===================================================================
RCS file: /cvsrepo/anoncvs/cvs/src/usr.bin/m4/gnum4.c,v
retrieving revision 1.48
retrieving revision 1.49
diff -c -r1.48 -r1.49
*** src/usr.bin/m4/gnum4.c	2015/03/14 23:00:43	1.48
--- src/usr.bin/m4/gnum4.c	2015/04/25 15:33:47	1.49
***************
*** 1,4 ****
! /* $OpenBSD: gnum4.c,v 1.48 2015/03/14 23:00:43 millert Exp $ */
  
  /*
   * Copyright (c) 1999 Marc Espie
--- 1,4 ----
! /* $OpenBSD: gnum4.c,v 1.49 2015/04/25 15:33:47 espie Exp $ */
  
  /*
   * Copyright (c) 1999 Marc Espie
***************
*** 208,215 ****
  	while (current + n > bufsize) {
  		if (bufsize == 0)
  			bufsize = 1024;
! 		else
  			bufsize *= 2;
  		buffer = xrealloc(buffer, bufsize, NULL);
  	}
  	memcpy(buffer+current, c, n);
--- 208,218 ----
  	while (current + n > bufsize) {
  		if (bufsize == 0)
  			bufsize = 1024;
! 		else if (bufsize <= SIZE_MAX/2) {
  			bufsize *= 2;
+ 		} else {
+ 			errx(1, "size overflow");
+ 		}
  		buffer = xrealloc(buffer, bufsize, NULL);
  	}
  	memcpy(buffer+current, c, n);