* xfaces.c (Fbitmap_spec_p): Fix integer overflow bug.

[bpt/emacs.git] / src / xfaces.c

diff --git a/src/xfaces.c b/src/xfaces.c
index c1e75ab..e0dc288 100644 (file)
--- a/src/xfaces.c
+++ b/src/xfaces.c
@@ -940,11 +940,13 @@ the pixmap.  Bits are stored row by row, each row occupies
            }
        }
 
-      if (NATNUMP (width) && NATNUMP (height) && STRINGP (data))
+      if (STRINGP (data)
+         && INTEGERP (width) && 0 < XINT (width)
+         && INTEGERP (height) && 0 < XINT (height))
        {
-         int bytes_per_row = ((XFASTINT (width) + BITS_PER_CHAR - 1)
-                              / BITS_PER_CHAR);
-         if (SBYTES (data) >= bytes_per_row * XINT (height))
+         EMACS_INT bytes_per_row = ((XINT (width) + BITS_PER_CHAR - 1)
+                                    / BITS_PER_CHAR);
+         if (XINT (height) <= SBYTES (data) / bytes_per_row)
            pixmap_p = 1;
        }
     }