***************
*** 335,340 ****
      char **defaults;
      int ErrorStatus;
  
      colorTable = (XpmColor *) XpmCalloc(ncolors, sizeof(XpmColor));
      if (!colorTable)
  	return (XpmNoMemory);
--- 335,342 ----
      char **defaults;
      int ErrorStatus;
  
+     if (ncolors > INT_MAX/sizeof(XpmColor))
+ 	return (XpmNoMemory);
      colorTable = (XpmColor *) XpmCalloc(ncolors, sizeof(XpmColor));
      if (!colorTable)
  	return (XpmNoMemory);
***************
*** 346,351 ****
  	    /*
  	     * read pixel value
  	     */
  	    color->string = (char *) XpmMalloc(cpp + 1);
  	    if (!color->string) {
  		xpmFreeColorTable(colorTable, ncolors);
--- 348,355 ----
  	    /*
  	     * read pixel value
  	     */
+ 	    if (cpp > INT_MAX-1)
+ 		return (XpmNoMemory);
  	    color->string = (char *) XpmMalloc(cpp + 1);
  	    if (!color->string) {
  		xpmFreeColorTable(colorTable, ncolors);
***************
*** 428,433 ****
  	    /*
  	     * read pixel value
  	     */
  	    color->string = (char *) XpmMalloc(cpp + 1);
  	    if (!color->string) {
  		xpmFreeColorTable(colorTable, ncolors);
--- 432,439 ----
  	    /*
  	     * read pixel value
  	     */
+ 	    if (cpp > INT_MAX-1)
+ 		return (XpmNoMemory);
  	    color->string = (char *) XpmMalloc(cpp + 1);
  	    if (!color->string) {
  		xpmFreeColorTable(colorTable, ncolors);
***************
*** 490,495 ****
      unsigned int *iptr, *iptr2;
      unsigned int a, x, y;
  
  #ifndef FOR_MSW
      iptr2 = (unsigned int *) XpmMalloc(sizeof(unsigned int) * width * height);
  #else
--- 496,503 ----
      unsigned int *iptr, *iptr2;
      unsigned int a, x, y;
  
+     if (height != 0 && width > INT_MAX/sizeof(unsigned int))
+ 	return (XpmNoMemory);
  #ifndef FOR_MSW
      iptr2 = (unsigned int *) XpmMalloc(sizeof(unsigned int) * width * height);
  #else
***************
*** 543,549 ****
  
  	    /* array of pointers malloced by need */
  	    unsigned short *cidx[256];
- 	    int char1;
  
  	    bzero((char *)cidx, 256 * sizeof(unsigned short *)); /* init */
  	    for (a = 0; a < ncolors; a++) {
--- 551,557 ----
  
  	    /* array of pointers malloced by need */
  	    unsigned short *cidx[256];
+ 	    unsigned int char1;
  
  	    bzero((char *)cidx, 256 * sizeof(unsigned short *)); /* init */
  	    for (a = 0; a < ncolors; a++) {