4 files changed, 17 insertions, 15 deletions

diff --git a/libXfont/src/fontfile/bufio.c b/libXfont/src/fontfile/bufio.c
index 34b7f3665..d8d4f2964 100644
--- a/libXfont/src/fontfile/bufio.c
+++ b/libXfont/src/fontfile/bufio.c
@@ -162,8 +162,10 @@ BufFileOpenWrite (int fd)
     setmode(fd,O_BINARY);
 #endif
     f = BufFileCreate ((char *)(long) fd, 0, BufFileRawFlush, 0, BufFileFlush);
-    f->bufp = f->buffer;
-    f->left = BUFFILESIZE;
+    if (f != NULL) {
+	f->bufp = f->buffer;
+	f->left = BUFFILESIZE;
+    }
     return f;
 }
 
diff --git a/libXfont/src/fontfile/catalogue.c b/libXfont/src/fontfile/catalogue.c
index 75eb4e3a3..d5721ab68 100644
--- a/libXfont/src/fontfile/catalogue.c
+++ b/libXfont/src/fontfile/catalogue.c
@@ -290,7 +290,6 @@ CatalogueOpenFont (pointer client, FontPathElementPtr fpe, Mask flags,
 {
     CataloguePtr cat = fpe->private;
     FontPathElementPtr subfpe;
-    FontDirectoryPtr dir;
     int i, status;
 
     CatalogueRescan (fpe, FALSE);
@@ -298,7 +297,6 @@ CatalogueOpenFont (pointer client, FontPathElementPtr fpe, Mask flags,
     for (i = 0; i < cat->fpeCount; i++)
     {
 	subfpe = cat->fpeList[i];
-	dir = subfpe->private;
 	status = FontFileOpenFont(client, subfpe, flags,
 				  name, namelen, format, fmask, id,
 				  pFont, aliasName, non_cachable_font);
@@ -324,7 +322,6 @@ CatalogueListFonts (pointer client, FontPathElementPtr fpe, char *pat,
 {
     CataloguePtr cat = fpe->private;
     FontPathElementPtr subfpe;
-    FontDirectoryPtr dir;
     int i;
 
     CatalogueRescan (fpe, FALSE);
@@ -332,18 +329,12 @@ CatalogueListFonts (pointer client, FontPathElementPtr fpe, char *pat,
     for (i = 0; i < cat->fpeCount; i++)
     {
 	subfpe = cat->fpeList[i];
-	dir = subfpe->private;
 	FontFileListFonts(client, subfpe, pat, len, max, names);
     }
 
     return Successful;
 }
 
-int
-FontFileStartListFonts(pointer client, FontPathElementPtr fpe,
-		       char *pat, int len, int max,
-		       pointer *privatep, int mark_aliases);
-
 typedef struct _LFWIData {
     pointer		*privates;
     int			current;
diff --git a/libXfont/src/fontfile/dirfile.c b/libXfont/src/fontfile/dirfile.c
index c8aff6f4f..639310c31 100644
--- a/libXfont/src/fontfile/dirfile.c
+++ b/libXfont/src/fontfile/dirfile.c
@@ -42,6 +42,7 @@ in this Software without prior written authorization from The Open Group.
 #include <sys/types.h>
 #include <sys/stat.h>
 #include <errno.h>
+#include <limits.h>
 
 static Bool AddFileNameAliases ( FontDirectoryPtr dir );
 static int ReadFontAlias ( char *directory, Bool isFile,
@@ -90,7 +91,7 @@ FontFileReadDirectory (char *directory, FontDirectoryPtr *pdir)
     strcat(dir_file, FontDirFile);
     file = fopen(dir_file, "rt");
     if (file) {
-#ifndef WIN32        
+#ifndef WIN32
 	if (fstat (fileno(file), &statb) == -1)
 #else
 	if (stat (dir_file, &statb) == -1)
@@ -135,7 +136,7 @@ FontFileReadDirectory (char *directory, FontDirectoryPtr *pdir)
 	    FontFileAddFontFile (dir, font_name, file_name);
 	}
 	fclose(file);
-	
+
     } else if (errno != ENOENT) {
 	return BadFontPath;
     }
@@ -188,7 +189,7 @@ FontFileDirectoryChanged(FontDirectoryPtr dir)
 	return TRUE;
     return FALSE;
 }
-    
+
 /*
  * Make each of the file names an automatic alias for each of the files.
  */
@@ -212,7 +213,7 @@ AddFileNameAliases(FontDirectoryPtr dir)
 	renderer = FontFileMatchRenderer (fileName);
 	if (!renderer)
 	    continue;
-	
+
 	len = strlen (fileName) - renderer->fileSuffixLen;
 	if (len >= sizeof(copy))
 	    continue;
@@ -374,6 +375,9 @@ lexAlias(FILE *file, char **lexToken)
 	    int         nsize;
 	    char       *nbuf;
 
+	    if (tokenSize >= (INT_MAX >> 2))
+		/* Stop before we overflow */
+		return EALLOC;
 	    nsize = tokenSize ? (tokenSize << 1) : 64;
 	    nbuf = realloc(tokenBuf, nsize);
 	    if (!nbuf)
diff --git a/libXfont/src/fontfile/fontdir.c b/libXfont/src/fontfile/fontdir.c
index 13cda0a37..a4d41960b 100644
--- a/libXfont/src/fontfile/fontdir.c
+++ b/libXfont/src/fontfile/fontdir.c
@@ -179,6 +179,11 @@ FontFileAddEntry(FontTablePtr table, FontEntryPtr prototype)
     if (table->sorted)
 	return (FontEntryPtr) 0;    /* "cannot" happen */
     if (table->used == table->size) {
+	if (table->size >= ((INT32_MAX / sizeof(FontEntryRec)) - 100))
+	    /* If we've read so many entries we're going to ask for 2gb
+	       or more of memory, something is so wrong with this font
+	       directory that we should just give up before we overflow. */
+	    return NULL;
 	newsize = table->size + 100;
 	entry = realloc(table->entries, newsize * sizeof(FontEntryRec));
 	if (!entry)