8 files changed, 35 insertions, 1040 deletions

diff --git a/print/ghostscript8/Makefile b/print/ghostscript8/Makefile
index 4c2b2bd2105a..778d36aa1f53 100644
--- a/print/ghostscript8/Makefile
+++ b/print/ghostscript8/Makefile
@@ -6,8 +6,7 @@
 #
 
 PORTNAME=	ghostscript8
-PORTVERSION=	8.64
-PORTREVISION=	7
+PORTVERSION=	8.70
 CATEGORIES=	print
 MASTER_SITES=	SF/ghostscript/GPL%20Ghostscript/${PORTVERSION}:gs_srcs \
 		ftp://mirror.cs.wisc.edu/pub/mirrors/ghost/GPL/gs${PORTVERSION:S/.//}/:gs_srcs \
diff --git a/print/ghostscript8/Makefile.drivers b/print/ghostscript8/Makefile.drivers
index 55346e086502..962992bcd72d 100644
--- a/print/ghostscript8/Makefile.drivers
+++ b/print/ghostscript8/Makefile.drivers
@@ -122,6 +122,8 @@ GS_lp8500c	"D: Epson LP-8500C color laser printer"	${OPTIONS_GS_DEFAULT_ON} \
 GS_lp3000c	"D: Epson LP-3000C color laser printer"	${OPTIONS_GS_DEFAULT_ON} \
 GS_lp8200c	"D: Epson LP-8200C color laser printer"	${OPTIONS_GS_DEFAULT_ON} \
 GS_lp8000c	"D: Epson LP-8000C color laser printer"	${OPTIONS_GS_DEFAULT_ON} \
+GS_eplmono	"D: Epson Esc/Page Generic driver, mono"	${OPTIONS_GS_DEFAULT_ON} \
+GS_eplcolor	"D: Epson Esc/Page Generic driver, color"	${OPTIONS_GS_DEFAULT_ON} \
 GS_epl6100	"D: Epson EPL-6100 laser printer"	${OPTIONS_GS_DEFAULT_ON} \
 GS_epl5900	"D: Epson EPL-5900 laser printer"	${OPTIONS_GS_DEFAULT_ON} \
 GS_epl5800	"D: Epson EPL-5800 laser printer"	${OPTIONS_GS_DEFAULT_ON} \
@@ -163,6 +165,7 @@ GS_photoex	"D: Epson Stylus Color Photo/Photo EX/Photo 700"	${OPTIONS_GS_DEFAULT
 GS_fmlbp	"D: Fujitsu contrib2xx Page Printer"	${OPTIONS_GS_DEFAULT_ON} \
 GS_fmpr		"D: Fujitsu contrib"	${OPTIONS_GS_DEFAULT_ON} \
 GS_lp2563	"D: HP 2563B line printer"	${OPTIONS_GS_DEFAULT_ON} \
+GS_cdnj500	"D: HP DesignJet 500"	${OPTIONS_GS_DEFAULT_ON} \
 GS_dnj650c	"D: HP DesignJet 650C"	${OPTIONS_GS_DEFAULT_ON} \
 GS_deskjet	"D: HP DeskJet and DeskJet Plus"	${OPTIONS_GS_DEFAULT_ON} \
 GS_djet500	"D: HP DeskJet 500 (for DeskJet 600 use -r600)"	${OPTIONS_GS_DEFAULT_ON} \
diff --git a/print/ghostscript8/distinfo b/print/ghostscript8/distinfo
index dd4f8868889e..2d73fde4f430 100644
--- a/print/ghostscript8/distinfo
+++ b/print/ghostscript8/distinfo
@@ -1,6 +1,6 @@
-MD5 (ghostscript/ghostscript-8.64.tar.bz2) = b13289cb2115f38f40c5e064f87e228a
-SHA256 (ghostscript/ghostscript-8.64.tar.bz2) = 012f7fec58480c728580836fec6f865588d8a33fe8ada7ae73b1f971440d02bb
-SIZE (ghostscript/ghostscript-8.64.tar.bz2) = 16921504
+MD5 (ghostscript/ghostscript-8.70.tar.bz2) = 526366f8cb4fda0d3d293597cc5b984b
+SHA256 (ghostscript/ghostscript-8.70.tar.bz2) = c889f2a3a27a4dbd3519197ffc0170d66f398da6a8252b2ebe0548d250f4acc8
+SIZE (ghostscript/ghostscript-8.70.tar.bz2) = 17019673
 MD5 (ghostscript/epag-3.09.tar.gz) = 63304a6afe44842124d2d880bf24dbe3
 SHA256 (ghostscript/epag-3.09.tar.gz) = ad10eca44c781a5851d5a8993dcd95b2e2b99392cbf2c8372a5a658f3b991b3b
 SIZE (ghostscript/epag-3.09.tar.gz) = 12858
diff --git a/print/ghostscript8/files/patch-CVE-2009-0583,0584 b/print/ghostscript8/files/patch-CVE-2009-0583,0584
deleted file mode 100644
index 71505e257c72..000000000000
--- a/print/ghostscript8/files/patch-CVE-2009-0583,0584
+++ /dev/null
@@ -1,989 +0,0 @@
---- icclib/icc.c.CVE-2009-0583,0584	2008-05-09 05:12:01.000000000 +0100
-+++ icclib/icc.c	2009-03-06 15:24:33.000000000 +0000
-@@ -152,6 +152,8 @@
-  *      Various bug fixes and enhancements.
-  */
- 
-+#include <limits.h>
-+#include <stdint.h>
- #include <stdio.h>
- #include <stdlib.h>
- #include <stdarg.h>
-@@ -313,8 +315,11 @@ size_t count
- 	icmFileMem *p = (icmFileMem *)pp;
- 	size_t len;
- 
-+	if (count > 0 && size > SIZE_MAX / count)
-+		return 0;
-+
- 	len = size * count;
--	if ((p->cur + len) >= p->end) {		/* Too much */
-+	if (len > (p->end - p->cur)) { /* Too much */
- 		if (size > 0)
- 			count = (p->end - p->cur)/size;
- 		else
-@@ -1634,6 +1639,8 @@ static int icmUInt8Array_write(
- 
- 	/* Allocate a file write buffer */
- 	len = p->get_size((icmBase *)p);
-+	if (icp->errc)
-+		return icp->errc;
- 	if ((buf = (char *) icp->al->malloc(icp->al, len)) == NULL) {
- 		sprintf(icp->err,"icmUInt8Array_write malloc() failed");
- 		return icp->errc = 2;
-@@ -1698,7 +1705,7 @@ static int icmUInt8Array_allocate(
- 	if (p->size != p->_size) {
- 		if (p->data != NULL)
- 			icp->al->free(icp->al, p->data);
--		if ((p->data = (unsigned int *) icp->al->malloc(icp->al, p->size * sizeof(unsigned int))) == NULL) {
-+		if ((p->data = (unsigned int *) icp->al->calloc(icp->al, p->size, sizeof(unsigned int))) == NULL) {
- 			sprintf(icp->err,"icmUInt8Array_alloc: malloc() of icmUInt8Array data failed");
- 			return icp->errc = 2;
- 		}
-@@ -1749,6 +1756,10 @@ static unsigned int icmUInt16Array_get_s
- 	icmUInt16Array *p = (icmUInt16Array *)pp;
- 	unsigned int len = 0;
- 	len += 8;			/* 8 bytes for tag and padding */
-+	if (p->size > (UINT_MAX - len) / 2) {
-+		p->icp->errc = 1;
-+		return (unsigned int) -1;
-+	}
- 	len += p->size * 2;	/* 2 bytes for each UInt16 */
- 	return len;
- }
-@@ -1821,6 +1832,8 @@ static int icmUInt16Array_write(
- 
- 	/* Allocate a file write buffer */
- 	len = p->get_size((icmBase *)p);
-+	if (icp->errc)
-+		return icp->errc;
- 	if ((buf = (char *) icp->al->malloc(icp->al, len)) == NULL) {
- 		sprintf(icp->err,"icmUInt16Array_write malloc() failed");
- 		return icp->errc = 2;
-@@ -1885,7 +1898,7 @@ static int icmUInt16Array_allocate(
- 	if (p->size != p->_size) {
- 		if (p->data != NULL)
- 			icp->al->free(icp->al, p->data);
--		if ((p->data = (unsigned int *) icp->al->malloc(icp->al, p->size * sizeof(unsigned int))) == NULL) {
-+		if ((p->data = (unsigned int *) icp->al->calloc(icp->al, p->size, sizeof(unsigned int))) == NULL) {
- 			sprintf(icp->err,"icmUInt16Array_alloc: malloc() of icmUInt16Array data failed");
- 			return icp->errc = 2;
- 		}
-@@ -1936,6 +1949,10 @@ static unsigned int icmUInt32Array_get_s
- 	icmUInt32Array *p = (icmUInt32Array *)pp;
- 	unsigned int len = 0;
- 	len += 8;			/* 8 bytes for tag and padding */
-+	if (p->size > (UINT_MAX - len) / 4) {
-+		p->icp->errc = 1;
-+		return (unsigned int) -1;
-+	}
- 	len += p->size * 4;	/* 4 bytes for each UInt32 */
- 	return len;
- }
-@@ -2008,6 +2025,8 @@ static int icmUInt32Array_write(
- 
- 	/* Allocate a file write buffer */
- 	len = p->get_size((icmBase *)p);
-+	if (icp->errc)
-+		return icp->errc;
- 	if ((buf = (char *) icp->al->malloc(icp->al, len)) == NULL) {
- 		sprintf(icp->err,"icmUInt32Array_write malloc() failed");
- 		return icp->errc = 2;
-@@ -2072,7 +2091,7 @@ static int icmUInt32Array_allocate(
- 	if (p->size != p->_size) {
- 		if (p->data != NULL)
- 			icp->al->free(icp->al, p->data);
--		if ((p->data = (unsigned int *) icp->al->malloc(icp->al, p->size * sizeof(unsigned int))) == NULL) {
-+		if ((p->data = (unsigned int *) icp->al->calloc(icp->al, p->size, sizeof(unsigned int))) == NULL) {
- 			sprintf(icp->err,"icmUInt32Array_alloc: malloc() of icmUInt32Array data failed");
- 			return icp->errc = 2;
- 		}
-@@ -2123,6 +2142,10 @@ static unsigned int icmUInt64Array_get_s
- 	icmUInt64Array *p = (icmUInt64Array *)pp;
- 	unsigned int len = 0;
- 	len += 8;			/* 8 bytes for tag and padding */
-+	if (p->size > (UINT_MAX - len) / 8) {
-+		p->icp->errc = 1;
-+		return (unsigned int) -1;
-+	}
- 	len += p->size * 8;	/* 8 bytes for each UInt64 */
- 	return len;
- }
-@@ -2195,6 +2218,8 @@ static int icmUInt64Array_write(
- 
- 	/* Allocate a file write buffer */
- 	len = p->get_size((icmBase *)p);
-+	if (icp->errc)
-+		return icp->errc;
- 	if ((buf = (char *) icp->al->malloc(icp->al, len)) == NULL) {
- 		sprintf(icp->err,"icmUInt64Array_write malloc() failed");
- 		return icp->errc = 2;
-@@ -2259,7 +2284,7 @@ static int icmUInt64Array_allocate(
- 	if (p->size != p->_size) {
- 		if (p->data != NULL)
- 			icp->al->free(icp->al, p->data);
--		if ((p->data = (icmUint64 *) icp->al->malloc(icp->al, p->size * sizeof(icmUint64))) == NULL) {
-+		if ((p->data = (icmUint64 *) icp->al->calloc(icp->al, p->size, sizeof(icmUint64))) == NULL) {
- 			sprintf(icp->err,"icmUInt64Array_alloc: malloc() of icmUInt64Array data failed");
- 			return icp->errc = 2;
- 		}
-@@ -2310,6 +2335,10 @@ static unsigned int icmU16Fixed16Array_g
- 	icmU16Fixed16Array *p = (icmU16Fixed16Array *)pp;
- 	unsigned int len = 0;
- 	len += 8;			/* 8 bytes for tag and padding */
-+	if (p->size > (UINT_MAX - len) / 4) {
-+		p->icp->errc = 1;
-+		return (unsigned int) -1;
-+	}
- 	len += p->size * 4;	/* 4 byte for each U16Fixed16 */
- 	return len;
- }
-@@ -2382,6 +2411,8 @@ static int icmU16Fixed16Array_write(
- 
- 	/* Allocate a file write buffer */
- 	len = p->get_size((icmBase *)p);
-+	if (icp->errc)
-+		return icp->errc;
- 	if ((buf = (char *) icp->al->malloc(icp->al, len)) == NULL) {
- 		sprintf(icp->err,"icmU16Fixed16Array_write malloc() failed");
- 		return icp->errc = 2;
-@@ -2446,7 +2477,7 @@ static int icmU16Fixed16Array_allocate(
- 	if (p->size != p->_size) {
- 		if (p->data != NULL)
- 			icp->al->free(icp->al, p->data);
--		if ((p->data = (double *) icp->al->malloc(icp->al, p->size * sizeof(double))) == NULL) {
-+		if ((p->data = (double *) icp->al->calloc(icp->al, p->size, sizeof(double))) == NULL) {
- 			sprintf(icp->err,"icmU16Fixed16Array_alloc: malloc() of icmU16Fixed16Array data failed");
- 			return icp->errc = 2;
- 		}
-@@ -2497,6 +2528,10 @@ static unsigned int icmS15Fixed16Array_g
- 	icmS15Fixed16Array *p = (icmS15Fixed16Array *)pp;
- 	unsigned int len = 0;
- 	len += 8;			/* 8 bytes for tag and padding */
-+	if (p->size > (UINT_MAX - len) / 4) {
-+		p->icp->errc = 1;
-+		return (unsigned int) - 1;
-+	}
- 	len += p->size * 4;	/* 4 byte for each S15Fixed16 */
- 	return len;
- }
-@@ -2569,6 +2604,8 @@ static int icmS15Fixed16Array_write(
- 
- 	/* Allocate a file write buffer */
- 	len = p->get_size((icmBase *)p);
-+	if (icp->errc)
-+		return icp->errc;
- 	if ((buf = (char *) icp->al->malloc(icp->al, len)) == NULL) {
- 		sprintf(icp->err,"icmS15Fixed16Array_write malloc() failed");
- 		return icp->errc = 2;
-@@ -2633,7 +2670,7 @@ static int icmS15Fixed16Array_allocate(
- 	if (p->size != p->_size) {
- 		if (p->data != NULL)
- 			icp->al->free(icp->al, p->data);
--		if ((p->data = (double *) icp->al->malloc(icp->al, p->size * sizeof(double))) == NULL) {
-+		if ((p->data = (double *) icp->al->calloc(icp->al, p->size, sizeof(double))) == NULL) {
- 			sprintf(icp->err,"icmS15Fixed16Array_alloc: malloc() of icmS15Fixed16Array data failed");
- 			return icp->errc = 2;
- 		}
-@@ -2726,6 +2763,10 @@ static unsigned int icmXYZArray_get_size
- 	icmXYZArray *p = (icmXYZArray *)pp;
- 	unsigned int len = 0;
- 	len += 8;				/* 8 bytes for tag and padding */
-+	if (p->size > (UINT_MAX - len) / 12) {
-+		p->icp->errc = 1;
-+		return (unsigned int) - 1;
-+	}
- 	len += p->size * 12;	/* 12 bytes for each XYZ */
- 	return len;
- }
-@@ -2798,6 +2839,8 @@ static int icmXYZArray_write(
- 
- 	/* Allocate a file write buffer */
- 	len = p->get_size((icmBase *)p);
-+	if (icp->errc)
-+		return icp->errc;
- 	if ((buf = (char *) icp->al->malloc(icp->al, len)) == NULL) {
- 		sprintf(icp->err,"icmXYZArray_write malloc() failed");
- 		return icp->errc = 2;
-@@ -2865,7 +2908,7 @@ static int icmXYZArray_allocate(
- 	if (p->size != p->_size) {
- 		if (p->data != NULL)
- 			icp->al->free(icp->al, p->data);
--		if ((p->data = (icmXYZNumber *) icp->al->malloc(icp->al, p->size * sizeof(icmXYZNumber))) == NULL) {
-+		if ((p->data = (icmXYZNumber *) icp->al->calloc(icp->al, p->size, sizeof(icmXYZNumber))) == NULL) {
- 			sprintf(icp->err,"icmXYZArray_alloc: malloc() of icmXYZArray data failed");
- 			return icp->errc = 2;
- 		}
-@@ -3001,7 +3044,7 @@ static int icmTable_setup_bwd(
- 			int nf;			/* Next free slot */
- 			if (rt->rlists[j] == NULL) {	/* No allocation */
- 				as = 5;						/* Start with space for 5 */
--				if ((rt->rlists[j] = (int *) icp->al->malloc(icp->al, sizeof(int) * as)) == NULL) {
-+				if ((rt->rlists[j] = (int *) icp->al->calloc(icp->al, sizeof(int), as)) == NULL) {
- 					return 2;
- 				}
- 				rt->rlists[j][0] = as;
-@@ -3141,6 +3184,10 @@ static unsigned int icmCurve_get_size(
- 	icmCurve *p = (icmCurve *)pp;
- 	unsigned int len = 0;
- 	len += 12;			/* 12 bytes for tag, padding and count */
-+	if (p->size > (UINT_MAX - len) / 2) {
-+		p->icp->errc = 1;
-+		return (unsigned int) - 1;
-+	}
- 	len += p->size * 2;	/* 2 bytes for each UInt16 */
- 	return len;
- }
-@@ -3238,6 +3285,8 @@ static int icmCurve_write(
- 
- 	/* Allocate a file write buffer */
- 	len = p->get_size((icmBase *)p);
-+	if (icp->errc)
-+		return icp->errc;
- 	if ((buf = (char *) icp->al->malloc(icp->al, len)) == NULL) {
- 		sprintf(icp->err,"icmCurve_write malloc() failed");
- 		return icp->errc = 2;
-@@ -3347,7 +3396,7 @@ static int icmCurve_allocate(
- 	if (p->size != p->_size) {
- 		if (p->data != NULL)
- 			icp->al->free(icp->al, p->data);
--		if ((p->data = (double *) icp->al->malloc(icp->al, p->size * sizeof(double))) == NULL) {
-+		if ((p->data = (double *) icp->al->calloc(icp->al, p->size, sizeof(double))) == NULL) {
- 			sprintf(icp->err,"icmCurve_alloc: malloc() of icmCurve data failed");
- 			return icp->errc = 2;
- 		}
-@@ -3493,6 +3542,8 @@ static int icmData_write(
- 
- 	/* Allocate a file write buffer */
- 	len = p->get_size((icmBase *)p);
-+	if (icp->errc)
-+		return icp->errc;
- 	if ((buf = (char *) icp->al->malloc(icp->al, len)) == NULL) {
- 		sprintf(icp->err,"icmData_write malloc() failed");
- 		return icp->errc = 2;
-@@ -3745,6 +3796,8 @@ static int icmText_write(
- 
- 	/* Allocate a file write buffer */
- 	len = p->get_size((icmBase *)p);
-+	if (icp->errc)
-+		return icp->errc;
- 	if ((buf = (char *) icp->al->malloc(icp->al, len)) == NULL) {
- 		sprintf(icp->err,"icmText_write malloc() failed");
- 		return icp->errc = 2;
-@@ -4038,6 +4091,8 @@ static int icmDateTimeNumber_write(
- 
- 	/* Allocate a file write buffer */
- 	len = p->get_size((icmBase *)p);
-+	if (icp->errc)
-+		return icp->errc;
- 	if ((buf = (char *) icp->al->malloc(icp->al, len)) == NULL) {
- 		sprintf(icp->err,"icmDateTimeNumber_write malloc() failed");
- 		return icp->errc = 2;
-@@ -4128,11 +4183,15 @@ static icmBase *new_icmDateTimeNumber(
- /* icmLut object */
- 
- /* Utility function - raise one integer to an integer power */
--static unsigned int uipow(unsigned int a, unsigned int b) {
-+static int uipow(unsigned int a, unsigned int b, unsigned int *ret) {
- 	unsigned int rv = 1;
--	for (; b > 0; b--)
-+	for (; b > 0; b--) {
-+		if (a > 0 && rv > UINT_MAX / a)
-+			return 1;
- 		rv *= a;
--	return rv;
-+	}
-+	*ret = rv;
-+	return 0;
- }
- 
- /* - - - - - - - - - - - - - - - - */
-@@ -4268,7 +4327,7 @@ double *in		/* Input array[outputChan] *
- 	if (p->inputChan <= 8) {
- 		gw = GW;				/* Use stack allocation */
- 	} else {
--		if ((gw = (double *) icp->al->malloc(icp->al, (1 << p->inputChan) * sizeof(double))) == NULL) {
-+		if ((gw = (double *) icp->al->calloc(icp->al, (1 << p->inputChan), sizeof(double))) == NULL) {
- 			sprintf(icp->err,"icmLut_lookup_clut: malloc() failed");
- 			return icp->errc = 2;
- 		}
-@@ -4819,19 +4878,50 @@ static unsigned int icmLut_get_size(
- ) {
- 	icmLut *p = (icmLut *)pp;
- 	unsigned int len = 0;
-+	unsigned int pw;
- 
- 	if (p->ttype == icSigLut8Type) {
- 		len += 48;			/* tag and header */
-+		if (p->inputChan > 0 &&
-+		    p->inputEnt > (UINT_MAX - len) / p->inputChan / 1)
-+			goto overflow;
-+
- 		len += 1 * (p->inputChan * p->inputEnt);
--		len += 1 * (p->outputChan * uipow(p->clutPoints,p->inputChan));
-+		if (uipow(p->clutPoints,p->inputChan, &pw) ||
-+		    (p->outputChan > 0 &&
-+		     pw > (UINT_MAX - len) / p->outputChan / 1))
-+			goto overflow;
-+
-+		len += 1 * (p->outputChan * pw);
-+		if (p->outputChan > 0 &&
-+		    p->outputEnt > (UINT_MAX - len) / p->outputChan / 1)
-+			goto overflow;
-+
- 		len += 1 * (p->outputChan * p->outputEnt);
- 	} else {
- 		len += 52;			/* tag and header */
-+		if (p->inputChan > 0 &&
-+		    p->inputEnt > (UINT_MAX - len) / p->inputChan / 2)
-+			goto overflow;
-+
- 		len += 2 * (p->inputChan * p->inputEnt);
--		len += 2 * (p->outputChan * uipow(p->clutPoints,p->inputChan));
-+		if (uipow(p->clutPoints,p->inputChan, &pw) ||
-+		    (p->outputChan > 0 &&
-+		     pw > (UINT_MAX - len) / p->outputChan / 2))
-+			goto overflow;
-+
-+		len += 2 * (p->outputChan * pw);
-+		if (p->outputChan > 0 &&
-+		    p->outputEnt > (UINT_MAX - len) / p->outputChan / 2)
-+			goto overflow;
-+
- 		len += 2 * (p->outputChan * p->outputEnt);
- 	}
- 	return len;
-+
-+  overflow:
-+	p->icp->errc = 1;
-+	return (unsigned int) -1;
- }
- 
- /* read the object, return 0 on success, error code on fail */
-@@ -4844,6 +4934,7 @@ static int icmLut_read(
- 	icc *icp = p->icp;
- 	int rv = 0;
- 	unsigned long i, j, g, size;
-+	unsigned int pw;
- 	char *bp, *buf;
- 
- 	if (len < 4) {
-@@ -4904,6 +4995,11 @@ static int icmLut_read(
- 		return icp->errc = 1;
- 	}
- 
-+	if (p->clutPoints > 100) {
-+		sprintf(icp->err,"icmLut_read: too many clutPoints");
-+		return icp->errc = 1;
-+	}
-+
- 	/* Read 3x3 transform matrix */
- 	for (j = 0; j < 3; j++) {		/* Rows */
- 		for (i = 0; i < 3; i++) {	/* Columns */
-@@ -4921,13 +5017,18 @@ static int icmLut_read(
- 		bp = buf+52;
- 	}
- 
--	if (len < icmLut_get_size((icmBase *)p)) {
-+	if (len < icmLut_get_size((icmBase *)p) || icp->errc) {
- 		sprintf(icp->err,"icmLut_read: Tag too small for contents");
- 		icp->al->free(icp->al, buf);
- 		return icp->errc = 1;
- 	}
- 
- 	/* Read the input tables */
-+	if (p->inputEnt > 0 && p->inputChan > UINT_MAX / p->inputEnt) {
-+		sprintf(icp->err,"icmLut_read: overflow");
-+		icp->al->free(icp->al, buf);
-+		return icp->errc = 1;
-+	}
- 	size = (p->inputChan * p->inputEnt);
- 	if ((rv = p->allocate((icmBase *)p)) != 0) {
- 		icp->al->free(icp->al, buf);
-@@ -4942,7 +5043,14 @@ static int icmLut_read(
- 	}
- 
- 	/* Read the clut table */
--	size = (p->outputChan * uipow(p->clutPoints,p->inputChan));
-+	if (uipow(p->clutPoints,p->inputChan,&pw) ||
-+	    (p->outputChan > 0 &&
-+	     pw > UINT_MAX / p->outputChan)) {
-+		sprintf(icp->err,"icmLut_read: overflow");
-+		icp->al->free(icp->al, buf);
-+		return icp->errc = 1;
-+	}
-+	size = (p->outputChan * pw);
- 	if ((rv = p->allocate((icmBase *)p)) != 0) {
- 		icp->al->free(icp->al, buf);
- 		return rv;
-@@ -4956,6 +5064,11 @@ static int icmLut_read(
- 	}
- 
- 	/* Read the output tables */
-+	if (p->outputChan > 0 && p->outputEnt > UINT_MAX / p->outputChan) {
-+		sprintf(icp->err,"icmLut_read: overflow");
-+		icp->al->free(icp->al, buf);
-+		return icp->errc = 1;
-+	}
- 	size = (p->outputChan * p->outputEnt);
- 	if ((rv = p->allocate((icmBase *)p)) != 0) {
- 		icp->al->free(icp->al, buf);
-@@ -4995,12 +5108,14 @@ static int icmLut_write(
- 	icmLut *p = (icmLut *)pp;
- 	icc *icp = p->icp;
- 	unsigned long i,j;
--	unsigned int len, size;
-+	unsigned int len, size, pw;
- 	char *bp, *buf;		/* Buffer to write from */
- 	int rv = 0;
- 
- 	/* Allocate a file write buffer */
- 	len = p->get_size((icmBase *)p);
-+	if (icp->errc)
-+		return icp->errc;
- 	if ((buf = (char *) icp->al->malloc(icp->al, len)) == NULL) {
- 		sprintf(icp->err,"icmLut_write malloc() failed");
- 		return icp->errc = 2;
-@@ -5066,6 +5181,11 @@ static int icmLut_write(
- 	}
- 
- 	/* Write the input tables */
-+	if (p->inputEnt > 0 && p->inputChan > UINT_MAX / p->inputEnt) {
-+		sprintf(icp->err,"icmLut_write: overflow");
-+		icp->al->free(icp->al, buf);
-+		return icp->errc = 1;
-+	}
- 	size = (p->inputChan * p->inputEnt);
- 	if (p->ttype == icSigLut8Type) {
- 		for (i = 0; i < size; i++, bp += 1) {
-@@ -5086,7 +5206,14 @@ static int icmLut_write(
- 	}
- 
- 	/* Write the clut table */
--	size = (p->outputChan * uipow(p->clutPoints,p->inputChan));
-+	if (uipow(p->clutPoints,p->inputChan,&pw) ||
-+	    (p->outputChan > 0 &&
-+	     pw > UINT_MAX / p->outputChan)) {
-+		sprintf(icp->err,"icmLut_write: overflow");
-+		icp->al->free(icp->al, buf);
-+		return icp->errc = 1;
-+	}
-+	size = (p->outputChan * pw);
- 	if (p->ttype == icSigLut8Type) {
- 		for (i = 0; i < size; i++, bp += 1) {
- 			if ((rv = write_DCS8Number(p->clutTable[i], bp)) != 0) {
-@@ -5106,6 +5233,11 @@ static int icmLut_write(
- 	}
- 
- 	/* Write the output tables */
-+	if (p->outputChan > 0 && p->outputEnt > UINT_MAX / p->outputChan) {
-+		sprintf(icp->err,"icmLut_write: overflow");
-+		icp->al->free(icp->al, buf);
-+		return icp->errc = 1;
-+	}
- 	size = (p->outputChan * p->outputEnt);
- 	if (p->ttype == icSigLut8Type) {
- 		for (i = 0; i < size; i++, bp += 1) {
-@@ -5177,7 +5309,14 @@ static void icmLut_dump(
- 		if (p->inputChan > MAX_CHAN) {
- 			fprintf(op,"  !!Can't dump > %d input channel CLUT table!!\n",MAX_CHAN);
- 		} else {
--			size = (p->outputChan * uipow(p->clutPoints,p->inputChan));
-+			unsigned int pw;
-+			if (uipow(p->clutPoints,p->inputChan,&pw) ||
-+			    (p->outputChan > 0 &&
-+			     pw > UINT_MAX / p->outputChan)) {
-+				fprintf(op,"Would overflow.\n");
-+				return;
-+			}
-+			size = (p->outputChan * pw);
- 			for (j = 0; j < p->inputChan; j++)
- 				ii[j] = 0;
- 			for (i = 0; i < size;) {
-@@ -5216,7 +5355,7 @@ static void icmLut_dump(
- static int icmLut_allocate(
- 	icmBase *pp
- ) {
--	unsigned int i, j, g, size;
-+	unsigned int i, j, g, size, pw;
- 	icmLut *p = (icmLut *)pp;
- 	icc *icp = p->icp;
- 
-@@ -5231,6 +5370,10 @@ static int icmLut_allocate(
- 		return icp->errc = 1;
- 	}
- 
-+	if (p->inputEnt > 0 && p->inputChan > UINT_MAX / p->inputEnt) {
-+		sprintf(icp->err,"icmLut_alloc: too many entries");
-+		return icp->errc = 1;
-+	}
- 	size = (p->inputChan * p->inputEnt);
- 	if (size != p->inputTable_size) {
- 		if (p->inputTable != NULL)
-@@ -5241,7 +5384,13 @@ static int icmLut_allocate(
- 		}
- 		p->inputTable_size = size;
- 	}
--	size = (p->outputChan * uipow(p->clutPoints,p->inputChan));
-+	if (uipow(p->clutPoints,p->inputChan,&pw) ||
-+	    (p->outputChan > 0 &&
-+	     pw > UINT_MAX / p->outputChan)) {
-+		sprintf(icp->err,"icmLut_alloc: overflow");
-+		return icp->errc = 1;
-+	}
-+	size = (p->outputChan * pw);
- 	if (size != p->clutTable_size) {
- 		if (p->clutTable != NULL)
- 			icp->al->free(icp->al, p->clutTable);
-@@ -5251,6 +5400,10 @@ static int icmLut_allocate(
- 		}
- 		p->clutTable_size = size;
- 	}
-+	if (p->outputChan > 0 && p->outputEnt > UINT_MAX / p->outputChan) {
-+		sprintf(icp->err,"icmLut_alloc: overflow");
-+		return icp->errc = 1;
-+	}
- 	size = (p->outputChan * p->outputEnt);
- 	if (size != p->outputTable_size) {
- 		if (p->outputTable != NULL)
-@@ -5441,6 +5594,8 @@ static int icmMeasurement_write(
- 
- 	/* Allocate a file write buffer */
- 	len = p->get_size((icmBase *)p);
-+	if (icp->errc)
-+		return icp->errc;
- 	if ((buf = (char *) icp->al->malloc(icp->al, len)) == NULL) {
- 		sprintf(icp->err,"icmMeasurement_write malloc() failed");
- 		return icp->errc = 2;
-@@ -5712,13 +5867,20 @@ static unsigned int icmNamedColor_get_si
- 			len += p->nDeviceCoords * 1;	/* bytes for each named color */
- 		}
- 	} else {	/* Named Color 2 */
-+		unsigned int col;
- 		len += 8;			/* 8 bytes for tag and padding */
- 		len += 4;			/* 4 for vendor specific flags */
- 		len += 4;			/* 4 for count of named colors */
- 		len += 4;			/* 4 for number of device coords */
- 		len += 32;			/* 32 for prefix of color names */
- 		len += 32;			/* 32 for suffix of color names */
--		len += p->count * (32 + 6 + p->nDeviceCoords * 2);	/* bytes for each named color */
-+		col = 32 + 6 + p->nDeviceCoords * 2;
-+		if (p->nDeviceCoords > (UINT_MAX - (32 + 6)) / 2 ||
-+		    (p->count > 0 && col > (UINT_MAX - len) / p->count)) {
-+			p->icp->errc = 1;
-+			return (unsigned int) -1;
-+		}
-+		len += p->count * col;	/* bytes for each named color */
- 	}
- 	return len;
- }
-@@ -5882,6 +6044,8 @@ static int icmNamedColor_write(
- 
- 	/* Allocate a file write buffer */
- 	len = p->get_size((icmBase *)p);
-+	if (icp->errc)
-+		return icp->errc;
- 	if ((buf = (char *) icp->al->malloc(icp->al, len)) == NULL) {
- 		sprintf(icp->err,"icmNamedColor_write malloc() failed");
- 		return icp->errc = 2;
-@@ -6109,9 +6273,22 @@ static unsigned int icmTextDescription_g
- ) {
- 	icmTextDescription *p = (icmTextDescription *)pp;
- 	unsigned int len = 0;
-+	if (p->size > UINT_MAX - (8 + 4 + 8)) {
-+		p->icp->errc = 1;
-+		return (unsigned int) -1;
-+	}
- 	len += 8;			/* 8 bytes for tag and padding */
- 	len += 4 + p->size;	/* Ascii string length + ascii string */
--	len += 8 + 2 * p->ucSize;	/* Unicode language code + length + string */
-+	len += 8;               /* Unicode language code + length */
-+	if (p->ucSize > (UINT_MAX - len) / 2) {
-+		p->icp->errc = 1;
-+		return (unsigned int) -1;
-+	}
-+	len += 2 * p->ucSize;    /* Unicode string */
-+	if (len > (UINT_MAX - (3 + 67))) {
-+		p->icp->errc = 1;
-+		return (unsigned int) -1;
-+	}
- 	len += 3 + 67;		/* ScriptCode code, length string */
- 	return len;
- }
-@@ -6294,6 +6471,8 @@ static int icmTextDescription_write(
- 
- 	/* Allocate a file write buffer */
- 	len = p->get_size((icmBase *)p);
-+	if (icp->errc)
-+		return icp->errc;
- 	if ((buf = (char *) icp->al->malloc(icp->al, len)) == NULL) {
- 		sprintf(icp->err,"icmTextDescription_write malloc() failed");
- 		return icp->errc = 2;
-@@ -6544,7 +6723,7 @@ static int icmTextDescription_allocate(
- 	if (p->ucSize != p->uc_size) {
- 		if (p->ucDesc != NULL)
- 			icp->al->free(icp->al, p->ucDesc);
--		if ((p->ucDesc = (ORD16 *) icp->al->malloc(icp->al, p->ucSize * sizeof(ORD16))) == NULL) {
-+		if ((p->ucDesc = (ORD16 *) icp->al->calloc(icp->al, p->ucSize, sizeof(ORD16))) == NULL) {
- 			sprintf(icp->err,"icmTextDescription_alloc: malloc() of Unicode description failed");
- 			return icp->errc = 2;
- 		}
-@@ -6820,6 +6999,12 @@ static int icmProfileSequenceDesc_read(
- 	bp += 8;	/* Skip padding */
- 
- 	p->count = read_UInt32Number(bp);	/* Number of sequence descriptions */
-+	if (p->count > 1000) {
-+		sprintf(icp->err,"icmProfileSequenceDesc_read: too many sequence descriptions");
-+		icp->al->free(icp->al, buf);
-+		return icp->errc = 1;
-+	}
-+
- 	bp += 4;
- 
- 	/* Read all the sequence descriptions */
-@@ -6852,6 +7037,8 @@ static int icmProfileSequenceDesc_write(
- 
- 	/* Allocate a file write buffer */
- 	len = p->get_size((icmBase *)p);
-+	if (icp->errc)
-+		return icp->errc;
- 	if ((buf = (char *) icp->al->malloc(icp->al, len)) == NULL) {
- 		sprintf(icp->err,"icmProfileSequenceDesc_write malloc() failed");
- 		return icp->errc = 2;
-@@ -6922,7 +7109,7 @@ static int icmProfileSequenceDesc_alloca
- 	if (p->count != p->_count) {
- 		if (p->data != NULL)
- 			icp->al->free(icp->al, p->data);
--		if ((p->data = (icmDescStruct *) icp->al->malloc(icp->al, p->count * sizeof(icmDescStruct))) == NULL) {
-+		if ((p->data = (icmDescStruct *) icp->al->calloc(icp->al, p->count, sizeof(icmDescStruct))) == NULL) {
- 			sprintf(icp->err,"icmProfileSequenceDesc_allocate Allocation of DescStruct array failed");
- 			return icp->errc = 2;
- 		}
-@@ -7041,6 +7228,8 @@ static int icmSignature_write(
- 
- 	/* Allocate a file write buffer */
- 	len = p->get_size((icmBase *)p);
-+	if (icp->errc)
-+		return icp->errc;
- 	if ((buf = (char *) icp->al->malloc(icp->al, len)) == NULL) {
- 		sprintf(icp->err,"icmSignature_write malloc() failed");
- 		return icp->errc = 2;
-@@ -7156,6 +7345,10 @@ static unsigned int icmScreening_get_siz
- 	icmScreening *p = (icmScreening *)pp;
- 	unsigned int len = 0;
- 	len += 16;				/* 16 bytes for tag, padding, flag & channeles */
-+	if (p->channels > (UINT_MAX - len) / 12) {
-+		p->icp->errc = 1;
-+		return (unsigned int) -1;
-+	}
- 	len += p->channels * 12;	/* 12 bytes for each channel */
- 	return len;
- }
-@@ -7235,6 +7428,8 @@ static int icmScreening_write(
- 
- 	/* Allocate a file write buffer */
- 	len = p->get_size((icmBase *)p);
-+	if (icp->errc)
-+		return icp->errc;
- 	if ((buf = (char *) icp->al->malloc(icp->al, len)) == NULL) {
- 		sprintf(icp->err,"icmScreening_write malloc() failed");
- 		return icp->errc = 2;
-@@ -7315,7 +7510,7 @@ static int icmScreening_allocate(
- 	if (p->channels != p->_channels) {
- 		if (p->data != NULL)
- 			icp->al->free(icp->al, p->data);
--		if ((p->data = (icmScreeningData *) icp->al->malloc(icp->al, p->channels * sizeof(icmScreeningData))) == NULL) {
-+		if ((p->data = (icmScreeningData *) icp->al->calloc(icp->al, p->channels, sizeof(icmScreeningData))) == NULL) {
- 			sprintf(icp->err,"icmScreening_alloc: malloc() of icmScreening data failed");
- 			return icp->errc = 2;
- 		}
-@@ -7366,10 +7561,20 @@ static unsigned int icmUcrBg_get_size(
- 	icmUcrBg *p = (icmUcrBg *)pp;
- 	unsigned int len = 0;
- 	len += 8;			/* 8 bytes for tag and padding */
-+	if (p->UCRcount > (UINT_MAX - len - 4) / 2)
-+		goto overflow;
-+
- 	len += 4 + p->UCRcount * 2;	/* Undercolor Removal */
-+	if (p->BGcount > (UINT_MAX - len - 4 - p->size) / 2)
-+		goto overflow;
-+
- 	len += 4 + p->BGcount * 2;	/* Black Generation */
- 	len += p->size;				/* Description string */
- 	return len;
-+
-+ overflow:
-+	p->icp->errc = 1;
-+	return (unsigned int) -1;
- }
- 
- /* read the object, return 0 on success, error code on fail */
-@@ -7498,6 +7703,8 @@ static int icmUcrBg_write(
- 
- 	/* Allocate a file write buffer */
- 	len = p->get_size((icmBase *)p);
-+	if (icp->errc)
-+		return icp->errc;
- 	if ((buf = (char *) icp->al->malloc(icp->al, len)) == NULL) {
- 		sprintf(icp->err,"icmUcrBg_write malloc() failed");
- 		return icp->errc = 2;
-@@ -7663,7 +7870,7 @@ static int icmUcrBg_allocate(
- 	if (p->UCRcount != p->UCR_count) {
- 		if (p->UCRcurve != NULL)
- 			icp->al->free(icp->al, p->UCRcurve);
--		if ((p->UCRcurve = (double *) icp->al->malloc(icp->al, p->UCRcount * sizeof(double))) == NULL) {
-+		if ((p->UCRcurve = (double *) icp->al->calloc(icp->al, p->UCRcount, sizeof(double))) == NULL) {
- 			sprintf(icp->err,"icmUcrBg_allocate: malloc() of UCR curve data failed");
- 			return icp->errc = 2;
- 		}
-@@ -7672,7 +7879,7 @@ static int icmUcrBg_allocate(
- 	if (p->BGcount != p->BG_count) {
- 		if (p->BGcurve != NULL)
- 			icp->al->free(icp->al, p->BGcurve);
--		if ((p->BGcurve = (double *) icp->al->malloc(icp->al, p->BGcount * sizeof(double))) == NULL) {
-+		if ((p->BGcurve = (double *) icp->al->calloc(icp->al, p->BGcount, sizeof(double))) == NULL) {
- 			sprintf(icp->err,"icmUcrBg_allocate: malloc() of BG curve data failed");
- 			return icp->errc = 2;
- 		}
-@@ -7743,6 +7950,15 @@ static unsigned int icmVideoCardGamma_ge
- 		len += 2;       /* 2 bytes for channels */
- 		len += 2;       /* 2 for entry count */
- 		len += 2;       /* 2 for entry size */
-+		if (p->u.table.entryCount > 0 &&
-+		    p->u.table.entrySize > 0 &&
-+		    p->u.table.channels >
-+		    (UINT_MAX - len) /
-+		    p->u.table.entryCount /
-+		    p->u.table.entrySize) {
-+			p->icp->errc = 1;
-+			return (unsigned int) -1;
-+		}
- 		len += ( p->u.table.channels *     /* compute table size */
- 				 p->u.table.entryCount *
- 				 p->u.table.entrySize );
-@@ -7762,10 +7978,11 @@ static int icmVideoCardGamma_read(
- ) {
- 	icmVideoCardGamma *p = (icmVideoCardGamma *)pp;
- 	icc *icp = p->icp;
--	int rv, c;
-+	int rv;
- 	char *bp, *buf;
- 	unsigned char *pchar;
- 	unsigned short *pshort;
-+	unsigned long c;
- 
- 	if (len < 18) {
- 		sprintf(icp->err,"icmVideoCardGamma_read: Tag too small to be legal");
-@@ -7803,6 +8020,16 @@ static int icmVideoCardGamma_read(
- 		p->u.table.channels   = read_UInt16Number(bp+12);
- 		p->u.table.entryCount = read_UInt16Number(bp+14);
- 		p->u.table.entrySize  = read_UInt16Number(bp+16);
-+		if (p->u.table.entrySize > 65530 || p->u.table.entrySize == 0) {
-+			sprintf(icp->err,"icmVideoCardGamma_read: Too many entries (or none)");
-+			return icp->errc = 1;
-+		}
-+		if (p->u.table.entryCount > 0 && p->u.table.entrySize > 0 &&
-+		    p->u.table.channels >
-+		    UINT_MAX / p->u.table.entryCount / p->u.table.entrySize) {
-+			sprintf(icp->err,"icmVideoCardGamma_read: Overflow reading tag");
-+			return icp->errc = 1;
-+		}
- 		if (len-18 < p->u.table.channels*p->u.table.entryCount*p->u.table.entrySize) {
- 			sprintf(icp->err,"icmVideoCardGamma_read: Tag too small to be legal");
- 			return icp->errc = 1;
-@@ -7871,6 +8098,8 @@ static int icmVideoCardGamma_write(
- 
- 	/* Allocate a file write buffer */
- 	len = p->get_size((icmBase *)p);
-+	if (icp->errc)
-+		return icp->errc;
- 	if ((buf = (char *) icp->al->malloc(icp->al, len)) == NULL) {
- 		sprintf(icp->err,"icmViewingConditions_write malloc() failed");
- 		return icp->errc = 2;
-@@ -8049,7 +8278,7 @@ static int icmVideoCardGamma_allocate(
- ) {
- 	icmVideoCardGamma *p = (icmVideoCardGamma *)pp;
- 	icc *icp = p->icp;
--	int size;
-+	unsigned int size;
- 
- 	/* note: allocation is only relevant for table type
- 	 * and in that case the channels, entryCount, and entrySize
-@@ -8059,6 +8288,11 @@ static int icmVideoCardGamma_allocate(
- 	if (p->tagType == icmVideoCardGammaTableType) {
- 		if (p->u.table.data != NULL)
- 			icp->al->free(icp->al, p->u.table.data);
-+		if (p->u.table.entryCount > 0 &&
-+		    p->u.table.channels > UINT_MAX / p->u.table.entryCount) {
-+			sprintf(icp->err,"icmVideoCardGamma_alloc: table too large");
-+			return icp->errc = 1;
-+		}
- 		size = (p->u.table.channels *
- 				p->u.table.entryCount);
- 		switch (p->u.table.entrySize) {
-@@ -8066,6 +8300,10 @@ static int icmVideoCardGamma_allocate(
- 			size *= sizeof(unsigned char);
- 			break;
- 		case 2:
-+			if (size > UINT_MAX / sizeof(unsigned short)) {
-+				sprintf(icp->err,"icmVideoCardGamma_alloc: table too large");
-+				return icp->errc = 1;
-+			}
- 			size *= sizeof(unsigned short);
- 			break;
- 		default:
-@@ -8201,6 +8439,8 @@ static int icmViewingConditions_write(
- 
- 	/* Allocate a file write buffer */
- 	len = p->get_size((icmBase *)p);
-+	if (icp->errc)
-+		return icp->errc;
- 	if ((buf = (char *) icp->al->malloc(icp->al, len)) == NULL) {
- 		sprintf(icp->err,"icmViewingConditions_write malloc() failed");
- 		return icp->errc = 2;
-@@ -8433,6 +8673,8 @@ static int icmCrdInfo_write(
- 
- 	/* Allocate a file write buffer */
- 	len = p->get_size((icmBase *)p);
-+	if (icp->errc)
-+		return icp->errc;
- 	if ((buf = (char *) icp->al->malloc(icp->al, len)) == NULL) {
- 		sprintf(icp->err,"icmCrdInfo_write malloc() failed");
- 		return icp->errc = 2;
-@@ -8736,6 +8978,8 @@ static int icmHeader_write(
- 	int rv = 0;
- 
- 	len = p->get_size(p);
-+	if (icp->errc)
-+		return icp->errc;
- 	if ((buf = (char *) icp->al->calloc(icp->al,1,len)) == NULL) {			/* Zero it - some CMS are fussy */
- 		sprintf(icp->err,"icmHeader_write calloc() failed");
- 		return icp->errc = 2;
-@@ -9245,13 +9489,23 @@ static int icc_read(
- 	}
- 
- 	p->count = read_UInt32Number(tcbuf);		/* Tag count */
-+	if (p->count > 100) {
-+		sprintf(p->err,"icc_read: too many table tags");
-+		return p->errc = 1;
-+	}
- 	if (p->count > 0) {
- 		char *bp, *buf;
--		if ((p->data = (icmTag *) p->al->malloc(p->al, p->count * sizeof(icmTag))) == NULL) {
-+		if ((p->data = (icmTag *) p->al->calloc(p->al, p->count, sizeof(icmTag))) == NULL) {
- 			sprintf(p->err,"icc_read: Tag table malloc() failed");
- 			return p->errc = 2;
- 		}
- 	
-+		if (p->count > (UINT_MAX - 4) / 12) {
-+			sprintf(p->err,"icc_read: overflow");
-+			p->al->free(p->al, p->data);
-+			p->data = NULL;
-+			return p->errc = 1;
-+		}
- 		len = 4 + p->count * 12;
- 		if ((buf = (char *) p->al->malloc(p->al, len)) == NULL) {
- 			sprintf(p->err,"icc_read: Tag table read buffer malloc() failed");
-@@ -9281,6 +9535,14 @@ static int icc_read(
- 	    	    return p->errc = 1;
- 	    	}
- 	    	p->data[i].size = read_UInt32Number(bp + 8);	
-+			if (p->data[i].offset + p->data[i].size >
-+			    p->header->size) {
-+				sprintf(p->err,"icc_read: tag out of bounds");
-+				p->al->free(p->al, p->data);
-+				p->data = NULL;
-+				p->al->free(p->al, buf);
-+				return p->errc = 1;
-+			}
- 			if (   p->fp->seek(p->fp, of + p->data[i].offset) != 0
- 			    || p->fp->read(p->fp, tcbuf, 1, 4) != 4) {
- 				sprintf(p->err,"icc_read: fseek() or fread() failed on tag headers");
-@@ -9321,8 +9583,14 @@ static unsigned int icc_get_size(
- 	}
- 
- 	size += p->header->get_size(p->header);
-+	if (p->errc)
-+		return (unsigned int) -1;
- 
- 	size = DO_ALIGN(size);
-+	if (size == 0 || p->count > (UINT_MAX - 4 - size) / 12) {
-+		p->errc = 1;
-+		return (unsigned int) -1;
-+	}
- 	size += 4 + p->count * 12;	/* Tag table length */
- 	
- 	/* Reset touched flag for each tag type */
-@@ -9337,8 +9605,13 @@ static unsigned int icc_get_size(
- 	/* Get size for each tag type, skipping links */
- 	for (i = 0; i < p->count; i++) {
- 		if (p->data[i].objp->touched == 0) { /* Not alllowed for previously */
-+			unsigned int obj_size;
- 			size = DO_ALIGN(size);
--			size += p->data[i].objp->get_size(p->data[i].objp);
-+			obj_size = p->data[i].objp->get_size(p->data[i].objp);
-+			if (size == 0 || p->errc ||
-+			    obj_size > UINT_MAX - size)
-+				return (unsigned int) -1;
-+			size += obj_size;
- 			p->data[i].objp->touched = 1;	/* Don't account for this again */
- 		}
- 	}
-@@ -9373,9 +9646,19 @@ static int icc_write(
- 	}
- 
- 	size += p->header->get_size(p->header);
-+	if (p->errc)
-+		return p->errc;
- 
-+	if (p->count > (UINT_MAX - 4 - len) / 12) {
-+		sprintf(p->err,"icc_write: too many tags");
-+		return p->errc = 1;
-+	}
- 	len = 4 + p->count * 12;	/* Tag table length */
- 	size = DO_ALIGN(size);
-+	if (size == 0 || size > UINT_MAX - len) {
-+		sprintf(p->err,"icc_write: overflow writing tag table");
-+		return p->errc = 1;
-+	}
- 	size += len;
- 	
- 	/* Allocate memory buffer for tag table */
-@@ -9406,6 +9689,12 @@ static int icc_write(
- 			size = DO_ALIGN(size);
- 			p->data[i].offset = size;			/* Profile relative target */
- 			p->data[i].size = p->data[i].objp->get_size(p->data[i].objp);
-+			if (size == 0 ||
-+			    p->errc || p->data[i].size > UINT_MAX - size) {
-+				sprintf(p->err,"icc_write: internal error - overflow?");
-+				p->al->free(p->al, buf);
-+				return p->errc;
-+			}
- 			size += p->data[i].size;
- 			p->data[i].objp->touched = 1;	/* Allocated space for it */
- 		} else { /* must be linked - copy allocation */
-@@ -9529,6 +9818,11 @@ static icmBase *icc_add_tag(
- 	}
- 
- 	/* Make space in tag table for new tag item */
-+	if (p->count > (UINT_MAX / sizeof(icmTag)) - 1) {
-+		sprintf(p->err,"icc_add_tag: overflow");
-+		p->errc = 1;
-+		return NULL;
-+	}
- 	if (p->data == NULL)
- 		tp = p->al->malloc(p->al, (p->count+1) * sizeof(icmTag));
- 	else
-@@ -9612,6 +9906,11 @@ static icmBase *icc_link_tag(
- 	}
- 
- 	/* Make space in tag table for new tag item */
-+	if (p->count > (UINT_MAX / sizeof(icmTag)) - 1) {
-+		sprintf(p->err,"icc_link_tag: overflow");
-+		p->errc = 1;
-+		return NULL;
-+	}
- 	if (p->data == NULL)
- 		tp = p->al->malloc(p->al, (p->count+1) * sizeof(icmTag));
- 	else
-
diff --git a/print/ghostscript8/files/patch-Resource-Init-cidfmap b/print/ghostscript8/files/patch-Resource-Init-cidfmap
index f51d0be6848c..8ed71789f4fe 100644
--- a/print/ghostscript8/files/patch-Resource-Init-cidfmap
+++ b/print/ghostscript8/files/patch-Resource-Init-cidfmap
@@ -1,11 +1,11 @@
 --- Resource/Init/cidfmap.orig	2008-08-08 13:22:38.000000000 +0900
-+++ Resource/Init/cidfmap	2009-05-15 03:26:04.000000000 +0900
-@@ -26,3 +26,59 @@
++++ Resource/Init/cidfmap	2009-12-20 03:03:17.000000000 +0900
+@@ -26,3 +26,64 @@
  %   /ShinGo-Bold   /HeiseiKakuGo-W5 ;
  %   /Ryumin-Medium << /FileType /TrueType /Path (H:/AuxFiles/Fonts/BATANG.TTC) /SubfontID 3 /CSI [(Japan1) 2] >> ;
  %
-+/Ryumin-Light << /FileType /TrueType /Path (Ryumin-Light) /SubfontID 0 /CSI [(Japan1) 3] >> ;
-+/GothicBBB-Medium << /FileType /TrueType /Path (GothicBBB-Medium) /SubfontID 0 /CSI [(Japan1) 3] >> ;
++/Ryumin-Light << /FileType /TrueType /Path (Ryumin-Light) /SubfontID 0 /CSI [(Japan1) 6] >> ;
++/GothicBBB-Medium << /FileType /TrueType /Path (GothicBBB-Medium) /SubfontID 0 /CSI [(Japan1) 6] >> ;
 +
 +/Ryumin-Medium		/Ryumin-Light ;
 +/Ryumin-Regular		/Ryumin-Light ;
@@ -47,6 +47,11 @@
 +
 +/MidashiMinPro-MA31	/Ryumin-Light ;
 +
++/MS-Mincho		/Ryumin-Light ;
++/MS-PMincho		/Ryumin-Light ;
++/MS-Gothic		/GothicBBB-Medium ;
++/MS-PGothic		/GothicBBB-Medium ;
++
 +%/Munhwa-Regular	/Munhwa-Regular ;
 +%/MunhwaGothic-Regular	/MunhwaGothic-Regular ;
 +%/Munhwa-Bold		/Munhwa-Bold ;
diff --git a/print/ghostscript8/files/patch-Resource-Init-gs_statd.ps b/print/ghostscript8/files/patch-Resource-Init-gs_statd.ps
index 2432745941ad..ab50080daeb8 100644
--- a/print/ghostscript8/files/patch-Resource-Init-gs_statd.ps
+++ b/print/ghostscript8/files/patch-Resource-Init-gs_statd.ps
@@ -1,9 +1,9 @@
---- Resource/Init/gs_statd.ps.orig	Sat Feb 14 04:19:59 2004
-+++ Resource/Init/gs_statd.ps	Sat Feb 21 23:01:09 2004
-@@ -109,6 +109,12 @@
-  /halfletter {396 612 //.setpagesize exec} bind def
- 	% minimum of a4 and letter (a4 width, letter length)
+--- Resource/Init/gs_statd.ps.orig	2009-03-16 07:42:53.000000000 +0900
++++ Resource/Init/gs_statd.ps	2009-12-20 01:35:53.000000000 +0900
+@@ -111,6 +111,12 @@
   /pa4 {595 792 //.setpagesize exec} bind def
+ 	% Japanese postcard size, 100mm x 148mm
+  /hagaki {283 420 //.setpagesize exec} bind def
 + /postcard {284 419 //.setpagesize exec} bind def
 + /dbl_postcard {419 568 //.setpagesize exec} bind def
 + /Executive {522 756 //.setpagesize exec} bind def
@@ -13,11 +13,11 @@
  % /tabloid {792 1224 //.setpagesize exec} bind def  % 11x17 portrait
  % /csheet {1224 1584 //.setpagesize exec} bind def % ANSI C 17x22
  % /dsheet {1584 2448 //.setpagesize exec} bind def % ANSI D 22x34
-@@ -125,6 +131,7 @@
+@@ -127,6 +133,7 @@
   [ /letter /note	%do not change this line, needed by 'setpagetype'
     /legal /lettersmall
     /11x17 /ledger
-+   /postcard /dbl_postcard /Executive /jenv_you4 /jenv_you2 /jenv_kaku2
++   /postcard /dbl_postcard /Executive /hagaki /jenv_you4 /jenv_you2 /jenv_kaku2
     /a4small /a3 /a4
  STRICT { (%END SIZES) .skipeof } if
     /a0 /a1 /a2 /a5 /a6 /a7 /a8 /a9 /a10
diff --git a/print/ghostscript8/files/patch-base-devs.mak b/print/ghostscript8/files/patch-base-devs.mak
index 9507beb00f55..70fd478e9212 100644
--- a/print/ghostscript8/files/patch-base-devs.mak
+++ b/print/ghostscript8/files/patch-base-devs.mak
@@ -1,25 +1,24 @@
---- base/devs.mak.orig	2008-11-08 03:49:34.000000000 +0900
-+++ base/devs.mak	2009-03-29 03:39:04.000000000 +0900
-@@ -418,11 +418,11 @@
+--- base/devs.mak.orig	2009-02-14 09:46:58.000000000 +0900
++++ base/devs.mak	2009-12-20 01:39:02.000000000 +0900
+@@ -418,10 +418,10 @@
  ### NON PORTABLE, ONLY UNIX WITH GCC SUPPORT
  
  $(GLOBJ)lvga256.so : $(lvga256_)
--	$(CCLD) -shared -Wl,'-solvga256.so' $(lvga256_) -lvga -lvgagl
-+	$(CCLD) -shared -Wl,'-solvga256.so' $(lvga256_) -lvga -lvgagl $(XLDFLAGS)
- 	mv lvga256.so $(GLOBJ)lvga256.so
+-	$(CCLD) $(LDFLAGS) -shared -o $(GLOBJ)lvga256.so $(lvga256_) -lvga -lvgagl
++	$(CCLD) $(LDFLAGS) -shared -o $(GLOBJ)lvga256.so $(lvga256_) -lvga -lvgagl $(XLDFLAGS)
  
  $(GLOBJ)vgalib.so : $(vgalib_)
--	$(CCLD) -shared -Wl,'-sovgalib.so' $(vgalib_) -lvga -lvgagl
-+	$(CCLD) -shared -Wl,'-sovgalib.so' $(vgalib_) -lvga -lvgagl $(XLDFLAGS)
- 	mv vgalib.so $(GLOBJ)vgalib.so
+-	$(CCLD) $(LDFLAGS) -shared -o $(GLOBJ)vgalib.so $(vgalib_) -lvga -lvgagl
++	$(CCLD) $(LDFLAGS) -shared -o $(GLOBJ)vgalib.so $(vgalib_) -lvga -lvgagl $(XLDFLAGS)
  
  ### -------------------------- The X11 device -------------------------- ###
-@@ -526,7 +526,7 @@
+ 
+@@ -524,7 +524,7 @@
  ### NON PORTABLE, ONLY UNIX WITH GCC SUPPORT
  
  $(GLOBJ)X11.so : $(x11alt_) $(x11_)
--	$(CCLD) -shared -Wl,'-soX11.so' $(x11alt_) $(x11_) -L/usr/X11R6/lib -lXt -lSM -lICE -lXext -lX11 $(XLIBDIRS)
-+	$(CCLD) -shared -Wl,'-soX11.so' $(x11alt_) $(x11_) -lXt -lSM -lICE -lXext -lX11 $(XLIBDIRS)
- 	mv X11.so $(GLOBJ)X11.so
+-	$(CCLD) $(LDFLAGS) -shared -o $(GLOBJ)X11.so $(x11alt_) $(x11_) -L/usr/X11R6/lib -lXt -lSM -lICE -lXext -lX11 $(XLIBDIRS)
++	$(CCLD) $(LDFLAGS) -shared -o $(GLOBJ)X11.so $(x11alt_) $(x11_) -L$(X11BASE)/lib -lXt -lSM -lICE -lXext -lX11 $(XLIBDIRS)
  
  ###### --------------- Memory-buffered printer devices --------------- ######
+ 
diff --git a/print/ghostscript8/files/patch-psi-fapi_ft.c b/print/ghostscript8/files/patch-psi-fapi_ft.c
deleted file mode 100644
index 5737efec19b7..000000000000
--- a/print/ghostscript8/files/patch-psi-fapi_ft.c
+++ /dev/null
@@ -1,22 +0,0 @@
---- psi/fapi_ft.c.orig	Wed Jul 11 09:26:24 2007
-+++ psi/fapi_ft.c	Fri Aug 10 02:40:41 2007
-@@ -28,11 +28,14 @@
- #include "gserror.h"
- 
- /* FreeType headers */
--#include "freetype/freetype.h"
--#include "freetype/ftincrem.h"
--#include "freetype/ftglyph.h"
--#include "freetype/ftoutln.h"
--#include "freetype/fttrigon.h"
-+#include "ft2build.h"
-+#include FT_FREETYPE_H
-+#include FT_INCREMENTAL_H
-+#include FT_GLYPH_H
-+#include FT_OUTLINE_H
-+#include FT_TRIGONOMETRY_H
-+#include "gserrors.h"
-+#include "gserror.h"
- 
- /* Note: structure definitions here start with FF_, which stands for 'FAPI FreeType". */
-