diff --git a/analyzer/pgmtexture.c b/analyzer/pgmtexture.c

index 84c6bf4..c9576f5 100644

--- a/analyzer/pgmtexture.c

+++ b/analyzer/pgmtexture.c

@@ -98,6 +98,8 @@ vector(unsigned int const nl,

     assert(nh >= nl);

+    overflow_add(nh - nl, 1);

+    

     MALLOCARRAY(v, (unsigned) (nh - nl + 1));

     if (v == NULL)

@@ -129,6 +131,7 @@ matrix (unsigned int const nrl,

     assert(nrh >= nrl);

     /* allocate pointers to rows */

+    overflow_add(nrh - nrl, 1);

     MALLOCARRAY(m, (unsigned) (nrh - nrl + 1));

     if (m == NULL)

         pm_error("Unable to allocate memory for a matrix.");

@@ -137,6 +140,7 @@ matrix (unsigned int const nrl,

     assert (nch >= ncl);

+    overflow_add(nch - ncl, 1);

     /* allocate rows and set pointers to them */

     for (i = nrl; i <= nrh; ++i) {

         MALLOCARRAY(m[i], (unsigned) (nch - ncl + 1));

diff --git a/converter/other/gemtopnm.c b/converter/other/gemtopnm.c

index aac7479..5f1a51a 100644

--- a/converter/other/gemtopnm.c

+++ b/converter/other/gemtopnm.c

@@ -106,6 +106,7 @@ main(argc, argv)

 	pnm_writepnminit( stdout, cols, rows, MAXVAL, type, 0 );

+    overflow_add(cols, padright);

     { 

         /* allocate input row data structure */

         int plane;

diff --git a/converter/other/jpegtopnm.c b/converter/other/jpegtopnm.c

index 98552c0..311298c 100644

--- a/converter/other/jpegtopnm.c

+++ b/converter/other/jpegtopnm.c

@@ -862,6 +862,8 @@ convertImage(FILE *                          const ofP,

     /* Calculate output image dimensions so we can allocate space */

     jpeg_calc_output_dimensions(cinfoP);

+    overflow2(cinfoP->output_width, cinfoP->output_components);

+

     /* Start decompressor */

     jpeg_start_decompress(cinfoP);

diff --git a/converter/other/pbmtopgm.c b/converter/other/pbmtopgm.c

index 69b20fb..382a487 100644

--- a/converter/other/pbmtopgm.c

+++ b/converter/other/pbmtopgm.c

@@ -47,6 +47,7 @@ main(int argc, char *argv[]) {

                  "than the image height (%u rows)", height, rows);

     outrow = pgm_allocrow(cols) ;

+    overflow2(width, height);

     maxval = MIN(PGM_OVERALLMAXVAL, width*height);

     pgm_writepgminit(stdout, cols, rows, maxval, 0) ;

diff --git a/converter/other/pnmtoddif.c b/converter/other/pnmtoddif.c

index ac02e42..a2f045b 100644

--- a/converter/other/pnmtoddif.c

+++ b/converter/other/pnmtoddif.c

@@ -629,6 +629,7 @@ main(int argc, char *argv[]) {

     switch (PNM_FORMAT_TYPE(format)) {

     case PBM_TYPE:

         ip.bits_per_pixel = 1;

+        overflow_add(cols, 7);

         ip.bytes_per_line = (cols + 7) / 8;

         ip.spectral = 2;

         ip.components = 1;

@@ -644,6 +645,7 @@ main(int argc, char *argv[]) {

         ip.polarity = 2;

         break;

     case PPM_TYPE:

+        overflow2(cols, 3);

         ip.bytes_per_line = 3 * cols;

         ip.bits_per_pixel = 24;

         ip.spectral = 5;

diff --git a/converter/other/pnmtojpeg.c b/converter/other/pnmtojpeg.c

index 4482624..757d08d 100644

--- a/converter/other/pnmtojpeg.c

+++ b/converter/other/pnmtojpeg.c

@@ -606,7 +606,11 @@ read_scan_script(j_compress_ptr const cinfo,

            want JPOOL_PERMANENT.  

         */

         const unsigned int scan_info_size = nscans * sizeof(jpeg_scan_info);

-        jpeg_scan_info * const scan_info = 

+        const jpeg_scan_info * scan_info;

+      

+        overflow2(nscans, sizeof(jpeg_scan_info));

+      

+        scan_info =

             (jpeg_scan_info *)

             (*cinfo->mem->alloc_small) ((j_common_ptr) cinfo, JPOOL_IMAGE,

                                         scan_info_size);

@@ -938,6 +942,8 @@ compute_rescaling_array(JSAMPLE ** const rescale_p, const pixval maxval,

   const long half_maxval = maxval / 2;

   long val;

+  overflow_add(maxval, 1);

+  overflow2(maxval+1, sizeof(JSAMPLE));

   *rescale_p = (JSAMPLE *)

     (cinfo.mem->alloc_small) ((j_common_ptr) &cinfo, JPOOL_IMAGE,

                               (size_t) (((long) maxval + 1L) * 

@@ -1016,6 +1022,7 @@ convert_scanlines(struct jpeg_compress_struct * const cinfo_p,

     */

   /* Allocate the libpnm output and compressor input buffers */

+  overflow2(cinfo_p->image_width, cinfo_p->input_components);

   buffer = (*cinfo_p->mem->alloc_sarray)

     ((j_common_ptr) cinfo_p, JPOOL_IMAGE,

      (unsigned int) cinfo_p->image_width * cinfo_p->input_components, 

diff --git a/converter/other/pnmtops.c b/converter/other/pnmtops.c

index de0dfd8..09c28d5 100644

--- a/converter/other/pnmtops.c

+++ b/converter/other/pnmtops.c

@@ -294,17 +294,21 @@ parseCommandLine(int argc, const char ** argv,

     validateCompDimension(width, 72, "-width value");

     validateCompDimension(height, 72, "-height value");

+    overflow2(width, 72);

     cmdlineP->width  = width * 72;

+    overflow2(height, 72);

     cmdlineP->height = height * 72;

     if (imagewidthSpec) {

         validateCompDimension(imagewidth, 72, "-imagewidth value");

+        overflow2(imagewidth, 72);

         cmdlineP->imagewidth = imagewidth * 72;

     }

     else

         cmdlineP->imagewidth = 0;

     if (imageheightSpec) {

-        validateCompDimension(imagewidth, 72, "-imageheight value");

+        validateCompDimension(imageheight, 72, "-imageheight value");

+        overflow2(imageheight, 72);

         cmdlineP->imageheight = imageheight * 72;

     }

     else

diff --git a/converter/other/rletopnm.c b/converter/other/rletopnm.c

index 018456c..35ea7f7 100644

--- a/converter/other/rletopnm.c

+++ b/converter/other/rletopnm.c

@@ -19,6 +19,8 @@

  * If you modify this software, you should include a notice giving the

  * name of the person performing the modification, the date of modification,

  * and the reason for such modification.

+ *

+ *  2002-12-19: Fix maths wrapping bugs. Alan Cox <alan@redhat.com>

  */

 /*

  * rletopnm - A conversion program to convert from Utah's "rle" image format

diff --git a/converter/other/sirtopnm.c b/converter/other/sirtopnm.c

index fafcc91..9fe49d0 100644

--- a/converter/other/sirtopnm.c

+++ b/converter/other/sirtopnm.c

@@ -69,6 +69,7 @@ char* argv[];

 	    }

 	    break;

 	case PPM_TYPE:

+	    overflow3(cols, rows, 3);

 	    picsize = cols * rows * 3;

 	    planesize = cols * rows;

             if ( !( sirarray = (unsigned char*) malloc( picsize ) ) ) 

diff --git a/converter/other/tifftopnm.c b/converter/other/tifftopnm.c

index c1e7af8..ef9253b 100644

--- a/converter/other/tifftopnm.c

+++ b/converter/other/tifftopnm.c

@@ -1372,7 +1372,9 @@ convertRasterByRows(pnmOut *       const pnmOutP,

     if (scanbuf == NULL)

         pm_error("can't allocate memory for scanline buffer");

-    MALLOCARRAY(samplebuf, cols * spp);

+    /* samplebuf is unsigned int * !!! */

+    samplebuf = (unsigned int *) malloc3(cols , sizeof(unsigned int) , spp);

+

     if (samplebuf == NULL)

         pm_error("can't allocate memory for row buffer");

diff --git a/converter/other/xwdtopnm.c b/converter/other/xwdtopnm.c

index df3c737..6c19ade 100644

--- a/converter/other/xwdtopnm.c

+++ b/converter/other/xwdtopnm.c

@@ -210,6 +210,10 @@ processX10Header(X10WDFileHeader *  const h10P,

         *colorsP = pnm_allocrow(2);

         PNM_ASSIGN1((*colorsP)[0], 0);

         PNM_ASSIGN1((*colorsP)[1], *maxvalP);

+        overflow_add(h10P->pixmap_width, 15);

+        if(h10P->pixmap_width < 0)

+            pm_error("assert: negative width");

+        overflow2((((h10P->pixmap_width + 15) / 16) * 16 - h10P->pixmap_width), 8);

         *padrightP =

             (((h10P->pixmap_width + 15) / 16) * 16 - h10P->pixmap_width) * 8;

         *bits_per_itemP = 16;

@@ -635,6 +639,7 @@ processX11Header(X11WDFileHeader *  const h11P,

     *colsP = h11FixedP->pixmap_width;

     *rowsP = h11FixedP->pixmap_height;

+    overflow2(h11FixedP->bytes_per_line, 8);

     *padrightP =

         h11FixedP->bytes_per_line * 8 -

         h11FixedP->pixmap_width * h11FixedP->bits_per_pixel;

diff --git a/converter/pbm/mdatopbm.c b/converter/pbm/mdatopbm.c

index d8e0657..12c7468 100644

--- a/converter/pbm/mdatopbm.c

+++ b/converter/pbm/mdatopbm.c

@@ -245,10 +245,13 @@ main(int argc, char **argv) {

         pm_readlittleshort(infile, &yy;; nInCols = yy;

     }

+    overflow2(nOutCols, 8);

     nOutCols = 8 * nInCols;

     nOutRows = nInRows;

-    if (bScale) 

+    if (bScale) {

+        overflow2(nOutRows, 2);

         nOutRows *= 2;

+    }

     data = pbm_allocarray(nOutCols, nOutRows);

diff --git a/converter/pbm/mgrtopbm.c b/converter/pbm/mgrtopbm.c

index 9f7004a..60e8477 100644

--- a/converter/pbm/mgrtopbm.c

+++ b/converter/pbm/mgrtopbm.c

@@ -65,6 +65,8 @@ readMgrHeader(FILE *          const ifP,

     if (head.h_high < ' ' || head.l_high < ' ')

         pm_error("Invalid width field in MGR header");

+    overflow_add(*colsP, pad);

+

     *colsP = (((int)head.h_wide - ' ') << 6) + ((int)head.l_wide - ' ');

     *rowsP = (((int)head.h_high - ' ') << 6) + ((int) head.l_high - ' ');

     *padrightP = ( ( *colsP + pad - 1 ) / pad ) * pad - *colsP;

diff --git a/converter/pbm/pbmto4425.c b/converter/pbm/pbmto4425.c

index 1d97ac6..c4c8cbb 100644

--- a/converter/pbm/pbmto4425.c

+++ b/converter/pbm/pbmto4425.c

@@ -2,6 +2,7 @@

 #include "nstring.h"

 #include "pbm.h"

+#include <string.h>

 static char bit_table[2][3] = {

 {1, 4, 0x10},

@@ -160,7 +161,7 @@ main(int argc, char * argv[]) {

     xres = vmap_width * 2;

     yres = vmap_height * 3;

-    vmap = malloc(vmap_width * vmap_height * sizeof(char));

+    vmap = malloc3(vmap_width, vmap_height, sizeof(char));

     if(vmap == NULL)

 	{

         pm_error( "Cannot allocate memory" );

diff --git a/converter/pbm/pbmtogem.c b/converter/pbm/pbmtogem.c

index 9eab041..13b0257 100644

--- a/converter/pbm/pbmtogem.c

+++ b/converter/pbm/pbmtogem.c

@@ -79,6 +79,7 @@ putinit (int const rows, int const cols)

   bitsperitem = 0;

   bitshift = 7;

   outcol = 0;

+  overflow_add(cols, 7);

   outmax = (cols + 7) / 8;

   outrow = (unsigned char *) pm_allocrow (outmax, sizeof (unsigned char));

   lastrow = (unsigned char *) pm_allocrow (outmax, sizeof (unsigned char));

diff --git a/converter/pbm/pbmtogo.c b/converter/pbm/pbmtogo.c

index 23b2ee9..d2ee91f 100644

--- a/converter/pbm/pbmtogo.c

+++ b/converter/pbm/pbmtogo.c

@@ -158,6 +158,7 @@ main(int           argc,

     bitrow = pbm_allocrow(cols);

     /* Round cols up to the nearest multiple of 8. */

+    overflow_add(cols, 7);

     rucols = ( cols + 7 ) / 8;

     bytesperrow = rucols;       /* GraphOn uses bytes */

     rucols = rucols * 8;

diff --git a/converter/pbm/pbmtolj.c b/converter/pbm/pbmtolj.c

index 0cceb4f..fdab6df 100644

--- a/converter/pbm/pbmtolj.c

+++ b/converter/pbm/pbmtolj.c

@@ -120,7 +120,11 @@ parseCommandLine(int argc, char ** argv,

 static void

 allocateBuffers(unsigned int const cols) {

+    overflow_add(cols, 8);

     rowBufferSize = (cols + 7) / 8;

+    overflow_add(rowBufferSize, 128);

+    overflow_add(rowBufferSize, rowBufferSize+128);

+    overflow_add(rowBufferSize+10, rowBufferSize/8);

     packBufferSize = rowBufferSize + (rowBufferSize + 127) / 128 + 1;

     deltaBufferSize = rowBufferSize + rowBufferSize / 8 + 10;

diff --git a/converter/pbm/pbmtomda.c b/converter/pbm/pbmtomda.c

index 3ad5149..9efe5cf 100644

--- a/converter/pbm/pbmtomda.c

+++ b/converter/pbm/pbmtomda.c

@@ -179,6 +179,7 @@ int main(int argc, char **argv)

     nOutRowsUnrounded = bScale ? nInRows/2 : nInRows;

+    overflow_add(nOutRowsUnrounded, 3);

     nOutRows = ((nOutRowsUnrounded + 3) / 4) * 4;

         /* MDA wants rows a multiple of 4 */   

     nOutCols = nInCols / 8;

diff --git a/converter/pbm/pbmtoppa/pbm.c b/converter/pbm/pbmtoppa/pbm.c

index 2f8a42b..1c8d236 100644

--- a/converter/pbm/pbmtoppa/pbm.c

+++ b/converter/pbm/pbmtoppa/pbm.c

@@ -106,6 +106,7 @@ int pbm_readline(pbm_stat* pbm,unsigned char* data)

     return 0;

   case P4:

+    overflow_add(pbm->width, 7);

     tmp=(pbm->width+7)/8;

     tmp2=fread(data,1,tmp,pbm->fptr);

     if(tmp2 == tmp)

@@ -130,6 +131,7 @@ void pbm_unreadline (pbm_stat *pbm, void *data)

     return;

   pbm->unread = 1;

+  overflow_add(pbm->width, 7);

   pbm->revdata = malloc ((pbm->width+7)/8);

   memcpy (pbm->revdata, data, (pbm->width+7)/8);

   pbm->current_line--;

diff --git a/converter/pbm/pbmtoppa/pbmtoppa.c b/converter/pbm/pbmtoppa/pbmtoppa.c

index ff4a599..aa510ec 100644

--- a/converter/pbm/pbmtoppa/pbmtoppa.c

+++ b/converter/pbm/pbmtoppa/pbmtoppa.c

@@ -453,6 +453,7 @@ main(int argc, char *argv[]) {

             pm_error("main(): unrecognized parameter '%s'", argv[argn]);

     }

+    overflow_add(Width, 7);

     Pwidth=(Width+7)/8;

     printer.fptr=out;

diff --git a/converter/pbm/pbmtoxbm.c b/converter/pbm/pbmtoxbm.c

index ecb72b3..fc0eb9c 100644

--- a/converter/pbm/pbmtoxbm.c

+++ b/converter/pbm/pbmtoxbm.c

@@ -352,6 +352,8 @@ convertRaster(FILE *          const ifP,

     unsigned char * bitrow;

     unsigned int row;

+    

+    overflow_add(cols, padright);

     putinit(xbmVersion);

diff --git a/converter/pbm/pktopbm.c b/converter/pbm/pktopbm.c

index 712f339..b6fcb02 100644

--- a/converter/pbm/pktopbm.c

+++ b/converter/pbm/pktopbm.c

@@ -280,6 +280,7 @@ main(int argc, char *argv[]) {

         if (flagbyte == 7) {            /* long form preamble */

             integer packetlength = get32() ;    /* character packet length */

             car = get32() ;         /* character number */

+            overflow_add(packetlength, pktopbm_pkloc);

             endofpacket = packetlength + pktopbm_pkloc;

                 /* calculate end of packet */

             if ((car >= MAXPKCHAR) || !filename[car]) {

diff --git a/converter/pbm/thinkjettopbm.l b/converter/pbm/thinkjettopbm.l

index 5de4f2b..7f31de5 100644

--- a/converter/pbm/thinkjettopbm.l

+++ b/converter/pbm/thinkjettopbm.l

@@ -114,7 +114,9 @@ DIG             [0-9]

 <RASTERMODE>\033\*b{DIG}+W  {

                             int l;

                             if (rowCount >= rowCapacity) {

-                                rowCapacity += 100;

+				overflow_add(rowCapacity, 100);

+                                 rowCapacity += 100;

+				overflow2(rowCapacity, sizeof *rows);

                                 rows = realloc (rows, rowCapacity * sizeof *rows);

                                 if (rows == NULL)

                                     pm_error ("Out of memory.");

@@ -226,6 +228,8 @@ yywrap (void)

     /*

      * Quite simple since ThinkJet bit arrangement matches PBM

      */

+

+    overflow2(maxRowLength, 8);

     pbm_writepbminit(stdout, maxRowLength*8, rowCount, 0);

     packed_bitrow = malloc(maxRowLength);

diff --git a/converter/pbm/ybmtopbm.c b/converter/pbm/ybmtopbm.c

index 2a42908..cf1ff03 100644

--- a/converter/pbm/ybmtopbm.c

+++ b/converter/pbm/ybmtopbm.c

@@ -43,6 +43,7 @@ getinit(FILE *  const ifP,

         pm_error("EOF / read error");

     *depthP = 1;

+    overflow_add(*colsP, 15);

 }

diff --git a/converter/pgm/lispmtopgm.c b/converter/pgm/lispmtopgm.c

index 40dd3fb..b5469f7 100644

--- a/converter/pgm/lispmtopgm.c

+++ b/converter/pgm/lispmtopgm.c

@@ -58,6 +58,7 @@ main( argc, argv )

         pm_error( "depth (%d bits) is too large", depth);

     pgm_writepgminit( stdout, cols, rows, (gray) maxval, 0 );

+    overflow_add(cols, 7);

     grayrow = pgm_allocrow( ( cols + 7 ) / 8 * 8 );

     for ( row = 0; row < rows; ++row )

@@ -102,6 +103,8 @@ getinit( file, colsP, rowsP, depthP, padrightP )

     if ( *depthP == 0 )

 	*depthP = 1;	/* very old file */

+

+    overflow_add((int)colsP, 31);

     *padrightP = ( ( *colsP + 31 ) / 32 ) * 32 - *colsP;

diff --git a/converter/pgm/psidtopgm.c b/converter/pgm/psidtopgm.c

index 07417d1..25bb311 100644

--- a/converter/pgm/psidtopgm.c

+++ b/converter/pgm/psidtopgm.c

@@ -78,6 +78,7 @@ main(int     argc,

         pm_error("bits/sample (%d) is too large.", bitspersample);

     pgm_writepgminit(stdout, cols, rows, maxval, 0);

+    overflow_add(cols, 7);

     grayrow = pgm_allocrow((cols + 7) / 8 * 8);

     for (row = 0; row < rows; ++row) {

         unsigned int col;

diff --git a/converter/ppm/Makefile b/converter/ppm/Makefile

index 003ef8d..b97349d 100644

--- a/converter/ppm/Makefile

+++ b/converter/ppm/Makefile

@@ -11,7 +11,7 @@ SUBDIRS = hpcdtoppm ppmtompeg

 PORTBINARIES =	411toppm eyuvtoppm gouldtoppm ilbmtoppm imgtoppm \

 		leaftoppm mtvtoppm neotoppm \

-		pcxtoppm pc1toppm pi1toppm picttoppm pjtoppm \

+		pcxtoppm pc1toppm pi1toppm pjtoppm \

 		ppmtoacad ppmtoapplevol ppmtoarbtxt ppmtoascii \

 		ppmtobmp ppmtoeyuv ppmtogif ppmtoicr ppmtoilbm \

 		ppmtoleaf ppmtolj ppmtomitsu ppmtoneo \

diff --git a/converter/ppm/ilbmtoppm.c b/converter/ppm/ilbmtoppm.c

index 662be0b..2a86efc 100644

--- a/converter/ppm/ilbmtoppm.c

+++ b/converter/ppm/ilbmtoppm.c

@@ -606,6 +606,7 @@ decode_row(FILE *          const ifP,

     rawtype *chp;

     cols = bmhdP->w;

+    overflow_add(cols, 15);

     bytes = RowBytes(cols);

     for( plane = 0; plane < nPlanes; plane++ ) {

         int mask;

@@ -693,6 +694,23 @@ decode_mask(FILE *          const ifP,

  Multipalette handling

  ****************************************************************************/

+static void *

+xmalloc2(x, y)

+    int x;

+    int y;

+{

+    void *mem;

+

+    overflow2(x,y);

+    if( x * y == 0 )

+        return NULL;

+

+    mem = malloc2(x,y);

+    if( mem == NULL )

+        pm_error("out of memory allocating %d bytes", x * y);

+    return mem;

+}

+

 static void

 multi_adjust(cmap, row, palchange)

@@ -1355,6 +1373,9 @@ dcol_to_ppm(FILE *         const ifP,

     if( redmaxval != maxval || greenmaxval != maxval || bluemaxval != maxval )

         pm_message("scaling colors to %d bits", pm_maxvaltobits(maxval));

+    overflow_add(redmaxval, 1);

+    overflow_add(greenmaxval, 1);

+    overflow_add(bluemaxval, 1);

     MALLOCARRAY_NOFAIL(redtable,   redmaxval   +1);

     MALLOCARRAY_NOFAIL(greentable, greenmaxval +1);

     MALLOCARRAY_NOFAIL(bluetable,  bluemaxval  +1);

@@ -1784,7 +1805,9 @@ PCHG_ConvertSmall(PCHG, cmap, mask, datasize)

             ChangeCount32 = *data++;

             datasize -= 2;

+            overflow_add(ChangeCount16, ChangeCount32);

             changes = ChangeCount16 + ChangeCount32;

+            overflow_add(changes, 1);

             for( i = 0; i < changes; i++ ) {

                 if( totalchanges >= PCHG->TotalChanges ) goto fail;

                 if( datasize < 2 ) goto fail;

@@ -2049,6 +2072,9 @@ read_pchg(FILE *     const ifP,

             cmap->mp_change[i] = NULL;

         if( PCHG.StartLine < 0 ) {

             int nch;

+            if(PCHG.MaxReg < PCHG.MinReg)

+                pm_error("assert: MinReg > MaxReg");

+            overflow_add(PCHG.MaxReg-PCHG.MinReg, 2);

             nch = PCHG.MaxReg - PCHG.MinReg +1;

             MALLOCARRAY_NOFAIL(cmap->mp_init, nch + 1);

             for( i = 0; i < nch; i++ )

@@ -2125,6 +2151,7 @@ process_body( FILE *          const ifP,

     if (typeid == ID_ILBM) {

         int isdeep;

+        overflow_add(bmhdP->w, 15);

         MALLOCARRAY_NOFAIL(ilbmrow, RowBytes(bmhdP->w));

         *viewportmodesP |= fakeviewport;      /* -isham/-isehb */

diff --git a/converter/ppm/imgtoppm.c b/converter/ppm/imgtoppm.c

index 7078b88..eb8509e 100644

--- a/converter/ppm/imgtoppm.c

+++ b/converter/ppm/imgtoppm.c

@@ -84,6 +84,7 @@ main(int argc, char ** argv) {

             len = atoi((char*) buf );

             if ( fread( buf, len, 1, ifp ) != 1 )

                 pm_error( "bad colormap buf" );

+            overflow2(cmaplen, 3);

             if ( cmaplen * 3 != len )

             {

                 pm_message(

@@ -105,6 +106,7 @@ main(int argc, char ** argv) {

                 pm_error( "bad pixel data header" );

             buf[8] = '\0';

             len = atoi((char*) buf );

+            overflow2(cols, rows);

             if ( len != cols * rows )

                 pm_message(

                     "pixel data length (%d) does not match image size (%d)",

diff --git a/converter/ppm/pcxtoppm.c b/converter/ppm/pcxtoppm.c

index e252ba2..270ae3b 100644

--- a/converter/ppm/pcxtoppm.c

+++ b/converter/ppm/pcxtoppm.c

@@ -409,6 +409,7 @@ pcx_planes_to_pixels(pixels, bitplanes, bytesperline, planes, bitsperpixel)

     /*

      * clear the pixel buffer

      */

+    overflow2(bytesperline, 8);

     npixels = (bytesperline * 8) / bitsperpixel;

     p    = pixels;

     while (--npixels >= 0)

@@ -470,6 +471,7 @@ pcx_16col_to_ppm(FILE *       const ifP,

     }

     /*  BytesPerLine should be >= BitsPerPixel * cols / 8  */

+    overflow2(BytesPerLine, 8);

     rawcols = BytesPerLine * 8 / BitsPerPixel;

     if (headerCols > rawcols) {

         pm_message("warning - BytesPerLine = %d, "

diff --git a/converter/ppm/picttoppm.c b/converter/ppm/picttoppm.c

index d412038..a59bf77 100644

--- a/converter/ppm/picttoppm.c

+++ b/converter/ppm/picttoppm.c

@@ -1,3 +1,4 @@

+#error "Unfixable. Don't ship me"

 /*

  * picttoppm.c -- convert a MacIntosh PICT file to PPM format.

  *

diff --git a/converter/ppm/pjtoppm.c b/converter/ppm/pjtoppm.c

index 7b694fb..62ce77e 100644

--- a/converter/ppm/pjtoppm.c

+++ b/converter/ppm/pjtoppm.c

@@ -127,20 +127,22 @@ main(argc, argv)

                 case 'V':   /* send plane */

                 case 'W':   /* send last plane */

                     if (rows == -1 || r >= rows || image == NULL) {

-                        if (rows == -1 || r >= rows)

+                        if (rows == -1 || r >= rows) {

+                            overflow_add(rows, 100);

                             rows += 100;

+                        }

+

                         if (image == NULL) {

-                            MALLOCARRAY(image, rows * planes);

-                            MALLOCARRAY(imlen, rows * planes);

+                            image = (unsigned char **)

+                                malloc3(rows , planes , sizeof(unsigned char *));

+                            imlen = (int *) malloc3(rows , planes,  sizeof(int));

                         }

                         else {

-                            image = (unsigned char **) 

-                                realloc(image, 

-                                        rows * planes * 

-                                        sizeof(unsigned char *));

-                            imlen = (int *) 

-                                realloc(imlen, rows * planes * sizeof(int));

-                        }

+                            overflow2(rows,planes);

+                            image = (unsigned char **)

+                                realloc2(image, rows * planes,

+                                    sizeof(unsigned char *));

+                            imlen = (int *) realloc2(imlen, rows * planes, sizeof(int));                        }

                     }

                     if (image == NULL || imlen == NULL)

                         pm_error("out of memory");

@@ -212,8 +214,10 @@ main(argc, argv)

                 for (i = 0, c = 0; c < imlen[p + r * planes]; c += 2)

                     for (cmd = image[p + r * planes][c],

                              val = image[p + r * planes][c+1]; 

-                         cmd >= 0 && i < newcols; cmd--, i++) 

+                         cmd >= 0 && i < newcols; cmd--, i++) {

                         buf[i] = val;

+                        overflow_add(i, 1);

+                    }

                 cols = cols > i ? cols : i;

                 free(image[p + r * planes]);

                 /* 

@@ -224,6 +228,7 @@ main(argc, argv)

                 image[p + r * planes] = (unsigned char *) realloc(buf, i);

             }

         }

+        overflow2(cols, 8);

         cols *= 8;

     }

diff --git a/converter/ppm/ppmtoeyuv.c b/converter/ppm/ppmtoeyuv.c

index f5ce115..6f072be 100644

--- a/converter/ppm/ppmtoeyuv.c

+++ b/converter/ppm/ppmtoeyuv.c

@@ -114,6 +114,7 @@ create_multiplication_tables(const pixval maxval) {

     int index;

+    overflow_add(maxval, 1);

     MALLOCARRAY_NOFAIL(mult299   , maxval+1);

     MALLOCARRAY_NOFAIL(mult587   , maxval+1);

     MALLOCARRAY_NOFAIL(mult114   , maxval+1);

diff --git a/converter/ppm/ppmtolj.c b/converter/ppm/ppmtolj.c

index 7ed814e..b4e7db1 100644

--- a/converter/ppm/ppmtolj.c

+++ b/converter/ppm/ppmtolj.c

@@ -182,6 +182,7 @@ int main(int argc, char *argv[]) {

     ppm_readppminit( ifp, &cols, &rows, &maxval, &format );

     pixelrow = ppm_allocrow( cols );

+    overflow2(cols, 6);

     obuf = (unsigned char *) pm_allocrow(cols * 3, sizeof(unsigned char));

     cbuf = (unsigned char *) pm_allocrow(cols * 6, sizeof(unsigned char));

     if (mode == C_TRANS_MODE_DELTA)

diff --git a/converter/ppm/ppmtomitsu.c b/converter/ppm/ppmtomitsu.c

index e59f09b..1d2be20 100644

--- a/converter/ppm/ppmtomitsu.c

+++ b/converter/ppm/ppmtomitsu.c

@@ -685,6 +685,8 @@ main(int argc, char * argv[]) {

         medias = MSize_User;

     if (dpi300) {

+        overflow2(medias.maxcols, 2);

+        overflow2(medias.maxrows, 2);

         medias.maxcols *= 2;

         medias.maxrows *= 2;

     }

diff --git a/converter/ppm/ppmtopcx.c b/converter/ppm/ppmtopcx.c

index fa68edc..97dfb2b 100644

--- a/converter/ppm/ppmtopcx.c

+++ b/converter/ppm/ppmtopcx.c

@@ -425,6 +425,8 @@ ppmTo16ColorPcx(pixel **            const pixels,

             else                   Planes = 1;

         }

     }

+    overflow2(BitsPerPixel, cols);

+    overflow_add(BitsPerPixel * cols, 7);

     BytesPerLine = ((cols * BitsPerPixel) + 7) / 8;

     MALLOCARRAY_NOFAIL(indexRow, cols);

     MALLOCARRAY_NOFAIL(planesrow, BytesPerLine);

diff --git a/converter/ppm/ppmtopict.c b/converter/ppm/ppmtopict.c

index 36464b6..c91ccf2 100644

--- a/converter/ppm/ppmtopict.c

+++ b/converter/ppm/ppmtopict.c

@@ -450,6 +450,8 @@ main(int argc, const char ** argv) {

     putShort(stdout, 0);            /* mode */

     /* Finally, write out the data. */

+    overflow_add(cols/MAX_COUNT, 1);

+    overflow_add(cols, cols/MAX_COUNT+1);

     outBuf = malloc((unsigned)(cols+cols/MAX_COUNT+1));

     for (row = 0, oc = 0; row < rows; ++row) {

         unsigned int rowSize;

diff --git a/converter/ppm/ppmtopj.c b/converter/ppm/ppmtopj.c

index d116773..fc84cac 100644

--- a/converter/ppm/ppmtopj.c

+++ b/converter/ppm/ppmtopj.c

@@ -179,6 +179,7 @@ char *argv[];

 	pixels = ppm_readppm( ifp, &cols, &rows, &maxval );

 	pm_close( ifp );

+        overflow2(cols,2);

 	obuf = (unsigned char *) pm_allocrow(cols, sizeof(unsigned char));

 	cbuf = (unsigned char *) pm_allocrow(cols * 2, sizeof(unsigned char));

diff --git a/converter/ppm/ppmtopjxl.c b/converter/ppm/ppmtopjxl.c

index 90bcef0..72d0027 100644

--- a/converter/ppm/ppmtopjxl.c

+++ b/converter/ppm/ppmtopjxl.c

@@ -267,6 +267,9 @@ main(int argc, const char * argv[]) {

     if (maxval > PCL_MAXVAL)

         pm_error("color range too large; reduce with ppmcscale");

+    if (cols < 0 || rows < 0)

+        pm_error("negative size is not possible");