fontconfig libX11 mesa xserver git update 4 Jan 2015

xserver          commit dc777c346d5d452a53b13b917c45f6a1bad2f20b
libX11           commit 446f5f7f41317a85a0cd0efa5e6a1b37bc99fba2
fontconfig       commit 4420b27c074821a1d1f9d6ebe822a610176a417d
mesa             commit 48094d0e6554a9df36bf00fc2793ade46cf92406

1 files changed, 7 insertions, 3 deletions

diff --git a/xorg-server/include/regionstr.h b/xorg-server/include/regionstr.h
index 515e93ffa..079375d33 100644
--- a/xorg-server/include/regionstr.h
+++ b/xorg-server/include/regionstr.h
@@ -127,7 +127,10 @@ RegionEnd(RegionPtr reg)
 static inline size_t
 RegionSizeof(size_t n)
 {
-    return (sizeof(RegDataRec) + ((n) * sizeof(BoxRec)));
+    if (n < ((INT_MAX - sizeof(RegDataRec)) / sizeof(BoxRec)))
+        return (sizeof(RegDataRec) + ((n) * sizeof(BoxRec)));
+    else
+        return 0;
 }
 
 static inline void
@@ -138,9 +141,10 @@ RegionInit(RegionPtr _pReg, BoxPtr _rect, int _size)
         (_pReg)->data = (RegDataPtr) NULL;
     }
     else {
+        size_t rgnSize;
         (_pReg)->extents = RegionEmptyBox;
-        if (((_size) > 1) && ((_pReg)->data =
-                              (RegDataPtr) malloc(RegionSizeof(_size)))) {
+        if (((_size) > 1) && ((rgnSize = RegionSizeof(_size)) > 0) &&
+            (((_pReg)->data = malloc(rgnSize)) != NULL)) {
             (_pReg)->data->size = (_size);
             (_pReg)->data->numRects = 0;
         }