Add fz_calloc function to check for integer overflow when allocating arrays, and change the signature of fz_realloc to match.

2 files changed, 13 insertions, 13 deletions

diff --git a/apps/pdfclean.c b/apps/pdfclean.c
index fbea8fd4..8f51157a 100644
--- a/apps/pdfclean.c
+++ b/apps/pdfclean.c
@@ -241,7 +241,7 @@ static void renumberobjs(void)
 
 	/* Create new table for the reordered, compacted xref */
 	oldxref = xref->table;
-	xref->table = fz_malloc(xref->len * sizeof (pdf_xrefentry));
+	xref->table = fz_calloc(xref->len, sizeof(pdf_xrefentry));
 	xref->table[0] = oldxref[0];
 
 	/* Move used objects into the new compacted xref */
@@ -721,10 +721,10 @@ int main(int argc, char **argv)
 	fprintf(out, "%%PDF-%d.%d\n", xref->version / 10, xref->version % 10);
 	fprintf(out, "%%\316\274\341\277\246\n\n");
 
-	uselist = fz_malloc(sizeof (char) * (xref->len + 1));
-	ofslist = fz_malloc(sizeof (int) * (xref->len + 1));
-	genlist = fz_malloc(sizeof (int) * (xref->len + 1));
-	renumbermap = fz_malloc(sizeof (int) * (xref->len + 1));
+	uselist = fz_calloc(xref->len + 1, sizeof(char));
+	ofslist = fz_calloc(xref->len + 1, sizeof(int));
+	genlist = fz_calloc(xref->len + 1, sizeof(int));
+	renumbermap = fz_calloc(xref->len + 1, sizeof(int));
 
 	for (num = 0; num < xref->len; num++)
 	{
diff --git a/apps/pdfinfo.c b/apps/pdfinfo.c
index ddcabecb..e85ac00a 100644
--- a/apps/pdfinfo.c
+++ b/apps/pdfinfo.c
@@ -223,11 +223,11 @@ gatherdimensions(int page, fz_obj *pageref, fz_obj *pageobj)
 
 	dims++;
 
-	dim = fz_realloc(dim, dims * sizeof (struct info));
+	dim = fz_realloc(dim, dims, sizeof(struct info));
 	dim[dims - 1].page = page;
 	dim[dims - 1].pageref = pageref;
 	dim[dims - 1].pageobj = pageobj;
-	dim[dims - 1].u.dim.bbox = fz_malloc(sizeof (fz_rect));
+	dim[dims - 1].u.dim.bbox = fz_malloc(sizeof(fz_rect));
 	memcpy(dim[dims - 1].u.dim.bbox, &bbox, sizeof (fz_rect));
 
 	return;
@@ -267,7 +267,7 @@ gatherfonts(int page, fz_obj *pageref, fz_obj *pageobj, fz_obj *dict)
 
 		fonts++;
 
-		font = fz_realloc(font, fonts * sizeof (struct info));
+		font = fz_realloc(font, fonts, sizeof(struct info));
 		font[fonts - 1].page = page;
 		font[fonts - 1].pageref = pageref;
 		font[fonts - 1].pageobj = pageobj;
@@ -335,7 +335,7 @@ gatherimages(int page, fz_obj *pageref, fz_obj *pageobj, fz_obj *dict)
 
 		images++;
 
-		image = fz_realloc(image, images * sizeof (struct info));
+		image = fz_realloc(image, images, sizeof(struct info));
 		image[images - 1].page = page;
 		image[images - 1].pageref = pageref;
 		image[images - 1].pageobj = pageobj;
@@ -392,7 +392,7 @@ gatherforms(int page, fz_obj *pageref, fz_obj *pageobj, fz_obj *dict)
 
 		forms++;
 
-		form = fz_realloc(form, forms * sizeof (struct info));
+		form = fz_realloc(form, forms, sizeof(struct info));
 		form[forms - 1].page = page;
 		form[forms - 1].pageref = pageref;
 		form[forms - 1].pageobj = pageobj;
@@ -436,7 +436,7 @@ gatherpsobjs(int page, fz_obj *pageref, fz_obj *pageobj, fz_obj *dict)
 
 		psobjs++;
 
-		psobj = fz_realloc(psobj, psobjs * sizeof (struct info));
+		psobj = fz_realloc(psobj, psobjs, sizeof(struct info));
 		psobj[psobjs - 1].page = page;
 		psobj[psobjs - 1].pageref = pageref;
 		psobj[psobjs - 1].pageobj = pageobj;
@@ -478,7 +478,7 @@ gathershadings(int page, fz_obj *pageref, fz_obj *pageobj, fz_obj *dict)
 
 		shadings++;
 
-		shading = fz_realloc(shading, shadings * sizeof (struct info));
+		shading = fz_realloc(shading, shadings, sizeof(struct info));
 		shading[shadings - 1].page = page;
 		shading[shadings - 1].pageref = pageref;
 		shading[shadings - 1].pageobj = pageobj;
@@ -545,7 +545,7 @@ gatherpatterns(int page, fz_obj *pageref, fz_obj *pageobj, fz_obj *dict)
 
 		patterns++;
 
-		pattern = fz_realloc(pattern, patterns * sizeof (struct info));
+		pattern = fz_realloc(pattern, patterns, sizeof(struct info));
 		pattern[patterns - 1].page = page;
 		pattern[patterns - 1].pageref = pageref;
 		pattern[patterns - 1].pageobj = pageobj;