInCols;

     nOutRows = nInRows;

-    if (bScale) 

+    if (bScale) {

+        overflow2(nOutRows, 2);

         nOutRows *= 2;

+    }

     data = pbm_allocarray(nOutCols, nOutRows);

diff -ruNp a/converter/pbm/mgrtopbm.c b/converter/pbm/mgrtopbm.c

--- a/converter/pbm/mgrtopbm.c	2021-06-02 15:53:59.828205592 +0200

+++ b/converter/pbm/mgrtopbm.c	2021-06-02 20:23:21.808634248 +0200

@@ -65,6 +65,8 @@ readMgrHeader(FILE *          const ifP,

     if (head.h_high < ' ' || head.l_high < ' ')

         pm_error("Invalid width field in MGR header");

+    overflow_add(*colsP, pad);

+

     *colsP = (((int)head.h_wide - ' ') << 6) + ((int)head.l_wide - ' ');

     *rowsP = (((int)head.h_high - ' ') << 6) + ((int) head.l_high - ' ');

     *padrightP = ( ( *colsP + pad - 1 ) / pad ) * pad - *colsP;

diff -ruNp a/converter/pbm/pbmtogem.c b/converter/pbm/pbmtogem.c

--- a/converter/pbm/pbmtogem.c	2021-06-02 15:53:59.828205592 +0200

+++ b/converter/pbm/pbmtogem.c	2021-06-02 20:23:21.809634256 +0200

@@ -79,6 +79,7 @@ putinit (int const rows, int const cols)

   bitsperitem = 0;

   bitshift = 7;

   outcol = 0;

+  overflow_add(cols, 7);

   outmax = (cols + 7) / 8;

   outrow = (unsigned char *) pm_allocrow (outmax, sizeof (unsigned char));

   lastrow = (unsigned char *) pm_allocrow (outmax, sizeof (unsigned char));

diff -ruNp a/converter/pbm/pbmtogo.c b/converter/pbm/pbmtogo.c

--- a/converter/pbm/pbmtogo.c	2021-06-02 15:53:59.826205573 +0200

+++ b/converter/pbm/pbmtogo.c	2021-06-02 20:23:21.809634256 +0200

@@ -158,6 +158,7 @@ main(int           argc,

     bitrow = pbm_allocrow(cols);

     /* Round cols up to the nearest multiple of 8. */

+    overflow_add(cols, 7);

     rucols = ( cols + 7 ) / 8;

     bytesperrow = rucols;       /* GraphOn uses bytes */

     rucols = rucols * 8;

diff -ruNp a/converter/pbm/pbmtolj.c b/converter/pbm/pbmtolj.c

--- a/converter/pbm/pbmtolj.c	2021-06-02 15:53:59.828205592 +0200

+++ b/converter/pbm/pbmtolj.c	2021-06-02 20:23:21.810634265 +0200

@@ -120,7 +120,11 @@ parseCommandLine(int argc, char ** argv,

 static void

 allocateBuffers(unsigned int const cols) {

+    overflow_add(cols, 8);

     rowBufferSize = (cols + 7) / 8;

+    overflow_add(rowBufferSize, 128);

+    overflow_add(rowBufferSize, rowBufferSize+128);

+    overflow_add(rowBufferSize+10, rowBufferSize/8);

     packBufferSize = rowBufferSize + (rowBufferSize + 127) / 128 + 1;

     deltaBufferSize = rowBufferSize + rowBufferSize / 8 + 10;

diff -ruNp a/converter/pbm/pbmtomda.c b/converter/pbm/pbmtomda.c

--- a/converter/pbm/pbmtomda.c	2021-06-02 15:53:59.827205582 +0200

+++ b/converter/pbm/pbmtomda.c	2021-06-02 20:23:21.810634265 +0200

@@ -179,6 +179,7 @@ int main(int argc, char **argv)

     nOutRowsUnrounded = bScale ? nInRows/2 : nInRows;

+    overflow_add(nOutRowsUnrounded, 3);

     nOutRows = ((nOutRowsUnrounded + 3) / 4) * 4;

         /* MDA wants rows a multiple of 4 */   

     nOutCols = nInCols / 8;

diff -ruNp a/converter/pbm/pbmtoppa/pbm.c b/converter/pbm/pbmtoppa/pbm.c

--- a/converter/pbm/pbmtoppa/pbm.c	2021-06-02 15:53:59.830205611 +0200

+++ b/converter/pbm/pbmtoppa/pbm.c	2021-06-02 20:23:21.811634274 +0200

@@ -11,185 +11,128 @@

 #include <stdio.h>

 #include <stdlib.h>

 #include <string.h>

-#include <limits.h>

-#include "pm.h"

-#include "nstring.h"

 #include "ppapbm.h"

-int

-make_pbm_stat(pbm_stat * const pbmStatP,

-              FILE *     const ifP) {

-

-    char line[1024];

-    char * rc;

-    int retval;

-

-    pbmStatP->fptr         = ifP;

-    pbmStatP->version      = none;

-    pbmStatP->current_line = 0;

-    pbmStatP->unread       = 0;

-

-    rc = fgets(line, 1024, ifP);

-    if (rc == NULL)

-        retval = 0;

-    else {

-        line[strlen(line)-1] = 0;

-

-        if (streq(line,"P1"))

-            pbmStatP->version=P1;

-        if (streq(line,"P4"))

-            pbmStatP->version=P4;

-

-        if (pbmStatP->version == none) {

-            pm_message("unknown PBM magic '%s'", line);

-            retval = 0;

-        } else {

-            do {

-                char * rc;

-                rc = fgets(line, 1024, ifP);

-                if (rc == NULL)

-                    return 0;

-            } while (line[0] == '#');

-            {

-                int rc;

-                rc = sscanf(line, "%d %d",

-                            &pbmStatP->width, &pbmStatP->height);

-                if (rc != 2)

-                    retval = 0;

-                else {

-                    if (pbmStatP->width < 0) {

-                        pm_message("Image has negative width");

-                        retval = 0;

-                    } else if (pbmStatP->width > INT_MAX/2) {

-                        pm_message("Uncomputeably large width: %d",

-                                   pbmStatP->width);

-                        retval = 0;

-                    } else if (pbmStatP->height < 0) {

-                        pm_message("Image has negative height");

-                        retval = 0;

-                    } else if (pbmStatP->height > INT_MAX/2) {

-                        pm_message("Uncomputeably large height: %d",

-                                   pbmStatP->height);

-                        retval = 0;

-                    } else

-                        retval = 1;

-                }

-            }

-        }

-    }

-    return retval;

-}

-

+int make_pbm_stat(pbm_stat* pbm,FILE* fptr)

+{

+  char line[1024];

+

+  pbm->fptr=fptr;

+  pbm->version=none;

+  pbm->current_line=0;

+  pbm->unread = 0;

+

+  if (fgets (line, 1024, fptr) == NULL)

+    return 0;

+  line[strlen(line)-1] = 0;

+

+  if(!strcmp(line,"P1")) pbm->version=P1;

+  if(!strcmp(line,"P4")) pbm->version=P4;

+  if(pbm->version == none)

+  {

+    fprintf(stderr,"pbm_readheader(): unknown PBM magic '%s'\n",line);

+    return 0;

+  }

+

+  do

+    if (fgets (line, 1024, fptr) == NULL)

+      return 0;

+  while (line[0] == '#');

+  if (2 != sscanf (line, "%d %d", &pbm->width, &pbm->height))

+    return 0;

-static int

-getbytes(FILE *          const ifP,

-         unsigned int    const width,

-         unsigned char * const data) {

-

-    unsigned char mask;

-    unsigned char acc;

-    unsigned char * place;

-    unsigned int num;

-    int retval;

-

-    if (width == 0)

-        retval = 0;

-    else {

-        for (mask = 0x80, acc = 0, num = 0, place = data; num < width; ) {

-            switch (getc(ifP)) {

-            case EOF:

-                return 0;

-            case '1':

-                acc |= mask;

-                /* fall through */

-            case '0':

-                mask >>= 1;

-                ++num;

-                if (mask == 0x00) { /* if (num % 8 == 0) */

-                    *place++ = acc;

-                    acc = 0;

-                    mask = 0x80;

-                }

-            }

-        }

-        if (width % 8 != 0)

-            *place = acc;

-

-        retval = 1;

-    }

-    return retval;

+  return 1;

 }

-

-

-int

-pbm_readline(pbm_stat *      const pbmStatP,

-             unsigned char * const data) {

-/*----------------------------------------------------------------------------

-  Read a single line into data which must be at least (pbmStatP->width+7)/8

-  bytes of storage.

------------------------------------------------------------------------------*/

-    int retval;

-

-    if (pbmStatP->current_line >= pbmStatP->height)

-        retval = 0;

-    else {

-        if (pbmStatP->unread) {

-            memcpy(data, pbmStatP->revdata, (pbmStatP->width+7)/8);

-            ++pbmStatP->current_line;

-            pbmStatP->unread = 0;

-            free(pbmStatP->revdata);

-            pbmStatP->revdata = NULL;

-            retval = 1;

-        } else {

-            switch (pbmStatP->version) {

-            case P1:

-                if (getbytes(pbmStatP->fptr, pbmStatP->width, data)) {

-                    pbmStatP->current_line++;

-                    retval = 1;

-                } else

-                    retval = 0;

-                break;

-            case P4: {

-                int tmp, tmp2;

-                tmp = (pbmStatP->width+7)/8;

-                tmp2 = fread(data,1,tmp,pbmStatP->fptr);

-                if (tmp2 == tmp) {

-                    ++pbmStatP->current_line;

-                    retval = 1;

-                } else {

-                    pm_message("error reading line data (%d)", tmp2);

-                    retval = 0;

-                }

-            } break;

-

-            default:

-                pm_message("unknown PBM version");

-                retval = 0;

-            }

-        }

+static int getbytes(FILE *fptr,int width,unsigned char* data)

+{

+  unsigned char mask,acc,*place;

+  int num;

+

+  if(!width) return 0;

+  for(mask=0x80, acc=0, num=0, place=data; num

+  {

+    switch(getc(fptr))

+    {

+    case EOF:      

+      return 0;

+    case '1':

+      acc|=mask;

+      /* fall through */

+    case '0':

+      mask>>=1;

+      num++;

+      if(!mask) /* if(num%8 == 0) */

+      {

+	*place++ = acc;

+	acc=0;

+	mask=0x80;

+      }

     }

-    return retval;

+  }

+  if(width%8)

+    *place=acc;

+  return 1;

 }

+/* Reads a single line into data which must be at least (pbm->width+7)/8

+   bytes of storage */

+int pbm_readline(pbm_stat* pbm,unsigned char* data)

+{

+  int tmp,tmp2;

+

+  if(pbm->current_line >= pbm->height) return 0;

+

+  if (pbm->unread)

+    {

+      memcpy (data, pbm->revdata, (pbm->width+7)/8);

+      pbm->current_line++;

+      pbm->unread = 0;

+      free (pbm->revdata);

+      pbm->revdata = NULL;

+      return 1;

+    }

+  switch(pbm->version)

+  {

+  case P1:

+    if(getbytes(pbm->fptr,pbm->width,data))

+    {

+      pbm->current_line++;

+      return 1;

+    }

+    return 0;

-void

-pbm_unreadline(pbm_stat * const pbmStatP,

-               void *     const data) {

-/*----------------------------------------------------------------------------

-  Push a line back into the buffer; we read too much!

------------------------------------------------------------------------------*/

-    /* can store only one line in the unread buffer */

-

-    if (!pbmStatP->unread) {

-        pbmStatP->unread = 1;

-        pbmStatP->revdata = malloc ((pbmStatP->width+7)/8);

-        memcpy(pbmStatP->revdata, data, (pbmStatP->width+7)/8);

-        --pbmStatP->current_line;

+  case P4:

+    overflow_add(pbm->width, 7);

+    tmp=(pbm->width+7)/8;

+    tmp2=fread(data,1,tmp,pbm->fptr);

+    if(tmp2 == tmp)

+    {

+      pbm->current_line++;

+      return 1;

     }

-}

+    fprintf(stderr,"pbm_readline(): error reading line data (%d)\n",tmp2);

+    return 0;

+  default:

+    fprintf(stderr,"pbm_readline(): unknown PBM version\n");

+    return 0;

+  }

+}

+/* push a line back into the buffer; we read too much! */

+void pbm_unreadline (pbm_stat *pbm, void *data)

+{

+  /* can only store one line in the unread buffer */

+  if (pbm->unread)

+    return;

+

+  pbm->unread = 1;

+  overflow_add(pbm->width, 7);

+  pbm->revdata = malloc ((pbm->width+7)/8);

+  memcpy (pbm->revdata, data, (pbm->width+7)/8);

+  pbm->current_line--;

+}

diff -ruNp a/converter/pbm/pbmtoppa/pbmtoppa.c b/converter/pbm/pbmtoppa/pbmtoppa.c

--- a/converter/pbm/pbmtoppa/pbmtoppa.c	2021-06-02 15:53:59.829205601 +0200

+++ b/converter/pbm/pbmtoppa/pbmtoppa.c	2021-06-02 20:23:21.811634274 +0200

@@ -453,6 +453,7 @@ main(int argc, char *argv[]) {

             pm_error("main(): unrecognized parameter '%s'", argv[argn]);

     }

+    overflow_add(Width, 7);

     Pwidth=(Width+7)/8;

     printer.fptr=out;

diff -ruNp a/converter/pbm/pbmtoxbm.c b/converter/pbm/pbmtoxbm.c

--- a/converter/pbm/pbmtoxbm.c	2021-06-02 15:53:59.829205601 +0200

+++ b/converter/pbm/pbmtoxbm.c	2021-06-02 20:23:21.812634282 +0200

@@ -352,6 +352,8 @@ convertRaster(FILE *          const ifP,

     unsigned char * bitrow;

     unsigned int row;

+    

+    overflow_add(cols, padright);

     putinit(xbmVersion);

diff -ruNp a/converter/pbm/pbmto4425.c b/converter/pbm/pbmto4425.c

--- a/converter/pbm/pbmto4425.c	2021-06-02 15:53:59.827205582 +0200

+++ b/converter/pbm/pbmto4425.c	2021-06-02 20:23:21.808634248 +0200

@@ -2,6 +2,7 @@

 #include "nstring.h"

 #include "pbm.h"

+#include <string.h>

 static char bit_table[2][3] = {

 {1, 4, 0x10},

@@ -160,7 +161,7 @@ main(int argc, char * argv[]) {

     xres = vmap_width * 2;

     yres = vmap_height * 3;

-    vmap = malloc(vmap_width * vmap_height * sizeof(char));

+    vmap = malloc3(vmap_width, vmap_height, sizeof(char));

     if(vmap == NULL)

 	{

         pm_error( "Cannot allocate memory" );

diff -ruNp a/converter/pbm/pktopbm.c b/converter/pbm/pktopbm.c

--- a/converter/pbm/pktopbm.c	2021-06-02 15:53:59.828205592 +0200

+++ b/converter/pbm/pktopbm.c	2021-06-02 20:23:21.813634291 +0200

@@ -280,6 +280,7 @@ main(int argc, char *argv[]) {

         if (flagbyte == 7) {            /* long form preamble */

             integer packetlength = get32() ;    /* character packet length */

             car = get32() ;         /* character number */

+            overflow_add(packetlength, pktopbm_pkloc);

             endofpacket = packetlength + pktopbm_pkloc;

                 /* calculate end of packet */

             if ((car >= MAXPKCHAR) || !filename[car]) {

diff -ruNp a/converter/pbm/thinkjettopbm.l b/converter/pbm/thinkjettopbm.l

--- a/converter/pbm/thinkjettopbm.l	2021-06-02 15:53:59.828205592 +0200

+++ b/converter/pbm/thinkjettopbm.l	2021-06-02 20:23:21.813634291 +0200

@@ -114,7 +114,9 @@ DIG             [0-9]

 <RASTERMODE>\033\*b{DIG}+W  {

                             int l;

                             if (rowCount >= rowCapacity) {

-                                rowCapacity += 100;

+				overflow_add(rowCapacity, 100);

+                                 rowCapacity += 100;

+				overflow2(rowCapacity, sizeof *rows);

                                 rows = realloc (rows, rowCapacity * sizeof *rows);

                                 if (rows == NULL)

                                     pm_error ("Out of memory.");

@@ -226,6 +228,8 @@ yywrap (void)

     /*

      * Quite simple since ThinkJet bit arrangement matches PBM

      */

+

+    overflow2(maxRowLength, 8);

     pbm_writepbminit(stdout, maxRowLength*8, rowCount, 0);

     packed_bitrow = malloc(maxRowLength);

diff -ruNp a/converter/pbm/ybmtopbm.c b/converter/pbm/ybmtopbm.c

--- a/converter/pbm/ybmtopbm.c	2021-06-02 15:53:59.827205582 +0200

+++ b/converter/pbm/ybmtopbm.c	2021-06-02 20:23:21.814634300 +0200

@@ -43,6 +43,7 @@ getinit(FILE *  const ifP,

         pm_error("EOF / read error");

     *depthP = 1;

+    overflow_add(*colsP, 15);

 }

diff -ruNp a/converter/pgm/lispmtopgm.c b/converter/pgm/lispmtopgm.c

--- a/converter/pgm/lispmtopgm.c	2021-06-02 15:53:59.831205621 +0200

+++ b/converter/pgm/lispmtopgm.c	2021-06-02 20:23:21.814634300 +0200

@@ -58,6 +58,7 @@ main( argc, argv )

         pm_error( "depth (%d bits) is too large", depth);

     pgm_writepgminit( stdout, cols, rows, (gray) maxval, 0 );

+    overflow_add(cols, 7);

     grayrow = pgm_allocrow( ( cols + 7 ) / 8 * 8 );

     for ( row = 0; row < rows; ++row )

@@ -102,6 +103,8 @@ getinit( file, colsP, rowsP, depthP, pad

     if ( *depthP == 0 )

 	*depthP = 1;	/* very old file */

+

+    overflow_add((int)colsP, 31);

     *padrightP = ( ( *colsP + 31 ) / 32 ) * 32 - *colsP;

diff -ruNp a/converter/pgm/psidtopgm.c b/converter/pgm/psidtopgm.c

--- a/converter/pgm/psidtopgm.c	2021-06-02 15:53:59.830205611 +0200

+++ b/converter/pgm/psidtopgm.c	2021-06-02 20:23:21.815634309 +0200

@@ -78,6 +78,7 @@ main(int     argc,

         pm_error("bits/sample (%d) is too large.", bitspersample);

     pgm_writepgminit(stdout, cols, rows, maxval, 0);

+    overflow_add(cols, 7);

     grayrow = pgm_allocrow((cols + 7) / 8 * 8);

     for (row = 0; row < rows; ++row) {

         unsigned int col;

diff -ruNp a/converter/ppm/ilbmtoppm.c b/converter/ppm/ilbmtoppm.c

--- a/converter/ppm/ilbmtoppm.c	2021-06-02 15:53:59.846205765 +0200

+++ b/converter/ppm/ilbmtoppm.c	2021-06-02 20:23:21.817634326 +0200

@@ -608,6 +608,7 @@ decode_row(FILE *          const ifP,

     rawtype *chp;

     cols = bmhdP->w;

+    overflow_add(cols, 15);

     bytes = RowBytes(cols);

     for( plane = 0; plane < nPlanes; plane++ ) {

         int mask;

@@ -695,6 +696,23 @@ decode_mask(FILE *          const ifP,

  Multipalette handling

  ****************************************************************************/

+static void *

+xmalloc2(x, y)

+    int x;

+    int y;

+{

+    void *mem;

+

+    overflow2(x,y);

+    if( x * y == 0 )