X-Git-Url: https://ncurses.scripts.mit.edu/?p=ncurses.git;a=blobdiff_plain;f=ncurses%2Ftinfo%2Fread_entry.c;h=47852ad1dcc3015451e306dea15200f0b5cfcc21;hp=c8aae6009242860fbd470b634e6cb5bb5f36efb0;hb=8554ac8f8bb70116fbc962f529168d273e950e2b;hpb=8b06e371ed1bce3dd6f37138e6becb5e1a562fe0

diff --git a/ncurses/tinfo/read_entry.c b/ncurses/tinfo/read_entry.c
index c8aae600..47852ad1 100644
--- a/ncurses/tinfo/read_entry.c
+++ b/ncurses/tinfo/read_entry.c
@@ -41,7 +41,7 @@
 
 #include <tic.h>
 
-MODULE_ID("$Id: read_entry.c,v 1.119 2012/02/22 22:40:24 tom Exp $")
+MODULE_ID("$Id: read_entry.c,v 1.121 2012/11/18 01:18:47 tom Exp $")
 
 #define TYPE_CALLOC(type,elts) typeCalloc(type, (unsigned)(elts))
 
@@ -252,9 +252,9 @@ _nc_read_termtype(TERMTYPE *ptr, char *buffer, int limit)
 	ptr->num_Numbers = UShort(NUMCOUNT + ext_num_count);
 	ptr->num_Strings = UShort(STRCOUNT + ext_str_count);
 
-	ptr->Booleans = typeRealloc(NCURSES_SBOOL, ptr->num_Booleans, ptr->Booleans);
-	ptr->Numbers = typeRealloc(short, ptr->num_Numbers, ptr->Numbers);
-	ptr->Strings = typeRealloc(char *, ptr->num_Strings, ptr->Strings);
+	TYPE_REALLOC(NCURSES_SBOOL, ptr->num_Booleans, ptr->Booleans);
+	TYPE_REALLOC(short, ptr->num_Numbers, ptr->Numbers);
+	TYPE_REALLOC(char *, ptr->num_Strings, ptr->Strings);
 
 	TR(TRACE_DATABASE, ("extended header is %d/%d/%d(%d:%d)",
 			    ext_bool_count, ext_num_count, ext_str_count,
@@ -279,6 +279,8 @@ _nc_read_termtype(TERMTYPE *ptr, char *buffer, int limit)
 	}
 
 	TR(TRACE_DATABASE, ("READ extended-offsets @%d", offset));
+	if ((unsigned) (ext_str_count + (int) need) >= (MAX_ENTRY_SIZE / 2))
+	    return (TGETENT_NO);
 	if ((ext_str_count || need)
 	    && !read_shorts(buf, ext_str_count + (int) need))
 	    return (TGETENT_NO);
@@ -315,7 +317,7 @@ _nc_read_termtype(TERMTYPE *ptr, char *buffer, int limit)
 	}
 
 	if (need) {
-	    if (ext_str_count >= (MAX_ENTRY_SIZE * 2))
+	    if (ext_str_count >= (MAX_ENTRY_SIZE / 2))
 		return (TGETENT_NO);
 	    if ((ptr->ext_Names = TYPE_CALLOC(char *, need)) == 0)
 		  return (TGETENT_NO);