Fixed potential overflow in surface allocation (thanks Yves!)
diff --git a/src/video/SDL_surface.c b/src/video/SDL_surface.c
index cabe7e0..721c477 100644
--- a/src/video/SDL_surface.c
+++ b/src/video/SDL_surface.c
@@ -80,7 +80,15 @@ SDL_CreateRGBSurfaceWithFormat(Uint32 flags, int width, int height, int depth,
/* Get the pixels */
if (surface->w && surface->h) {
- surface->pixels = SDL_malloc(surface->h * surface->pitch);
+ int size = (surface->h * surface->pitch);
+ if (size < 0 || (size / surface->pitch) != surface->h) {
+ /* Overflow... */
+ SDL_FreeSurface(surface);
+ SDL_OutOfMemory();
+ return NULL;
+ }
+
+ surface->pixels = SDL_malloc(size);
if (!surface->pixels) {
SDL_FreeSurface(surface);
SDL_OutOfMemory();