* nsterm.h (struct ns_color_table.size, struct ns_color_table.avail):

Now ptrdiff_t, not int.
* nsterm.m (ns_index_color): Use ptrdiff_t, not int, for table indexes.
(ns_draw_fringe_bitmap): Rewrite to avoid overflow.

src/ChangeLog

 2011-07-29  Paul Eggert  <eggert@cs.ucla.edu>
 
+	* nsterm.h (struct ns_color_table.size, struct ns_color_table.avail):
+	Now ptrdiff_t, not int.
+	* nsterm.m (ns_index_color): Use ptrdiff_t, not int, for table indexes.
+	(ns_draw_fringe_bitmap): Rewrite to avoid overflow.
+
 	* minibuf.c (read_minibuf_noninteractive): Don't leak memory
 	on memory overflow.
 

src/nsterm.h

@@ -416,8 +416,8 @@ struct ns_bitmap_record
 /* this to map between emacs color indices and NSColor objects */
 struct ns_color_table
 {
-  unsigned int size;
-  unsigned int avail;
+  ptrdiff_t size;
+  ptrdiff_t avail;
 #ifdef __OBJC__
   NSColor **colors;
   NSMutableSet *empty_indices;

src/nsterm.m

@@ -1343,7 +1343,7 @@ Free a pool and temporary objects it refers to (callable from C)
 ns_index_color (NSColor *color, struct frame *f)
 {
   struct ns_color_table *color_table = FRAME_NS_DISPLAY_INFO (f)->color_table;
-  int idx;
+  ptrdiff_t idx;
   NSNumber *index;
 
   if (!color_table->colors)
@@ -1358,7 +1358,7 @@ Free a pool and temporary objects it refers to (callable from C)
 
   /* do we already have this color ? */
   {
-    int i;
+    ptrdiff_t i;
     for (i = 1; i < color_table->avail; i++)
       {
         if (color_table->colors[i] && [color_table->colors[i] isEqual: color])
@@ -1373,16 +1373,23 @@ Free a pool and temporary objects it refers to (callable from C)
     {
       index = [color_table->empty_indices anyObject];
       [color_table->empty_indices removeObject: index];
-      idx = [index unsignedIntValue];
+      idx = [index unsignedLongValue];
     }
   else
     {
       if (color_table->avail == color_table->size)
         {
-          color_table->size += NS_COLOR_CAPACITY;
+	  ptrdiff_t size;
+	  ptrdiff_t size_max =
+	    min (ULONG_MAX,
+		 min (PTRDIFF_MAX, SIZE_MAX) / sizeof (NSColor *));
+	  if (size_max - NS_COLOR_CAPACITY < color_table->size)
+	    memory_full (SIZE_MAX);
+	  size = color_table->size + NS_COLOR_CAPACITY;
           color_table->colors
 	    = (NSColor **)xrealloc (color_table->colors,
-				    color_table->size * sizeof (NSColor *));
+				    size * sizeof (NSColor *));
+	  color_table->size = size;
         }
       idx = color_table->avail++;
     }
@@ -2323,7 +2330,7 @@ Free a pool and temporary objects it refers to (callable from C)
       if (!img)
         {
           unsigned short *bits = p->bits + p->dh;
-          int len = 8 * p->h/8;
+          int len = p->h;
           int i;
           unsigned char *cbits = xmalloc (len);
 
@@ -4705,7 +4712,7 @@ most recently updated (I guess), which is not the correct one. */
         }
     }
 
-  
+
 #if !defined (NS_IMPL_COCOA) || MAC_OS_X_VERSION_MAX_ALLOWED < MAC_OS_X_VERSION_10_6
   /* if we get here we should send the key for input manager processing */
   if (firstTime && [[NSInputManager currentInputManager]