diff -up netpbm-10.58.01/analyzer/pgmtexture.c.security-code netpbm-10.58.01/analyzer/pgmtexture.c

--- netpbm-10.58.01/analyzer/pgmtexture.c.security-code	2012-04-09 15:31:32.000000000 +0200

+++ netpbm-10.58.01/analyzer/pgmtexture.c	2012-04-09 15:40:03.183620040 +0200

@@ -97,7 +97,7 @@ vector(unsigned int const nl,

     float * v;

     assert(nh >= nl);

-

+    overflow_add(nh - nl, 1);

     MALLOCARRAY(v, (unsigned) (nh - nl + 1));

     if (v == NULL)

@@ -129,6 +129,7 @@ matrix (unsigned int const nrl,

     assert(nrh >= nrl);

     /* allocate pointers to rows */

+    overflow_add(nrh - nrl, 1);

     MALLOCARRAY(m, (unsigned) (nrh - nrl + 1));

     if (m == NULL)

         pm_error("Unable to allocate memory for a matrix.");

@@ -136,7 +137,7 @@ matrix (unsigned int const nrl,

     m -= ncl;

     assert (nch >= ncl);

-

+    overflow_add(nch - ncl, 1);

     /* allocate rows and set pointers to them */

     for (i = nrl; i <= nrh; ++i) {

         MALLOCARRAY(m[i], (unsigned) (nch - ncl + 1));

diff -up netpbm-10.58.01/converter/other/gemtopnm.c.security-code netpbm-10.58.01/converter/other/gemtopnm.c

--- netpbm-10.58.01/converter/other/gemtopnm.c.security-code	2012-04-09 15:31:42.000000000 +0200

+++ netpbm-10.58.01/converter/other/gemtopnm.c	2012-04-09 15:40:03.183620040 +0200

@@ -106,6 +106,7 @@ main(argc, argv)

 	pnm_writepnminit( stdout, cols, rows, MAXVAL, type, 0 );

+    overflow_add(cols, padright);

     { 

         /* allocate input row data structure */

         int plane;

diff -up netpbm-10.58.01/converter/other/jpegtopnm.c.security-code netpbm-10.58.01/converter/other/jpegtopnm.c

--- netpbm-10.58.01/converter/other/jpegtopnm.c.security-code	2012-04-09 15:31:40.000000000 +0200

+++ netpbm-10.58.01/converter/other/jpegtopnm.c	2012-04-09 15:40:03.184620028 +0200

@@ -861,6 +861,8 @@ convertImage(FILE *

     /* Calculate output image dimensions so we can allocate space */

     jpeg_calc_output_dimensions(cinfoP);

+    overflow2(cinfoP->output_width, cinfoP->output_components);

+

     /* Start decompressor */

     jpeg_start_decompress(cinfoP);

diff -up netpbm-10.58.01/converter/other/pbmtopgm.c.security-code netpbm-10.58.01/converter/other/pbmtopgm.c

--- netpbm-10.58.01/converter/other/pbmtopgm.c.security-code	2012-04-09 15:31:42.000000000 +0200

+++ netpbm-10.58.01/converter/other/pbmtopgm.c	2012-04-09 15:40:03.184620028 +0200

@@ -47,6 +47,7 @@ main(int argc, char *argv[]) {

                  "than the image height (%u rows)", height, rows);

     outrow = pgm_allocrow(cols) ;

+    overflow2(width, height);

     maxval = MIN(PGM_OVERALLMAXVAL, width*height);

     pgm_writepgminit(stdout, cols, rows, maxval, 0) ;

diff -up netpbm-10.58.01/converter/other/pnmtoddif.c.security-code netpbm-10.58.01/converter/other/pnmtoddif.c

--- netpbm-10.58.01/converter/other/pnmtoddif.c.security-code	2012-04-09 15:31:42.000000000 +0200

+++ netpbm-10.58.01/converter/other/pnmtoddif.c	2012-04-09 15:40:03.185620015 +0200

@@ -632,6 +632,7 @@ main(int argc, char *argv[]) {

     switch (PNM_FORMAT_TYPE(format)) {

     case PBM_TYPE:

         ip.bits_per_pixel = 1;

+        overflow_add(cols, 7);

         ip.bytes_per_line = (cols + 7) / 8;

         ip.spectral = 2;

         ip.components = 1;

@@ -647,6 +648,7 @@ main(int argc, char *argv[]) {

         ip.polarity = 2;

         break;

     case PPM_TYPE:

+        overflow2(cols, 3);

         ip.bytes_per_line = 3 * cols;

         ip.bits_per_pixel = 24;

         ip.spectral = 5;

diff -up netpbm-10.58.01/converter/other/pnmtojpeg.c.security-code netpbm-10.58.01/converter/other/pnmtojpeg.c

--- netpbm-10.58.01/converter/other/pnmtojpeg.c.security-code	2012-04-09 15:31:39.000000000 +0200

+++ netpbm-10.58.01/converter/other/pnmtojpeg.c	2012-04-09 15:40:03.186620002 +0200

@@ -605,7 +605,11 @@ read_scan_script(j_compress_ptr const ci

            want JPOOL_PERMANENT.  

         */

         const unsigned int scan_info_size = nscans * sizeof(jpeg_scan_info);

-        jpeg_scan_info * const scan_info = 

+        const jpeg_scan_info * scan_info;

+      

+        overflow2(nscans, sizeof(jpeg_scan_info));

+      

+        scan_info =

             (jpeg_scan_info *)

             (*cinfo->mem->alloc_small) ((j_common_ptr) cinfo, JPOOL_IMAGE,

                                         scan_info_size);

@@ -937,6 +941,8 @@ compute_rescaling_array(JSAMPLE ** const

   const long half_maxval = maxval / 2;

   long val;

+  overflow_add(maxval, 1);

+  overflow2(maxval+1, sizeof(JSAMPLE));

   *rescale_p = (JSAMPLE *)

     (cinfo.mem->alloc_small) ((j_common_ptr) &cinfo, JPOOL_IMAGE,

                               (size_t) (((long) maxval + 1L) * 

@@ -1015,6 +1021,7 @@ convert_scanlines(struct jpeg_compress_s

     */

   /* Allocate the libpnm output and compressor input buffers */

+  overflow2(cinfo_p->image_width, cinfo_p->input_components);

   buffer = (*cinfo_p->mem->alloc_sarray)

     ((j_common_ptr) cinfo_p, JPOOL_IMAGE,

      (unsigned int) cinfo_p->image_width * cinfo_p->input_components, 

diff -up netpbm-10.58.01/converter/other/pnmtops.c.security-code netpbm-10.58.01/converter/other/pnmtops.c

--- netpbm-10.58.01/converter/other/pnmtops.c.security-code	2012-04-09 15:31:40.000000000 +0200

+++ netpbm-10.58.01/converter/other/pnmtops.c	2012-04-09 15:40:03.187619989 +0200

@@ -256,17 +256,21 @@ parseCommandLine(int argc, const char **

     validateCompDimension(width, 72, "-width value");

     validateCompDimension(height, 72, "-height value");

+    overflow2(width, 72);

     cmdlineP->width  = width * 72;

+    overflow2(height, 72);

     cmdlineP->height = height * 72;

     if (imagewidthSpec) {

         validateCompDimension(imagewidth, 72, "-imagewidth value");

+        overflow2(imagewidth, 72);

         cmdlineP->imagewidth = imagewidth * 72;

     }

     else

         cmdlineP->imagewidth = 0;

     if (imageheightSpec) {

-        validateCompDimension(imagewidth, 72, "-imageheight value");

+        validateCompDimension(imageheight, 72, "-imageheight value");

+        overflow2(imageheight, 72);

         cmdlineP->imageheight = imageheight * 72;

     }

     else

diff -up netpbm-10.58.01/converter/other/pnmtorle.c.security-code netpbm-10.58.01/converter/other/pnmtorle.c

--- netpbm-10.58.01/converter/other/pnmtorle.c.security-code	2012-04-09 15:31:42.000000000 +0200

+++ netpbm-10.58.01/converter/other/pnmtorle.c	2012-04-09 15:40:03.188619976 +0200

@@ -19,6 +19,8 @@

  * If you modify this software, you should include a notice giving the

  * name of the person performing the modification, the date of modification,

  * and the reason for such modification.

+ *

+ *  2002-12-19: Fix maths wrapping bugs. Alan Cox <alan@redhat.com>

  */

 /*

  * pnmtorle - A program which will convert pbmplus (ppm or pgm) images

diff -up netpbm-10.58.01/converter/other/pnmtosgi.c.security-code netpbm-10.58.01/converter/other/pnmtosgi.c

--- netpbm-10.58.01/converter/other/pnmtosgi.c.security-code	2012-04-09 15:31:42.000000000 +0200

+++ netpbm-10.58.01/converter/other/pnmtosgi.c	2012-04-09 15:40:03.188619976 +0200

@@ -254,6 +254,7 @@ build_channels(FILE * const ifp, int con

 #endif

     if( storage != STORAGE_VERBATIM ) {

+        overflow2(channels, rows);

         MALLOCARRAY_NOFAIL(table, channels * rows);

         MALLOCARRAY_NOFAIL(rletemp, WORSTCOMPR(cols));

     }

@@ -306,6 +307,8 @@ compress(ScanElem * temp,

             break;

         case STORAGE_RLE:

             tabrow = chan_no * rows + row;

+            overflow2(chan_no, rows);

+            overflow_add(chan_no* rows, row);

             len = rle_compress(temp, cols);    /* writes result into rletemp */

             channel[chan_no][row].length = len;

             MALLOCARRAY(p, len);

diff -up netpbm-10.58.01/converter/other/rletopnm.c.security-code netpbm-10.58.01/converter/other/rletopnm.c

--- netpbm-10.58.01/converter/other/rletopnm.c.security-code	2012-04-09 15:31:42.000000000 +0200

+++ netpbm-10.58.01/converter/other/rletopnm.c	2012-04-09 15:40:03.189619963 +0200

@@ -19,6 +19,8 @@

  * If you modify this software, you should include a notice giving the

  * name of the person performing the modification, the date of modification,

  * and the reason for such modification.

+ *

+ *  2002-12-19: Fix maths wrapping bugs. Alan Cox <alan@redhat.com>

  */

 /*

  * rletopnm - A conversion program to convert from Utah's "rle" image format

diff -up netpbm-10.58.01/converter/other/sgitopnm.c.security-code netpbm-10.58.01/converter/other/sgitopnm.c

--- netpbm-10.58.01/converter/other/sgitopnm.c.security-code	2012-04-09 15:31:42.000000000 +0200

+++ netpbm-10.58.01/converter/other/sgitopnm.c	2012-04-09 15:40:03.189619963 +0200

@@ -359,10 +359,14 @@ readChannels(FILE *       const ifP,

         MALLOCARRAY_NOFAIL(image, head->ysize);

     } else {

         maxchannel = MIN(3, head->zsize);

+        overflow2(head->ysize, maxchannel);

         MALLOCARRAY_NOFAIL(image, head->ysize * maxchannel);

     }

-    if (table) 

+    if (table) {

+        overflow2(head->xsize, 2);

+        overflow_add(head->xsize*2, 2);

         MALLOCARRAY_NOFAIL(temp, WORSTCOMPR(head->xsize));

+    }

     for (channel = 0; channel < maxchannel; ++channel) {

         unsigned int row;

diff -up netpbm-10.58.01/converter/other/sirtopnm.c.security-code netpbm-10.58.01/converter/other/sirtopnm.c

--- netpbm-10.58.01/converter/other/sirtopnm.c.security-code	2012-04-09 15:31:42.000000000 +0200

+++ netpbm-10.58.01/converter/other/sirtopnm.c	2012-04-09 15:40:03.190619951 +0200

@@ -69,6 +69,7 @@ char* argv[];

 	    }

 	    break;

 	case PPM_TYPE:

+	    overflow3(cols, rows, 3);

 	    picsize = cols * rows * 3;

 	    planesize = cols * rows;

             if ( !( sirarray = (unsigned char*) malloc( picsize ) ) ) 

diff -up netpbm-10.58.01/converter/other/tifftopnm.c.security-code netpbm-10.58.01/converter/other/tifftopnm.c

--- netpbm-10.58.01/converter/other/tifftopnm.c.security-code	2012-04-09 15:31:42.000000000 +0200

+++ netpbm-10.58.01/converter/other/tifftopnm.c	2012-04-09 15:40:03.191619939 +0200

@@ -1279,7 +1279,9 @@ convertRasterByRows(pnmOut *       const

     if (scanbuf == NULL)

         pm_error("can't allocate memory for scanline buffer");

-    MALLOCARRAY(samplebuf, cols * spp);

+    /* samplebuf is unsigned int * !!! */

+    samplebuf = (unsigned int *) malloc3(cols , sizeof(unsigned int) , spp);

+

     if (samplebuf == NULL)

         pm_error("can't allocate memory for row buffer");

diff -up netpbm-10.58.01/converter/other/xwdtopnm.c.security-code netpbm-10.58.01/converter/other/xwdtopnm.c

--- netpbm-10.58.01/converter/other/xwdtopnm.c.security-code	2012-04-09 15:31:40.000000000 +0200

+++ netpbm-10.58.01/converter/other/xwdtopnm.c	2012-04-09 15:40:03.192619927 +0200

@@ -209,6 +209,10 @@ processX10Header(X10WDFileHeader *  cons

         *colorsP = pnm_allocrow(2);

         PNM_ASSIGN1((*colorsP)[0], 0);

         PNM_ASSIGN1((*colorsP)[1], *maxvalP);

+        overflow_add(h10P->pixmap_width, 15);

+        if(h10P->pixmap_width < 0)

+            pm_error("assert: negative width");

+        overflow2((((h10P->pixmap_width + 15) / 16) * 16 - h10P->pixmap_width), 8);

         *padrightP =

             (((h10P->pixmap_width + 15) / 16) * 16 - h10P->pixmap_width) * 8;

         *bits_per_itemP = 16;

@@ -634,6 +638,7 @@ processX11Header(X11WDFileHeader *  cons

     *colsP = h11FixedP->pixmap_width;

     *rowsP = h11FixedP->pixmap_height;

+    overflow2(h11FixedP->bytes_per_line, 8);

     *padrightP =

         h11FixedP->bytes_per_line * 8 -

         h11FixedP->pixmap_width * h11FixedP->bits_per_pixel;

diff -up netpbm-10.58.01/converter/pbm/mdatopbm.c.security-code netpbm-10.58.01/converter/pbm/mdatopbm.c

--- netpbm-10.58.01/converter/pbm/mdatopbm.c.security-code	2012-04-09 15:31:45.000000000 +0200

+++ netpbm-10.58.01/converter/pbm/mdatopbm.c	2012-04-09 15:40:03.192619927 +0200

@@ -245,10 +245,13 @@ main(int argc, char **argv) {

         pm_readlittleshort(infile, &yy;; nInCols = yy;

     }

+    overflow2(nOutCols, 8);

     nOutCols = 8 * nInCols;

     nOutRows = nInRows;

-    if (bScale) 

+    if (bScale) {

+        overflow2(nOutRows, 2);

         nOutRows *= 2;

+    }

     data = pbm_allocarray(nOutCols, nOutRows);

diff -up netpbm-10.58.01/converter/pbm/mgrtopbm.c.security-code netpbm-10.58.01/converter/pbm/mgrtopbm.c

--- netpbm-10.58.01/converter/pbm/mgrtopbm.c.security-code	2012-04-09 15:31:45.000000000 +0200

+++ netpbm-10.58.01/converter/pbm/mgrtopbm.c	2012-04-09 15:40:03.193619915 +0200

@@ -65,6 +65,8 @@ readMgrHeader(FILE *          const ifP,

     if (head.h_high < ' ' || head.l_high < ' ')

         pm_error("Invalid width field in MGR header");

+    overflow_add(*colsP, pad);

+

     *colsP = (((int)head.h_wide - ' ') << 6) + ((int)head.l_wide - ' ');

     *rowsP = (((int)head.h_high - ' ') << 6) + ((int) head.l_high - ' ');

     *padrightP = ( ( *colsP + pad - 1 ) / pad ) * pad - *colsP;

diff -up netpbm-10.58.01/converter/pbm/pbmtogem.c.security-code netpbm-10.58.01/converter/pbm/pbmtogem.c

--- netpbm-10.58.01/converter/pbm/pbmtogem.c.security-code	2012-04-09 15:31:45.000000000 +0200

+++ netpbm-10.58.01/converter/pbm/pbmtogem.c	2012-04-09 15:40:03.193619915 +0200

@@ -79,6 +79,7 @@ putinit (int const rows, int const cols)

   bitsperitem = 0;

   bitshift = 7;

   outcol = 0;

+  overflow_add(cols, 7);

   outmax = (cols + 7) / 8;

   outrow = (unsigned char *) pm_allocrow (outmax, sizeof (unsigned char));

   lastrow = (unsigned char *) pm_allocrow (outmax, sizeof (unsigned char));

diff -up netpbm-10.58.01/converter/pbm/pbmtogo.c.security-code netpbm-10.58.01/converter/pbm/pbmtogo.c

--- netpbm-10.58.01/converter/pbm/pbmtogo.c.security-code	2012-04-09 15:31:45.000000000 +0200

+++ netpbm-10.58.01/converter/pbm/pbmtogo.c	2012-04-09 15:40:03.193619915 +0200

@@ -158,6 +158,7 @@ main(int           argc,

     bitrow = pbm_allocrow(cols);

     /* Round cols up to the nearest multiple of 8. */

+    overflow_add(cols, 7);

     rucols = ( cols + 7 ) / 8;

     bytesperrow = rucols;       /* GraphOn uses bytes */

     rucols = rucols * 8;

diff -up netpbm-10.58.01/converter/pbm/pbmtolj.c.security-code netpbm-10.58.01/converter/pbm/pbmtolj.c

--- netpbm-10.58.01/converter/pbm/pbmtolj.c.security-code	2012-04-09 15:31:45.000000000 +0200

+++ netpbm-10.58.01/converter/pbm/pbmtolj.c	2012-04-09 15:40:03.194619902 +0200

@@ -120,7 +120,11 @@ parseCommandLine(int argc, char ** argv,

 static void

 allocateBuffers(unsigned int const cols) {

+    overflow_add(cols, 8);

     rowBufferSize = (cols + 7) / 8;

+    overflow_add(rowBufferSize, 128);

+    overflow_add(rowBufferSize, rowBufferSize+128);

+    overflow_add(rowBufferSize+10, rowBufferSize/8);

     packBufferSize = rowBufferSize + (rowBufferSize + 127) / 128 + 1;

     deltaBufferSize = rowBufferSize + rowBufferSize / 8 + 10;

diff -up netpbm-10.58.01/converter/pbm/pbmtomacp.c.security-code netpbm-10.58.01/converter/pbm/pbmtomacp.c

--- netpbm-10.58.01/converter/pbm/pbmtomacp.c.security-code	2012-04-09 15:31:45.000000000 +0200

+++ netpbm-10.58.01/converter/pbm/pbmtomacp.c	2012-04-09 15:40:03.195619889 +0200

@@ -101,6 +101,7 @@ char *argv[];

   if( !lflg )

     left = 0;

+  overflow_add(left, MAX_COLS - 1);

   if( rflg )

   { if( right - left >= MAX_COLS )

       right = left + MAX_COLS - 1;

@@ -111,6 +112,8 @@ char *argv[];

   if( !tflg )

     top = 0;

+  overflow_add(top, MAX_LINES - 1);

+

   if( bflg )

   { if( bottom - top >= MAX_LINES )

       bottom = top + MAX_LINES - 1;

diff -up netpbm-10.58.01/converter/pbm/pbmtomda.c.security-code netpbm-10.58.01/converter/pbm/pbmtomda.c

--- netpbm-10.58.01/converter/pbm/pbmtomda.c.security-code	2012-04-09 15:31:45.000000000 +0200

+++ netpbm-10.58.01/converter/pbm/pbmtomda.c	2012-04-09 15:40:03.195619889 +0200

@@ -179,6 +179,7 @@ int main(int argc, char **argv)

     nOutRowsUnrounded = bScale ? nInRows/2 : nInRows;

+    overflow_add(nOutRowsUnrounded, 3);

     nOutRows = ((nOutRowsUnrounded + 3) / 4) * 4;

         /* MDA wants rows a multiple of 4 */   

     nOutCols = nInCols / 8;

diff -up netpbm-10.58.01/converter/pbm/pbmtoppa/pbm.c.security-code netpbm-10.58.01/converter/pbm/pbmtoppa/pbm.c

--- netpbm-10.58.01/converter/pbm/pbmtoppa/pbm.c.security-code	2012-04-09 15:31:45.000000000 +0200

+++ netpbm-10.58.01/converter/pbm/pbmtoppa/pbm.c	2012-04-09 15:40:03.195619889 +0200

@@ -105,6 +105,7 @@ int pbm_readline(pbm_stat* pbm,unsigned

     return 0;

   case P4:

+    overflow_add(pbm->width, 7);

     tmp=(pbm->width+7)/8;

     tmp2=fread(data,1,tmp,pbm->fptr);

     if(tmp2 == tmp)

@@ -129,7 +130,8 @@ void pbm_unreadline (pbm_stat *pbm, void

     return;

   pbm->unread = 1;

-  pbm->revdata = malloc ((pbm->width+7)/8);

+  overflow_add(pbm->width, 7);

+  pbm->revdata = malloc((pbm->width+7)/8);

   memcpy (pbm->revdata, data, (pbm->width+7)/8);

   pbm->current_line--;

 }

diff -up netpbm-10.58.01/converter/pbm/pbmtoppa/pbmtoppa.c.security-code netpbm-10.58.01/converter/pbm/pbmtoppa/pbmtoppa.c

--- netpbm-10.58.01/converter/pbm/pbmtoppa/pbmtoppa.c.security-code	2012-04-09 15:31:45.000000000 +0200

+++ netpbm-10.58.01/converter/pbm/pbmtoppa/pbmtoppa.c	2012-04-09 15:40:03.196619876 +0200

@@ -441,6 +441,7 @@ main(int argc, char *argv[]) {

             pm_error("main(): unrecognized parameter '%s'", argv[argn]);

     }

+    overflow_add(Width, 7);

     Pwidth=(Width+7)/8;

     printer.fptr=out;

diff -up netpbm-10.58.01/converter/pbm/pbmtoxbm.c.security-code netpbm-10.58.01/converter/pbm/pbmtoxbm.c

--- netpbm-10.58.01/converter/pbm/pbmtoxbm.c.security-code	2012-04-09 15:31:45.000000000 +0200

+++ netpbm-10.58.01/converter/pbm/pbmtoxbm.c	2012-04-09 15:40:03.196619876 +0200

@@ -335,6 +335,8 @@ convertRaster(FILE *          const ifP,

     unsigned char * bitrow;

     unsigned int row;

+    

+    overflow_add(cols, padright);

     putinit(xbmVersion);

diff -up netpbm-10.58.01/converter/pbm/pbmtoybm.c.security-code netpbm-10.58.01/converter/pbm/pbmtoybm.c

--- netpbm-10.58.01/converter/pbm/pbmtoybm.c.security-code	2012-04-09 15:31:45.000000000 +0200

+++ netpbm-10.58.01/converter/pbm/pbmtoybm.c	2012-04-09 15:40:03.197619863 +0200

@@ -113,6 +113,7 @@ main(int argc, const char *argv[]) {

     bitrow = pbm_allocrow(cols);

     /* Compute padding to round cols up to the nearest multiple of 16. */

+    overflow_add(cols, 16);

     padright = ((cols + 15) / 16) * 16 - cols;

     putinit(cols, rows);

diff -up netpbm-10.58.01/converter/pbm/pbmtozinc.c.security-code netpbm-10.58.01/converter/pbm/pbmtozinc.c

--- netpbm-10.58.01/converter/pbm/pbmtozinc.c.security-code	2012-04-09 15:31:45.000000000 +0200

+++ netpbm-10.58.01/converter/pbm/pbmtozinc.c	2012-04-09 15:40:03.197619863 +0200

@@ -65,6 +65,7 @@ main(int argc, char * argv[]) {

     bitrow = pbm_allocrow( cols );

     /* Compute padding to round cols up to the nearest multiple of 16. */

+    overflow_add(cols, 16);

     padright = ( ( cols + 15 ) / 16 ) * 16 - cols;

     printf( "USHORT %s[] = {\n",name);

diff -up netpbm-10.58.01/converter/pbm/pbmto10x.c.security-code netpbm-10.58.01/converter/pbm/pbmto10x.c

--- netpbm-10.58.01/converter/pbm/pbmto10x.c.security-code	2012-04-09 15:31:45.000000000 +0200

+++ netpbm-10.58.01/converter/pbm/pbmto10x.c	2012-04-09 15:40:03.197619863 +0200

@@ -162,7 +162,7 @@ main(int argc, char * argv[]) {

         res_60x72();

     pm_close(ifp);

-    exit(0);

+    return 0;

 }

diff -up netpbm-10.58.01/converter/pbm/pbmto4425.c.security-code netpbm-10.58.01/converter/pbm/pbmto4425.c

--- netpbm-10.58.01/converter/pbm/pbmto4425.c.security-code	2012-04-09 15:31:45.000000000 +0200

+++ netpbm-10.58.01/converter/pbm/pbmto4425.c	2012-04-09 15:40:03.198619851 +0200

@@ -2,6 +2,7 @@

 #include "nstring.h"

 #include "pbm.h"

+#include <string.h>

 static char bit_table[2][3] = {

 {1, 4, 0x10},

@@ -160,7 +161,7 @@ main(int argc, char * argv[]) {

     xres = vmap_width * 2;

     yres = vmap_height * 3;

-    vmap = malloc(vmap_width * vmap_height * sizeof(char));

+    vmap = malloc3(vmap_width, vmap_height, sizeof(char));

     if(vmap == NULL)

 	{

         pm_error( "Cannot allocate memory" );

diff -up netpbm-10.58.01/converter/pbm/pktopbm.c.security-code netpbm-10.58.01/converter/pbm/pktopbm.c

--- netpbm-10.58.01/converter/pbm/pktopbm.c.security-code	2012-04-09 15:31:45.000000000 +0200

+++ netpbm-10.58.01/converter/pbm/pktopbm.c	2012-04-09 15:40:03.198619851 +0200

@@ -277,6 +277,7 @@ main(int argc, char *argv[]) {

         if (flagbyte == 7) {            /* long form preamble */

             integer packetlength = get32() ;    /* character packet length */

             car = get32() ;         /* character number */

+            overflow_add(packetlength, pktopbm_pkloc);

             endofpacket = packetlength + pktopbm_pkloc;

                 /* calculate end of packet */

             if ((car >= MAXPKCHAR) || !filename[car]) {

diff -up netpbm-10.58.01/converter/pbm/thinkjettopbm.l.security-code netpbm-10.58.01/converter/pbm/thinkjettopbm.l

--- netpbm-10.58.01/converter/pbm/thinkjettopbm.l.security-code	2012-04-09 15:31:45.000000000 +0200

+++ netpbm-10.58.01/converter/pbm/thinkjettopbm.l	2012-04-09 15:40:03.199619839 +0200

@@ -114,7 +114,9 @@ DIG             [0-9]

 <RASTERMODE>\033\*b{DIG}+W  {

                             int l;

                             if (rowCount >= rowCapacity) {

+				overflow_add(rowCapacity, 100);

                                 rowCapacity += 100;

+				overflow2(rowCapacity, sizeof *rows);

                                 rows = realloc (rows, rowCapacity * sizeof *rows);

                                 if (rows == NULL)

                                     pm_error ("Out of memory.");

@@ -226,6 +228,8 @@ yywrap (void)

     /*

      * Quite simple since ThinkJet bit arrangement matches PBM

      */

+

+    overflow2(maxRowLength, 8);

     pbm_writepbminit(stdout, maxRowLength*8, rowCount, 0);

     packed_bitrow = malloc(maxRowLength);

diff -up netpbm-10.58.01/converter/pbm/ybmtopbm.c.security-code netpbm-10.58.01/converter/pbm/ybmtopbm.c

--- netpbm-10.58.01/converter/pbm/ybmtopbm.c.security-code	2012-04-09 15:31:45.000000000 +0200

+++ netpbm-10.58.01/converter/pbm/ybmtopbm.c	2012-04-09 15:40:03.199619839 +0200

@@ -49,6 +49,7 @@ getinit(FILE *  const ifP,

         pm_error("EOF / read error");

     *depthP = 1;

+    overflow_add(*colsP, 15);

     *padrightP = ((*colsP + 15) / 16) * 16 - *colsP;

 }

diff -up netpbm-10.58.01/converter/pgm/lispmtopgm.c.security-code netpbm-10.58.01/converter/pgm/lispmtopgm.c

--- netpbm-10.58.01/converter/pgm/lispmtopgm.c.security-code	2012-04-09 15:31:42.000000000 +0200

+++ netpbm-10.58.01/converter/pgm/lispmtopgm.c	2012-04-09 15:40:03.199619839 +0200

@@ -58,6 +58,7 @@ main( argc, argv )

         pm_error( "depth (%d bits) is too large", depth);

     pgm_writepgminit( stdout, cols, rows, (gray) maxval, 0 );

+    overflow_add(cols, 7);

     grayrow = pgm_allocrow( ( cols + 7 ) / 8 * 8 );

     for ( row = 0; row < rows; ++row )

@@ -102,7 +103,9 @@ getinit( file, colsP, rowsP, depthP, pad

     if ( *depthP == 0 )

 	*depthP = 1;	/* very old file */

-    

+

+    overflow_add((int)colsP, 31);

+        

     *padrightP = ( ( *colsP + 31 ) / 32 ) * 32 - *colsP;

     if ( *colsP != (cols_32 - *padrightP) ) {

diff -up netpbm-10.58.01/converter/pgm/psidtopgm.c.security-code netpbm-10.58.01/converter/pgm/psidtopgm.c

--- netpbm-10.58.01/converter/pgm/psidtopgm.c.security-code	2012-04-09 15:31:42.000000000 +0200

+++ netpbm-10.58.01/converter/pgm/psidtopgm.c	2012-04-09 15:40:03.200619827 +0200

@@ -78,6 +78,7 @@ main(int     argc,

         pm_error("bits/sample (%d) is too large.", bitspersample);

     pgm_writepgminit(stdout, cols, rows, maxval, 0);

+    overflow_add(cols, 7);

     grayrow = pgm_allocrow((cols + 7) / 8 * 8);

     for (row = 0; row < rows; ++row) {

         unsigned int col;

diff -up netpbm-10.58.01/converter/ppm/ilbmtoppm.c.security-code netpbm-10.58.01/converter/ppm/ilbmtoppm.c

--- netpbm-10.58.01/converter/ppm/ilbmtoppm.c.security-code	2012-04-09 15:31:44.000000000 +0200

+++ netpbm-10.58.01/converter/ppm/ilbmtoppm.c	2012-04-09 15:40:03.201619815 +0200

@@ -592,6 +592,7 @@ decode_row(FILE *          const ifP,

     rawtype *chp;

     cols = bmhdP->w;

+    overflow_add(cols, 15);

     bytes = RowBytes(cols);

     for( plane = 0; plane < nPlanes; plane++ ) {

         int mask;

@@ -679,6 +680,23 @@ decode_mask(FILE *          const ifP,

  Multipalette handling

  ****************************************************************************/

+static void *

+xmalloc2(x, y)

+    int x;

+    int y;

+{

+    void *mem;

+

+    overflow2(x,y);

+    if( x * y == 0 )

+        return NULL;

+

+    mem = malloc2(x,y);

+    if( mem == NULL )

+        pm_error("out of memory allocating %d bytes", x * y);

+    return mem;

+}

+

 static void

 multi_adjust(cmap, row, palchange)

@@ -1341,6 +1359,9 @@ dcol_to_ppm(FILE *         const ifP,

     if( redmaxval != maxval || greenmaxval != maxval || bluemaxval != maxval )

         pm_message("scaling colors to %d bits", pm_maxvaltobits(maxval));

+    overflow_add(redmaxval, 1);

+    overflow_add(greenmaxval, 1);

+    overflow_add(bluemaxval, 1);

     MALLOCARRAY_NOFAIL(redtable,   redmaxval   +1);

     MALLOCARRAY_NOFAIL(greentable, greenmaxval +1);

     MALLOCARRAY_NOFAIL(bluetable,  bluemaxval  +1);

@@ -1763,7 +1784,9 @@ PCHG_ConvertSmall(PCHG, cmap, mask, data

             ChangeCount32 = *data++;

             datasize -= 2;

+            overflow_add(ChangeCount16, ChangeCount32);

             changes = ChangeCount16 + ChangeCount32;

+            overflow_add(changes, 1);

             for( i = 0; i < changes; i++ ) {

                 if( totalchanges >= PCHG->TotalChanges ) goto fail;

                 if( datasize < 2 ) goto fail;

@@ -2028,6 +2051,9 @@ read_pchg(FILE *     const ifp,

             cmap->mp_change[i] = NULL;

         if( PCHG.StartLine < 0 ) {

             int nch;

+            if(PCHG.MaxReg < PCHG.MinReg)

+                pm_error("assert: MinReg > MaxReg");

+            overflow_add(PCHG.MaxReg-PCHG.MinReg, 2);

             nch = PCHG.MaxReg - PCHG.MinReg +1;

             MALLOCARRAY_NOFAIL(cmap->mp_init, nch + 1);

             for( i = 0; i < nch; i++ )

@@ -2104,6 +2130,7 @@ process_body( FILE *          const ifp,

     if( typeid == ID_ILBM ) {

         int isdeep;

+        overflow_add(bmhdP->w, 15);

         MALLOCARRAY_NOFAIL(ilbmrow, RowBytes(bmhdP->w));

         *viewportmodesP |= fakeviewport;      /* -isham/-isehb */

diff -up netpbm-10.58.01/converter/ppm/imgtoppm.c.security-code netpbm-10.58.01/converter/ppm/imgtoppm.c

--- netpbm-10.58.01/converter/ppm/imgtoppm.c.security-code	2012-04-09 15:31:44.000000000 +0200

+++ netpbm-10.58.01/converter/ppm/imgtoppm.c	2012-04-09 15:40:03.202619802 +0200

@@ -84,6 +84,7 @@ main(int argc, char ** argv) {

             len = atoi((char*) buf );

             if ( fread( buf, len, 1, ifp ) != 1 )

                 pm_error( "bad colormap buf" );

+            overflow2(cmaplen, 3);

             if ( cmaplen * 3 != len )

             {

                 pm_message(

@@ -105,6 +106,7 @@ main(int argc, char ** argv) {

                 pm_error( "bad pixel data header" );

             buf[8] = '\0';

             len = atoi((char*) buf );

+            overflow2(cols, rows);

             if ( len != cols * rows )

                 pm_message(

                     "pixel data length (%d) does not match image size (%d)",

diff -up netpbm-10.58.01/converter/ppm/Makefile.security-code netpbm-10.58.01/converter/ppm/Makefile

--- netpbm-10.58.01/converter/ppm/Makefile.security-code	2012-04-09 15:31:44.000000000 +0200

+++ netpbm-10.58.01/converter/ppm/Makefile	2012-04-09 15:40:03.202619802 +0200

@@ -11,7 +11,7 @@ SUBDIRS = hpcdtoppm ppmtompeg

 PORTBINARIES =	411toppm eyuvtoppm gouldtoppm ilbmtoppm imgtoppm \

 		leaftoppm mtvtoppm neotoppm \

-		pcxtoppm pc1toppm pi1toppm picttoppm pjtoppm \

+		pcxtoppm pc1toppm pi1toppm pjtoppm \

 		ppmtoacad ppmtoapplevol ppmtoarbtxt ppmtoascii \

 		ppmtobmp ppmtoeyuv ppmtogif ppmtoicr ppmtoilbm \

 		ppmtoleaf ppmtolj ppmtomitsu ppmtoneo \

diff -up netpbm-10.58.01/converter/ppm/pcxtoppm.c.security-code netpbm-10.58.01/converter/ppm/pcxtoppm.c

--- netpbm-10.58.01/converter/ppm/pcxtoppm.c.security-code	2012-04-09 15:31:44.000000000 +0200

+++ netpbm-10.58.01/converter/ppm/pcxtoppm.c	2012-04-09 15:40:03.203619789 +0200

@@ -409,6 +409,7 @@ pcx_planes_to_pixels(pixels, bitplanes,

     /*

      * clear the pixel buffer

      */

+    overflow2(bytesperline, 8);

     npixels = (bytesperline * 8) / bitsperpixel;

     p    = pixels;

     while (--npixels >= 0)

@@ -470,6 +471,7 @@ pcx_16col_to_ppm(FILE *       const ifP,

     }

     /*  BytesPerLine should be >= BitsPerPixel * cols / 8  */

+    overflow2(BytesPerLine, 8);

     rawcols = BytesPerLine * 8 / BitsPerPixel;

     if (headerCols > rawcols) {

         pm_message("warning - BytesPerLine = %d, "

diff -up netpbm-10.58.01/converter/ppm/picttoppm.c.security-code netpbm-10.58.01/converter/ppm/picttoppm.c

--- netpbm-10.58.01/converter/ppm/picttoppm.c.security-code	2012-04-09 15:31:44.000000000 +0200

+++ netpbm-10.58.01/converter/ppm/picttoppm.c	2012-04-09 15:40:03.205619763 +0200

@@ -1,3 +1,5 @@

+#error "Unfixable. Don't ship me"

+

 /*

  * picttoppm.c -- convert a MacIntosh PICT file to PPM format.

  *

diff -up netpbm-10.58.01/converter/ppm/pjtoppm.c.security-code netpbm-10.58.01/converter/ppm/pjtoppm.c

--- netpbm-10.58.01/converter/ppm/pjtoppm.c.security-code	2012-04-09 15:31:44.000000000 +0200

+++ netpbm-10.58.01/converter/ppm/pjtoppm.c	2012-04-09 15:40:03.206619751 +0200

@@ -127,19 +127,21 @@ main(argc, argv)

                 case 'V':   /* send plane */

                 case 'W':   /* send last plane */

                     if (rows == -1 || r >= rows || image == NULL) {

-                        if (rows == -1 || r >= rows)

+                        if (rows == -1 || r >= rows) {

+                            overflow_add(rows, 100);

                             rows += 100;

+                        }

                         if (image == NULL) {

-                            MALLOCARRAY(image, rows * planes);

-                            MALLOCARRAY(imlen, rows * planes);

+                            image = (unsigned char **)

+                                malloc3(rows , planes , sizeof(unsigned char *));

+                            imlen = (int *) malloc3(rows , planes,  sizeof(int));

                         }

                         else {

+                            overflow2(rows,planes);

                             image = (unsigned char **) 

-                                realloc(image, 

-                                        rows * planes * 

+                                realloc2(image, rows * planes,

                                         sizeof(unsigned char *));

-                            imlen = (int *) 

-                                realloc(imlen, rows * planes * sizeof(int));

+                            imlen = (int *) realloc2(imlen, rows * planes, sizeof(int));

                         }

                     }

                     if (image == NULL || imlen == NULL)

@@ -212,8 +214,10 @@ main(argc, argv)

                 for (i = 0, c = 0; c < imlen[p + r * planes]; c += 2)

                     for (cmd = image[p + r * planes][c],

                              val = image[p + r * planes][c+1]; 

-                         cmd >= 0 && i < newcols; cmd--, i++) 

+                         cmd >= 0 && i < newcols; cmd--, i++) {

                         buf[i] = val;

+                        overflow_add(i, 1);

+                    }

                 cols = cols > i ? cols : i;

                 free(image[p + r * planes]);

                 /* 

@@ -224,6 +228,7 @@ main(argc, argv)

                 image[p + r * planes] = (unsigned char *) realloc(buf, i);

             }

         }

+        overflow2(cols, 8);

         cols *= 8;

     }

diff -up netpbm-10.58.01/converter/ppm/ppmtoeyuv.c.security-code netpbm-10.58.01/converter/ppm/ppmtoeyuv.c

--- netpbm-10.58.01/converter/ppm/ppmtoeyuv.c.security-code	2012-04-09 15:31:42.000000000 +0200

+++ netpbm-10.58.01/converter/ppm/ppmtoeyuv.c	2012-04-09 15:40:03.206619751 +0200

@@ -114,6 +114,7 @@ create_multiplication_tables(const pixva

     int index;

+    overflow_add(maxval, 1);

     MALLOCARRAY_NOFAIL(mult299   , maxval+1);

     MALLOCARRAY_NOFAIL(mult587   , maxval+1);

     MALLOCARRAY_NOFAIL(mult114   , maxval+1);