Add fz_calloc function to check for integer overflow when allocating arrays, and change the signature of fz_realloc to match.

1 files changed, 1 insertions, 1 deletions

diff --git a/fitz/dev_text.c b/fitz/dev_text.c
index 2cd4ab11..806fa40c 100644
--- a/fitz/dev_text.c
+++ b/fitz/dev_text.c
@@ -70,7 +70,7 @@ fz_addtextcharimp(fz_textspan *span, int c, fz_bbox bbox)
 	if (span->len + 1 >= span->cap)
 	{
 		span->cap = span->cap > 1 ? (span->cap * 3) / 2 : 80;
-		span->text = fz_realloc(span->text, sizeof(fz_textchar) * span->cap);
+		span->text = fz_realloc(span->text, span->cap, sizeof(fz_textchar));
 	}
 	span->text[span->len].c = c;
 	span->text[span->len].bbox = bbox;