Add fz_calloc function to check for integer overflow when allocating arrays, and change the signature of fz_realloc to match.

1 files changed, 3 insertions, 3 deletions

diff --git a/fitz/obj_dict.c b/fitz/obj_dict.c
index 4b9fca41..f5d3f733 100644
--- a/fitz/obj_dict.c
+++ b/fitz/obj_dict.c
@@ -24,7 +24,7 @@ fz_newdict(int initialcap)
 	fz_obj *obj;
 	int i;
 
-	obj = fz_malloc(sizeof (fz_obj));
+	obj = fz_malloc(sizeof(fz_obj));
 	obj->refs = 1;
 	obj->kind = FZ_DICT;
 
@@ -32,7 +32,7 @@ fz_newdict(int initialcap)
 	obj->u.d.len = 0;
 	obj->u.d.cap = initialcap > 1 ? initialcap : 10;
 
-	obj->u.d.items = fz_malloc(sizeof(fz_keyval) * obj->u.d.cap);
+	obj->u.d.items = fz_calloc(obj->u.d.cap, sizeof(fz_keyval));
 	for (i = 0; i < obj->u.d.cap; i++)
 	{
 		obj->u.d.items[i].k = nil;
@@ -200,7 +200,7 @@ fz_dictput(fz_obj *obj, fz_obj *key, fz_obj *val)
 	if (obj->u.d.len + 1 > obj->u.d.cap)
 	{
 		obj->u.d.cap = (obj->u.d.cap * 3) / 2;
-		obj->u.d.items = fz_realloc(obj->u.d.items, sizeof(fz_keyval) * obj->u.d.cap);
+		obj->u.d.items = fz_realloc(obj->u.d.items, obj->u.d.cap, sizeof(fz_keyval));
 		for (i = obj->u.d.len; i < obj->u.d.cap; i++)
 		{
 			obj->u.d.items[i].k = nil;