* image.c (cache_image): Check for size arithmetic overflow.

src/ChangeLog

@@ -1,3 +1,7 @@
+2011-06-23  Paul Eggert  <eggert@cs.ucla.edu>
+
+	* image.c (cache_image): Check for size arithmetic overflow.
+
 2011-06-22  Paul Eggert  <eggert@cs.ucla.edu>
 
 	* lread.c: Integer overflow issues.

src/image.c

@@ -1836,6 +1836,8 @@ cache_image (struct frame *f, struct image *img)
   /* If no free slot found, maybe enlarge c->images.  */
   if (i == c->used && c->used == c->size)
     {
+      if (min (PTRDIFF_MAX, SIZE_MAX) / sizeof *c->images / 2 < c->size)
+	memory_full (SIZE_MAX);
       c->size *= 2;
       c->images = (struct image **) xrealloc (c->images,
 					      c->size * sizeof *c->images);