From 9f1423f91fe487a5c804e4b1719114f76684f6f0 Mon Sep 17 00:00:00 2001
From: Andrey Kiselev <dron@ak4719.spb.edu>
Date: Fri, 24 Sep 2004 08:10:18 +0000
Subject: [PATCH] More overflow fixes from Dmitry V. Levin.

---
 libtiff/tif_dirread.c | 6 +++---
 libtiff/tiffiop.h     | 7 ++++---
 2 files changed, 7 insertions(+), 6 deletions(-)

diff --git a/libtiff/tif_dirread.c b/libtiff/tif_dirread.c
index 7bd2e1b7..9da4f3ab 100644
--- a/libtiff/tif_dirread.c
+++ b/libtiff/tif_dirread.c
@@ -1,4 +1,4 @@
-/* $Id: tif_dirread.c,v 1.38 2004-09-23 08:58:11 dron Exp $ */
+/* $Id: tif_dirread.c,v 1.39 2004-09-24 08:10:18 dron Exp $ */
 
 /*
  * Copyright (c) 1988-1997 Sam Leffler
@@ -64,8 +64,8 @@ static	void ChopUpSingleUncompressedStrip(TIFF*);
 static char *
 CheckMalloc(TIFF* tif, size_t nmemb, size_t elem_size, const char* what)
 {
-	char *cp = NULL;
-	size_t bytes = nmemb * elem_size;
+	char	*cp = NULL;
+	tsize_t	bytes = nmemb * elem_size;
 
 	/*
 	 * XXX: Check for integer overflow.
diff --git a/libtiff/tiffiop.h b/libtiff/tiffiop.h
index 0f314cb9..2cf02d00 100644
--- a/libtiff/tiffiop.h
+++ b/libtiff/tiffiop.h
@@ -1,4 +1,4 @@
-/* $Id: tiffiop.h,v 1.26 2004-09-22 13:48:20 dron Exp $ */
+/* $Id: tiffiop.h,v 1.27 2004-09-24 08:10:18 dron Exp $ */
 
 /*
  * Copyright (c) 1988-1997 Sam Leffler
@@ -206,8 +206,9 @@ struct tiff {
 	(TIFFWriteFile(tif, (tdata_t) buf, (tsize_t) size) == (tsize_t) size)
 #endif
 
-#define	TIFFhowmany(x, y) (((x)+((y)-1))/(y))
-#define TIFFhowmany8(x) (((x)&0x07)?((x)>>3)+1:(x)>>3)
+/* NB: the uint32 casts are to silence certain ANSI-C compilers */
+#define TIFFhowmany(x, y) ((((uint32)(x))+(((uint32)(y))-1))/((uint32)(y)))
+#define TIFFhowmany8(x) (((x)&0x07)?((uint32)(x)>>3)+1:(uint32)(x)>>3)
 #define	TIFFroundup(x, y) (TIFFhowmany(x,y)*(y))
 
 #define TIFFmax(A,B) ((A)>(B)?(A):(B))