$NetBSD: patch-aq,v 1.1.2.2 2006/01/23 10:35:16 salo Exp $

--- xpdf/JPXStream.cc.orig	2006-01-22 22:52:51.000000000 +0000
+++ xpdf/JPXStream.cc	2006-01-22 22:48:31.000000000 +0000
@@ -7,6 +7,7 @@
 //========================================================================
 
 #include <aconf.h>
+#include <limits.h>
 
 #ifdef USE_GCC_PRAGMAS
 #pragma implementation
@@ -818,13 +819,15 @@
 	            / img.xTileSize;
       img.nYTiles = (img.ySize - img.yTileOffset + img.yTileSize - 1)
 	            / img.yTileSize;
-      nTiles = img.nXTiles * img.nYTiles;
       // check for overflow before allocating memory
-      if (nTiles == 0 || nTiles / img.nXTiles != img.nYTiles) {
-	error(getPos(), "Bad tile count in JPX SIZ marker segment");
-	return gFalse;
+      if (img.nXTiles <= 0 || img.nYTiles <= 0 || 
+              img.nXTiles >= INT_MAX/img.nYTiles) {
+          error(getPos(), "Bad tile count in JPX SIZ marker segment");
+          return gFalse;
       }
+      nTiles = img.nXTiles * img.nYTiles;
       img.tiles = (JPXTile *)gmallocn(nTiles, sizeof(JPXTile));
+
       for (i = 0; i < img.nXTiles * img.nYTiles; ++i) {
 	img.tiles[i].tileComps = (JPXTileComp *)gmallocn(img.nComps,
 							 sizeof(JPXTileComp));
