3 files changed, 17 insertions, 13 deletions
diff --git a/core/src/fxge/dib/fx_dib_composite.cpp b/core/src/fxge/dib/fx_dib_composite.cpp
index 375b7c110e..ae72fc5a43 100644
--- a/core/src/fxge/dib/fx_dib_composite.cpp
+++ b/core/src/fxge/dib/fx_dib_composite.cpp
@@ -4148,15 +4148,7 @@ FX_BOOL CFX_DIBitmap::CompositeBitmap(int dest_left, int dest_top, int width, in
     }
     int dest_Bpp = m_bpp / 8;
     int src_Bpp = pSrcBitmap->GetBPP() / 8;
-    FX_BOOL bRgb = FALSE;
-    FX_BOOL bCmyk = FALSE;
-    if (src_Bpp > 1) {
-        if (pSrcBitmap->IsCmykImage()) {
-            bCmyk = TRUE;
-        } else {
-            bRgb = TRUE;
-        }
-    }
+    FX_BOOL bRgb = src_Bpp > 1 && !pSrcBitmap->IsCmykImage();
     CFX_DIBitmap* pSrcAlphaMask = pSrcBitmap->m_pAlphaMask;
     for (int row = 0; row < height; row ++) {
         FX_LPBYTE dest_scan = m_pBuffer + (dest_top + row) * m_Pitch + dest_left * dest_Bpp;
diff --git a/core/src/fxge/dib/fx_dib_transform.cpp b/core/src/fxge/dib/fx_dib_transform.cpp
index 457fe2e1f1..4544506e7b 100644
--- a/core/src/fxge/dib/fx_dib_transform.cpp
+++ b/core/src/fxge/dib/fx_dib_transform.cpp
@@ -70,7 +70,6 @@ CFX_DIBitmap* CFX_DIBSource::SwapXY(FX_BOOL bXFlip, FX_BOOL bYFlip, const FX_REC
         return NULL;
     }
     pTransBitmap->CopyPalette(m_pPalette);
-    int src_pitch = m_Pitch;
     int dest_pitch = pTransBitmap->GetPitch();
     FX_LPBYTE dest_buf = pTransBitmap->GetBuffer();
     int row_start = bXFlip ? m_Height - dest_clip.right : dest_clip.left;
@@ -130,7 +129,6 @@ CFX_DIBitmap* CFX_DIBSource::SwapXY(FX_BOOL bXFlip, FX_BOOL bYFlip, const FX_REC
         }
     }
     if (m_pAlphaMask) {
-        src_pitch = m_pAlphaMask->m_Pitch;
         dest_pitch = pTransBitmap->m_pAlphaMask->GetPitch();
         dest_buf = pTransBitmap->m_pAlphaMask->GetBuffer();
         int dest_step = bYFlip ? -dest_pitch : dest_pitch;
diff --git a/core/src/fxge/ge/fx_ge_fontmap.cpp b/core/src/fxge/ge/fx_ge_fontmap.cpp
index 43b971ffc3..0596c12f4c 100644
--- a/core/src/fxge/ge/fx_ge_fontmap.cpp
+++ b/core/src/fxge/ge/fx_ge_fontmap.cpp
@@ -1367,14 +1367,28 @@ void CFX_FolderFontInfo::ScanFile(CFX_ByteString& path)
     FX_BYTE buffer[16];
     FXSYS_fseek(pFile, 0, FXSYS_SEEK_SET);
     size_t readCnt = FXSYS_fread(buffer, 12, 1, pFile);
+    if (readCnt != 12) {
+        FXSYS_fclose(pFile);
+        return;
+    }
+
     if (GET_TT_LONG(buffer) == 0x74746366) {
         FX_DWORD nFaces = GET_TT_LONG(buffer + 8);
-        FX_LPBYTE offsets = FX_Alloc(FX_BYTE, nFaces * 4);
+        if (nFaces > FX_DWORD_MAX / 4) {
+            FXSYS_fclose(pFile);
+            return;
+        }
+        FX_DWORD face_bytes = nFaces * 4;
+        FX_LPBYTE offsets = FX_Alloc(FX_BYTE, face_bytes);
         if (!offsets) {
             FXSYS_fclose(pFile);
             return;
         }
-        readCnt = FXSYS_fread(offsets, nFaces * 4, 1, pFile);
+        readCnt = FXSYS_fread(offsets, face_bytes, 1, pFile);
+        if (readCnt != face_bytes) {
+            FXSYS_fclose(pFile);
+            return;
+        }
         for (FX_DWORD i = 0; i < nFaces; i ++) {
             FX_LPBYTE p = offsets + i * 4;
             ReportFace(path, pFile, filesize, GET_TT_LONG(p));