Merge 8ff61c9036 into 7c8e3338a1

caca/canvas.c

@@ -375,6 +375,13 @@ int caca_resize(caca_canvas_t *cv, int width, int height)
         return -1;
     }
     int new_size = width * height;
+    /* Check for overflow when multiplying by sizeof(uint32_t) on 32-bit
+     * systems */
+    if (new_size > 0 && (size_t)new_size > SIZE_MAX / sizeof(uint32_t))
+    {
+        seterrno(EOVERFLOW);
+        return -1;
+    }
 
     old_width = cv->width;
     old_height = cv->height;

caca/frame.c

@@ -147,6 +147,15 @@ int caca_create_frame(caca_canvas_t *cv, int id)
     int size = cv->width * cv->height;
     int f;
 
+
+    /* Check for overflow when multiplying by sizeof(uint32_t) on 32-bit
+     * systems */
+    if (size > 0 && (size_t)size > SIZE_MAX / sizeof(uint32_t))
+    {
+        seterrno(EOVERFLOW);
+        return -1;
+    }
+
     if(id < 0)
         id = 0;
     else if(id > cv->framecount)