Update to 8.70. Changes include:

- This release fixes a large number of issues with transparency,
  especially as it interacts with color space conversion, mask
  contexts and patterns. There have also been a number of
  significant fixes to font handling, especially when generating
  PDF. And there are numerous robustness, correctness and
  performance improvements.

- New generic Esc/Page devices, eplmono and eplcolor were added
  to the contrib directory. A new cdnj500 device was added to
  support the HP DesignJet 500.

- The licensing of the Free version of the core Ghostscript code
  has been changed to GPLv3 or later. Previously, the core code
  was GPLv2 only. Ghostscript can now be used with GPLv3
  applications, and can no longer be used with applications that
  are GPLv2-only.

- This release also includes security fixes addressing
  CVE-2009-0583 and CVE-2009-0792.

[Incompatible changes]

- The size of PostScript integers has been limited to 32
  bits. Previously they used the C long type resulting in 64 bits
  of precision on LP64 systems (like on x86_64). As of this
  release all platforms match the recommended implementation
  limits in the specification.

8 files changed, 35 insertions, 1040 deletions

diff --git a/print/ghostscript8/Makefile b/print/ghostscript8/Makefile
index 4c2b2bd2105a..778d36aa1f53 100644
--- a/print/ghostscript8/Makefile
+++ b/print/ghostscript8/Makefile
@@ -6,8 +6,7 @@
 #
 
 PORTNAME=	ghostscript8
-PORTVERSION=	8.64
-PORTREVISION=	7
+PORTVERSION=	8.70
 CATEGORIES=	print
 MASTER_SITES=	SF/ghostscript/GPL%20Ghostscript/${PORTVERSION}:gs_srcs \
 		ftp://mirror.cs.wisc.edu/pub/mirrors/ghost/GPL/gs${PORTVERSION:S/.//}/:gs_srcs \
diff --git a/print/ghostscript8/Makefile.drivers b/print/ghostscript8/Makefile.drivers
index 55346e086502..962992bcd72d 100644
--- a/print/ghostscript8/Makefile.drivers
+++ b/print/ghostscript8/Makefile.drivers
@@ -122,6 +122,8 @@ GS_lp8500c	"D: Epson LP-8500C color laser printer"	${OPTIONS_GS_DEFAULT_ON} \
 GS_lp3000c	"D: Epson LP-3000C color laser printer"	${OPTIONS_GS_DEFAULT_ON} \
 GS_lp8200c	"D: Epson LP-8200C color laser printer"	${OPTIONS_GS_DEFAULT_ON} \
 GS_lp8000c	"D: Epson LP-8000C color laser printer"	${OPTIONS_GS_DEFAULT_ON} \
+GS_eplmono	"D: Epson Esc/Page Generic driver, mono"	${OPTIONS_GS_DEFAULT_ON} \
+GS_eplcolor	"D: Epson Esc/Page Generic driver, color"	${OPTIONS_GS_DEFAULT_ON} \
 GS_epl6100	"D: Epson EPL-6100 laser printer"	${OPTIONS_GS_DEFAULT_ON} \
 GS_epl5900	"D: Epson EPL-5900 laser printer"	${OPTIONS_GS_DEFAULT_ON} \
 GS_epl5800	"D: Epson EPL-5800 laser printer"	${OPTIONS_GS_DEFAULT_ON} \
@@ -163,6 +165,7 @@ GS_photoex	"D: Epson Stylus Color Photo/Photo EX/Photo 700"	${OPTIONS_GS_DEFAULT
 GS_fmlbp	"D: Fujitsu contrib2xx Page Printer"	${OPTIONS_GS_DEFAULT_ON} \
 GS_fmpr		"D: Fujitsu contrib"	${OPTIONS_GS_DEFAULT_ON} \
 GS_lp2563	"D: HP 2563B line printer"	${OPTIONS_GS_DEFAULT_ON} \
+GS_cdnj500	"D: HP DesignJet 500"	${OPTIONS_GS_DEFAULT_ON} \
 GS_dnj650c	"D: HP DesignJet 650C"	${OPTIONS_GS_DEFAULT_ON} \
 GS_deskjet	"D: HP DeskJet and DeskJet Plus"	${OPTIONS_GS_DEFAULT_ON} \
 GS_djet500	"D: HP DeskJet 500 (for DeskJet 600 use -r600)"	${OPTIONS_GS_DEFAULT_ON} \
diff --git a/print/ghostscript8/distinfo b/print/ghostscript8/distinfo
index dd4f8868889e..2d73fde4f430 100644
--- a/print/ghostscript8/distinfo
+++ b/print/ghostscript8/distinfo
@@ -1,6 +1,6 @@
-MD5 (ghostscript/ghostscript-8.64.tar.bz2) = b13289cb2115f38f40c5e064f87e228a
-SHA256 (ghostscript/ghostscript-8.64.tar.bz2) = 012f7fec58480c728580836fec6f865588d8a33fe8ada7ae73b1f971440d02bb
-SIZE (ghostscript/ghostscript-8.64.tar.bz2) = 16921504
+MD5 (ghostscript/ghostscript-8.70.tar.bz2) = 526366f8cb4fda0d3d293597cc5b984b
+SHA256 (ghostscript/ghostscript-8.70.tar.bz2) = c889f2a3a27a4dbd3519197ffc0170d66f398da6a8252b2ebe0548d250f4acc8
+SIZE (ghostscript/ghostscript-8.70.tar.bz2) = 17019673
 MD5 (ghostscript/epag-3.09.tar.gz) = 63304a6afe44842124d2d880bf24dbe3
 SHA256 (ghostscript/epag-3.09.tar.gz) = ad10eca44c781a5851d5a8993dcd95b2e2b99392cbf2c8372a5a658f3b991b3b
 SIZE (ghostscript/epag-3.09.tar.gz) = 12858
diff --git a/print/ghostscript8/files/patch-CVE-2009-0583,0584 b/print/ghostscript8/files/patch-CVE-2009-0583,0584
deleted file mode 100644
index 71505e257c72..000000000000
--- a/print/ghostscript8/files/patch-CVE-2009-0583,0584
+++ /dev/null
@@ -1,989 +0,0 @@
---- icclib/icc.c.CVE-2009-0583,0584	2008-05-09 05:12:01.000000000 +0100
-+++ icclib/icc.c	2009-03-06 15:24:33.000000000 +0000
-@@ -152,6 +152,8 @@
-  *      Various bug fixes and enhancements.
-  */
- 
-+#include <limits.h>
-+#include <stdint.h>
- #include <stdio.h>
- #include <stdlib.h>
- #include <stdarg.h>
-@@ -313,8 +315,11 @@ size_t count
- 	icmFileMem *p = (icmFileMem *)pp;
- 	size_t len;
- 
-+	if (count > 0 && size > SIZE_MAX / count)
-+		return 0;
-+
- 	len = size * count;
--	if ((p->cur + len) >= p->end) {		/* Too much */
-+	if (len > (p->end - p->cur)) { /* Too much */
- 		if (size > 0)
- 			count = (p->end - p->cur)/size;
- 		else
-@@ -1634,6 +1639,8 @@ static int icmUInt8Array_write(
- 
- 	/* Allocate a file write buffer */
- 	len = p->get_size((icmBase *)p);
-+	if (icp->errc)
-+		return icp->errc;
- 	if ((buf = (char *) icp->al->malloc(icp->al, len)) == NULL) {
- 		sprintf(icp->err,"icmUInt8Array_write malloc() failed");
- 		return icp->errc = 2;
-@@ -1698,7 +1705,7 @@ static int icmUInt8Array_allocate(
- 	if (p->size != p->_size) {
- 		if (p->data != NULL)
- 			icp->al->free(icp->al, p->data);
--		if ((p->data = (unsigned int *) icp->al->malloc(icp->al, p->size * sizeof(unsigned int))) == NULL) {
-+		if ((p->data = (unsigned int *) icp->al->calloc(icp->al, p->size, sizeof(unsigned int))) == NULL) {
- 			sprintf(icp->err,"icmUInt8Array_alloc: malloc() of icmUInt8Array data failed");
- 			return icp->errc = 2;
- 		}
-@@ -1749,6 +1756,10 @@ static unsigned int icmUInt16Array_get_s
- 	icmUInt16Array *p = (icmUInt16Array *)pp;
- 	unsigned int len = 0;
- 	len += 8;			/* 8 bytes for tag and padding */
-+	if (p->size > (UINT_MAX - len) / 2) {
-+		p->icp->errc = 1;
-+		return (unsigned int) -1;
-+	}
- 	len += p->size * 2;	/* 2 bytes for each UInt16 */
- 	return len;
- }
-@@ -1821,6 +1832,8 @@ static int icmUInt16Array_write(
- 
- 	/* Allocate a file write buffer */
- 	len = p->get_size((icmBase *)p);
-+	if (icp->errc)
-+		return icp->errc;
- 	if ((buf = (char *) icp->al->malloc(icp->al, len)) == NULL) {
- 		sprintf(icp->err,"icmUInt16Array_write malloc() failed");
- 		return icp->errc = 2;
-@@ -1885,7 +1898,7 @@ static int icmUInt16Array_allocate(
- 	if (p->size != p->_size) {
- 		if (p->data != NULL)
- 			icp->al->free(icp->al, p->data);
--		if ((p->data = (unsigned int *) icp->al->malloc(icp->al, p->size * sizeof(unsigned int))) == NULL) {
-+		if ((p->data = (unsigned int *) icp->al->calloc(icp->al, p->size, sizeof(unsigned int))) == NULL) {
- 			sprintf(icp->err,"icmUInt16Array_alloc: malloc() of icmUInt16Array data failed");
- 			return icp->errc = 2;
- 		}
-@@ -1936,6 +1949,10 @@ static unsigned int icmUInt32Array_get_s
- 	icmUInt32Array *p = (icmUInt32Array *)pp;
- 	unsigned int len = 0;
- 	len += 8;			/* 8 bytes for tag and padding */
-+	if (p->size > (UINT_MAX - len) / 4) {
-+		p->icp->errc = 1;
-+		return (unsigned int) -1;
-+	}
- 	len += p->size * 4;	/* 4 bytes for each UInt32 */
- 	return len;
- }
-@@ -2008,6 +2025,8 @@ static int icmUInt32Array_write(
- 
- 	/* Allocate a file write buffer */
- 	len = p->get_size((icmBase *)p);
-+	if (icp->errc)
-+		return icp->errc;
- 	if ((buf = (char *) icp->al->malloc(icp->al, len)) == NULL) {
- 		sprintf(icp->err,"icmUInt32Array_write malloc() failed");
- 		return icp->errc = 2;
-@@ -2072,7 +2091,7 @@ static int icmUInt32Array_allocate(
- 	if (p->size != p->_size) {
- 		if (p->data != NULL)
- 			icp->al->free(icp->al, p->data);
--		if ((p->data = (unsigned int *) icp->al->malloc(icp->al, p->size * sizeof(unsigned int))) == NULL) {
-+		if ((p->data = (unsigned int *) icp->al->calloc(icp->al, p->size, sizeof(unsigned int))) == NULL) {
- 			sprintf(icp->err,"icmUInt32Array_alloc: malloc() of icmUInt32Array data failed");
- 			return icp->errc = 2;
- 		}
-@@ -2123,6 +2142,10 @@ static unsigned int icmUInt64Array_get_s
- 	icmUInt64Array *p = (icmUInt64Array *)pp;
- 	unsigned int len = 0;
- 	len += 8;			/* 8 bytes for tag and padding */
-+	if (p->size > (UINT_MAX - len) / 8) {
-+		p->icp->errc = 1;
-+		return (unsigned int) -1;
-+	}
- 	len += p->size * 8;	/* 8 bytes for each UInt64 */
- 	return len;
- }
-@@ -2195,6 +2218,8 @@ static int icmUInt64Array_write(
- 
- 	/* Allocate a file write buffer */
- 	len = p->get_size((icmBase *)p);
-+	if (icp->errc)
-+		return icp->errc;
- 	if ((buf = (char *) icp->al->malloc(icp->al, len)) == NULL) {
- 		sprintf(icp->err,"icmUInt64Array_write malloc() failed");
- 		return icp->errc = 2;
-@@ -2259,7 +2284,7 @@ static int icmUInt64Array_allocate(
- 	if (p->size != p->_size) {
- 		if (p->data != NULL)
- 			icp->al->free(icp->al, p->data);
--		if ((p->data = (icmUint64 *) icp->al->malloc(icp->al, p->size * sizeof(icmUint64))) == NULL) {
-+		if ((p->data = (icmUint64 *) icp->al->calloc(icp->al, p->size, sizeof(icmUint64))) == NULL) {
- 			sprintf(icp->err,"icmUInt64Array_alloc: malloc() of icmUInt64Array data failed");
- 			return icp->errc = 2;
- 		}
-@@ -2310,6 +2335,10 @@ static unsigned int icmU16Fixed16Array_g
- 	icmU16Fixed16Array *p = (icmU16Fixed16Array *)pp;
- 	unsigned int len = 0;
- 	len += 8;			/* 8 bytes for tag and padding */
-+	if (p->size > (UINT_MAX - len) / 4) {
-+		p->icp->errc = 1;
-+		return (unsigned int) -1;
-+	}
- 	len += p->size * 4;	/* 4 byte for each U16Fixed16 */
- 	return len;
- }
-@@ -2382,6 +2411,8 @@ static int icmU16Fixed16Array_write(
- 
- 	/* Allocate a file write buffer */
- 	len = p->get_size((icmBase *)p);
-+	if (icp->errc)
-+		return icp->errc;
- 	if ((buf = (char *) icp->al->malloc(icp->al, len)) == NULL) {
- 		sprintf(icp->err,"icmU16Fixed16Array_write malloc() failed");
- 		return icp->errc = 2;
-@@ -2446,7 +2477,7 @@ static int icmU16Fixed16Array_allocate(
- 	if (p->size != p->_size) {
- 		if (p->data != NULL)
- 			icp->al->free(icp->al, p->data);
--		if ((p->data = (double *) icp->al->malloc(icp->al, p->size * sizeof(double))) == NULL) {
-+		if ((p->data = (double *) icp->al->calloc(icp->al, p->size, sizeof(double))) == NULL) {
- 			sprintf(icp->err,"icmU16Fixed16Array_alloc: malloc() of icmU16Fixed16Array data failed");
- 			return icp->errc = 2;
- 		}
-@@ -2497,6 +2528,10 @@ static unsigned int icmS15Fixed16Array_g
- 	icmS15Fixed16Array *p = (icmS15Fixed16Array *)pp;
- 	unsigned int len = 0;
- 	len += 8;			/* 8 bytes for tag and padding */
-+	if (p->size > (UINT_MAX - len) / 4) {
-+		p->icp->errc = 1;
-+		return (unsigned int) - 1;
-+	}
- 	len += p->size * 4;	/* 4 byte for each S15Fixed16 */
- 	return len;
- }
-@@ -2569,6 +2604,8 @@ static int icmS15Fixed16Array_write(
- 
- 	/* Allocate a file write buffer */
- 	len = p->get_size((icmBase *)p);
-+	if (icp->errc)
-+		return icp->errc;
- 	if ((buf = (char *) icp->al->malloc(icp->al, len)) == NULL) {
- 		sprintf(icp->err,"icmS15Fixed16Array_write malloc() failed");
- 		return icp->errc = 2;
-@@ -2633,7 +2670,7 @@ static int icmS15Fixed16Array_allocate(
- 	if (p->size != p->_size) {
- 		if (p->data != NULL)
- 			icp->al->free(icp->al, p->data);
--		if ((p->data = (double *) icp->al->malloc(icp->al, p->size * sizeof(double))) == NULL) {
-+		if ((p->data = (double *) icp->al->calloc(icp->al, p->size, sizeof(double))) == NULL) {
- 			sprintf(icp->err,"icmS15Fixed16Array_alloc: malloc() of icmS15Fixed16Array data failed");
- 			return icp->errc = 2;
- 		}
-@@ -2726,6 +2763,10 @@ static unsigned int icmXYZArray_get_size
- 	icmXYZArray *p = (icmXYZArray *)pp;
- 	unsigned int len = 0;
- 	len += 8;				/* 8 bytes for tag and padding */
-+	if (p->size > (UINT_MAX - len) / 12) {
-+		p->icp->errc = 1;
-+		return (unsigned int) - 1;
-+	}
- 	len += p->size * 12;	/* 12 bytes for each XYZ */
- 	return len;
- }
-@@ -2798,6 +2839,8 @@ static int icmXYZArray_write(
- 
- 	/* Allocate a file write buffer */
- 	len = p->get_size((icmBase *)p);
-+	if (icp->errc)
-+		return icp->errc;
- 	if ((buf = (char *) icp->al->malloc(icp->al, len)) == NULL) {
- 		sprintf(icp->err,"icmXYZArray_write malloc() failed");
- 		return icp->errc = 2;
-@@ -2865,7 +2908,7 @@ static int icmXYZArray_allocate(
- 	if (p->size != p->_size) {
- 		if (p->data != NULL)
- 			icp->al->free(icp->al, p->data);
--		if ((p->data = (icmXYZNumber *) icp->al->malloc(icp->al, p->size * sizeof(icmXYZNumber))) == NULL) {
-+		if ((p->data = (icmXYZNumber *) icp->al->calloc(icp->al, p->size, sizeof(icmXYZNumber))) == NULL) {
- 			sprintf(icp->err,"icmXYZArray_alloc: malloc() of icmXYZArray data failed");
- 			return icp->errc = 2;
- 		}
-@@ -3001,7 +3044,7 @@ static int icmTable_setup_bwd(
- 			int nf;			/* Next free slot */
- 			if (rt->rlists[j] == NULL) {	/* No allocation */
- 				as = 5;						/* Start with space for 5 */
--				if ((rt->rlists[j] = (int *) icp->al->malloc(icp->al, sizeof(int) * as)) == NULL) {
-+				if ((rt->rlists[j] = (int *) icp->al->calloc(icp->al, sizeof(int), as)) == NULL) {
- 					return 2;
- 				}
- 				rt->rlists[j][0] = as;
-@@ -3141,6 +3184,10 @@ static unsigned int icmCurve_get_size(
- 	icmCurve *p = (icmCurve *)pp;
- 	unsigned int len = 0;
- 	len += 12;			/* 12 bytes for tag, padding and count */
-+	if (p->size > (UINT_MAX - len) / 2) {
-+		p->icp->errc = 1;
-+		return (unsigned int) - 1;
-+	}
- 	len += p->size * 2;	/* 2 bytes for each UInt16 */
- 	return len;
- }
-@@ -3238,6 +3285,8 @@ static int icmCurve_write(
- 
- 	/* Allocate a file write buffer */
- 	len = p->get_size((icmBase *)p);
-+	if (icp->errc)
-+		return icp->errc;
- 	if ((buf = (char *) icp->al->malloc(icp->al, len)) == NULL) {
- 		sprintf(icp->err,"icmCurve_write malloc() failed");
- 		return icp->errc = 2;
-@@ -3347,7 +3396,7 @@ static int icmCurve_allocate(
- 	if (p->size != p->_size) {
- 		if (p->data != NULL)
- 			icp->al->free(icp->al, p->data);
--		if ((p->data = (double *) icp->al->malloc(icp->al, p->size * sizeof(double))) == NULL) {
-+		if ((p->data = (double *) icp->al->calloc(icp->al, p->size, sizeof(double))) == NULL) {
- 			sprintf(icp->err,"icmCurve_alloc: malloc() of icmCurve data failed");
- 			return icp->errc = 2;
- 		}
-@@ -3493,6 +3542,8 @@ static int icmData_write(
- 
- 	/* Allocate a file write buffer */
- 	len = p->get_size((icmBase *)p);
-+	if (icp->errc)
-+		return icp->errc;
- 	if ((buf = (char *) icp->al->malloc(icp->al, len)) == NULL) {
- 		sprintf(icp->err,"icmData_write malloc() failed");
- 		return icp->errc = 2;
-@@ -3745,6 +3796,8 @@ static int icmText_write(
- 
- 	/* Allocate a file write buffer */
- 	len = p->get_size((icmBase *)p);
-+	if (icp->errc)
-+		return icp->errc;
- 	if ((buf = (char *) icp->al->malloc(icp->al, len)) == NULL) {
- 		sprintf(icp->err,"icmText_write malloc() failed");
- 		return icp->errc = 2;
-@@ -4038,6 +4091,8 @@ static int icmDateTimeNumber_write(
- 
- 	/* Allocate a file write buffer */
- 	len = p->get_size((icmBase *)p);
-+	if (icp->errc)
-+		return icp->errc;
- 	if ((buf = (char *) icp->al->malloc(icp->al, len)) == NULL) {
- 		sprintf(icp->err,"icmDateTimeNumber_write malloc() failed");
- 		return icp->errc = 2;
-@@ -4128,11 +4183,15 @@ static icmBase *new_icmDateTimeNumber(
- /* icmLut object */
- 
- /* Utility function - raise one integer to an integer power */
--static unsigned int uipow(unsigned int a, unsigned int b) {
-+static int uipow(unsigned int a, unsigned int b, unsigned int *ret) {
- 	unsigned int rv = 1;
--	for (; b > 0; b--)
-+	for (; b > 0; b--) {
-+		if (a > 0 && rv > UINT_MAX / a)
-+			return 1;
- 		rv *= a;
--	return rv;
-+	}
-+	*ret = rv;
-+	return 0;
- }
- 
- /* - - - - - - - - - - - - - - - - */
-@@ -4268,7 +4327,7 @@ double *in		/* Input array[outputChan] *
- 	if (p->inputChan <= 8) {
- 		gw = GW;				/* Use stack allocation */
- 	} else {
--		if ((gw = (double *) icp->al->malloc(icp->al, (1 << p->inputChan) * sizeof(double))) == NULL) {
-+		if ((gw = (double *) icp->al->calloc(icp->al, (1 << p->inputChan), sizeof(double))) == NULL) {
- 			sprintf(icp->err,"icmLut_lookup_clut: malloc() failed");
- 			return icp->errc = 2;
- 		}
-@@ -4819,19 +4878,50 @@ static unsigned int icmLut_get_size(
- ) {
- 	icmLut *p = (icmLut *)pp;
- 	unsigned int len = 0;
-+	unsigned int pw;
- 
- 	if (p->ttype == icSigLut8Type) {
- 		len += 48;			/* tag and header */
-+		if (p->inputChan > 0 &&
-+		    p->inputEnt > (UINT_MAX - len) / p->inputChan / 1)
-+			goto overflow;
-+
- 		len += 1 * (p->inputChan * p->inputEnt);
--		len += 1 * (p->outputChan * uipow(p->clutPoints,p->inputChan));
-+		if (uipow(p->clutPoints,p->inputChan, &pw) ||
-+		    (p->outputChan > 0 &&
-+		     pw > (UINT_MAX - len) / p->outputChan / 1))
-+			goto overflow;
-+
-+		len += 1 * (p->outputChan * pw);
-+		if (p->outputChan > 0 &&
-+		    p->outputEnt > (UINT_MAX - len) / p->outputChan / 1)
-+			goto overflow;
-+
- 		len += 1 * (p->outputChan * p->outputEnt);
- 	} else {
- 		len += 52;			/* tag and header */
-+		if (p->inputChan > 0 &&
-+		    p->inputEnt > (UINT_MAX - len) / p->inputChan / 2)
-+			goto overflow;
-+
- 		len += 2 * (p->inputChan * p->inputEnt);
--		len += 2 * (p->outputChan * uipow(p->clutPoints,p->inputChan));
-+		if (uipow(p->clutPoints,p->inputChan, &pw) ||
-+		    (p->outputChan > 0 &&
-+		     pw > (UINT_MAX - len) / p->outputChan / 2))
-+			goto overflow;
-+
-+		len += 2 * (p->outputChan * pw);
-+		if (p->outputChan > 0 &&
-+		    p->outputEnt > (UINT_MAX - len) / p->outputChan / 2)
-+			goto overflow;
-+
- 		len += 2 * (p->outputChan * p->outputEnt);
- 	}
- 	return len;
-+
-+  overflow:
-+	p->icp->errc = 1;
-+	return (unsigned int) -1;
- }
- 
- /* read the object, return 0 on success, error code on fail */
-@@ -4844,6 +4934,7 @@ static int icmLut_read(
- 	icc *icp = p->icp;
- 	int rv = 0;
- 	unsigned long i, j, g, size;
-+	unsigned int pw;
- 	char *bp, *buf;
- 
- 	if (len < 4) {
-@@ -4904,6 +4995,11 @@ static int icmLut_read(
- 		return icp->errc = 1;
- 	}
- 
-+	if (p->clutPoints > 100) {
-+		sprintf(icp->err,"icmLut_read: too many clutPoints");
-+		return icp->errc = 1;
-+	}
-+
- 	/* Read 3x3 transform matrix */
- 	for (j = 0; j < 3; j++) {		/* Rows */
- 		for (i = 0; i < 3; i++) {	/* Columns */
-@@ -4921,13 +5017,18 @@ static int icmLut_read(
- 		bp = buf+52;
- 	}
- 
--	if (len < icmLut_get_size((icmBase *)p)) {
-+	if (len < icmLut_get_size((icmBase *)p) || icp->errc) {
- 		sprintf(icp->err,"icmLut_read: Tag too small for contents");
- 		icp->al->free(icp->al, buf);
- 		return icp->errc = 1;
- 	}
- 
- 	/* Read the input tables */
-+	if (p->inputEnt > 0 && p->inputChan > UINT_MAX / p->inputEnt) {
-+		sprintf(icp->err,"icmLut_read: overflow");
-+		icp->al->free(icp->al, buf);
-+		return icp->errc = 1;
-+	}
- 	size = (p->inputChan * p->inputEnt);
- 	if ((rv = p->allocate((icmBase *)p)) != 0) {
- 		icp->al->free(icp->al, buf);
-@@ -4942,7 +5043,14 @@ static int icmLut_read(
- 	}
- 
- 	/* Read the clut table */
--	size = (p->outputChan * uipow(p->clutPoints,p->inputChan));
-+	if (uipow(p->clutPoints,p->inputChan,&pw) ||
-+	    (p->outputChan > 0 &&
-+	     pw > UINT_MAX / p->outputChan)) {
-+		sprintf(icp->err,"icmLut_read: overflow");
-+		icp->al->free(icp->al, buf);
-+		return icp->errc = 1;
-+	}
-+	size = (p->outputChan * pw);
- 	if ((rv = p->allocate((icmBase *)p)) != 0) {
- 		icp->al->free(icp->al, buf);
- 		return rv;
-@@ -4956,6 +5064,11 @@ static int icmLut_read(
- 	}
- 
- 	/* Read the output tables */
-+	if (p->outputChan > 0 && p->outputEnt > UINT_MAX / p->outputChan) {
-+		sprintf(icp->err,"icmLut_read: overflow");
-+		icp->al->free(icp->al, buf);
-+		return icp->errc = 1;
-+	}
- 	size = (p->outputChan * p->outputEnt);
- 	if ((rv = p->allocate((icmBase *)p)) != 0) {
- 		icp->al->free(icp->al, buf);
-@@ -4995,12 +5108,14 @@ static int icmLut_write(
- 	icmLut *p = (icmLut *)pp;
- 	icc *icp = p->icp;
- 	unsigned long i,j;
--	unsigned int len, size;
-+	unsigned int len, size, pw;
- 	char *bp, *buf;		/* Buffer to write from */
- 	int rv = 0;
- 
- 	/* Allocate a file write buffer */
- 	len = p->get_size((icmBase *)p);
-+	if (icp->errc)
-+		return icp->errc;
- 	if ((buf = (char *) icp->al->malloc(icp->al, len)) == NULL) {
- 		sprintf(icp->err,"icmLut_write malloc() failed");
- 		return icp->errc = 2;
-@@ -5066,6 +5181,11 @@ static int icmLut_write(
- 	}
- 
- 	/* Write the input tables */
-+	if (p->inputEnt > 0 && p->inputChan > UINT_MAX / p->inputEnt) {
-+		sprintf(icp->err,"icmLut_write: overflow");
-+		icp->al->free(icp->al, buf);
-+		return icp->errc = 1;
-+	}
- 	size = (p->inputChan * p->inputEnt);
- 	if (p->ttype == icSigLut8Type) {
- 		for (i = 0; i < size; i++, bp += 1) {
-@@ -5086,7 +5206,14 @@ static int icmLut_write(
- 	}
- 
- 	/* Write the clut table */
--	size = (p->outputChan * uipow(p->clutPoints,p->inputChan));
-+	if (uipow(p->clutPoints,p->inputChan,&pw) ||
-+	    (p->outputChan > 0 &&
-+	     pw > UINT_MAX / p->outputChan)) {
-+		sprintf(icp->err,"icmLut_write: overflow");
-+		icp->al->free(icp->al, buf);
-+		return icp->errc = 1;
-+	}
-+	size = (p->outputChan * pw);
- 	if (p->ttype == icSigLut8Type) {
- 		for (i = 0; i < size; i++, bp += 1) {
- 			if ((rv = write_DCS8Number(p->clutTable[i], bp)) != 0) {
-@@ -5106,6 +5233,11 @@ static int icmLut_write(
- 	}
- 
- 	/* Write the output tables */
-+	if (p->outputChan > 0 && p->outputEnt > UINT_MAX / p->outputChan) {
-+		sprintf(icp->err,"icmLut_write: overflow");
-+		icp->al->free(icp->al, buf);
-+		return icp->errc = 1;
-+	}
- 	size = (p->outputChan * p->outputEnt);
- 	if (p->ttype == icSigLut8Type) {
- 		for (i = 0; i < size; i++, bp += 1) {
-@@ -5177,7 +5309,14 @@ static void icmLut_dump(
- 		if (p->inputChan > MAX_CHAN) {
- 			fprintf(op,"  !!Can't dump > %d input channel CLUT table!!\n",MAX_CHAN);
- 		} else {
--			size = (p->outputChan * uipow(p->clutPoints,p->inputChan));
-+			unsigned int pw;
-+			if (uipow(p->clutPoints,p->inputChan,&pw) ||
-+			    (p->outputChan > 0 &&
-+			     pw > UINT_MAX / p->outputChan)) {
-+				fprintf(op,"Would overflow.\n");
-+				return;
-+			}
-+			size = (p->outputChan * pw);
- 			for (j = 0; j < p->inputChan; j++)
- 				ii[j] = 0;
- 			for (i = 0; i < size;) {
-@@ -5216,7 +5355,7 @@ static void icmLut_dump(
- static int icmLut_allocate(
- 	icmBase *pp
- ) {
--	unsigned int i, j, g, size;
-+	unsigned int i, j, g, size, pw;
- 	icmLut *p = (icmLut *)pp;
- 	icc *icp = p->icp;
- 
-@@ -5231,6 +5370,10 @@ static int icmLut_allocate(
- 		return icp->errc = 1;
- 	}
- 
-+	if (p->inputEnt > 0 && p->inputChan > UINT_MAX / p->inputEnt) {
-+		sprintf(icp->err,"icmLut_alloc: too many entries");
-+		return icp->errc = 1;
-+	}
- 	size = (p->inputChan * p->inputEnt);
- 	if (size != p->inputTable_size) {
- 		if (p->inputTable != NULL)
-@@ -5241,7 +5384,13 @@ static int icmLut_allocate(
- 		}
- 		p->inputTable_size = size;
- 	}
--	size = (p->outputChan * uipow(p->clutPoints,p->inputChan));
-+	if (uipow(p->clutPoints,p->inputChan,&pw) ||
-+	    (p->outputChan > 0 &&
-+	     pw > UINT_MAX / p->outputChan)) {
-+		sprintf(icp->err,"icmLut_alloc: overflow");
-+		return icp->errc = 1;
-+	}
-+	size = (p->outputChan * pw);
- 	if (size != p->clutTable_size) {
- 		if (p->clutTable != NULL)
- 			icp->al->free(icp->al, p->clutTable);
-@@ -5251,6 +5400,10 @@ static int icmLut_allocate(
- 		}
- 		p->clutTable_size = size;
- 	}
-+	if (p->outputChan > 0 && p->outputEnt > UINT_MAX / p->outputChan) {
-+		sprintf(icp->err,"icmLut_alloc: overflow");
-+		return icp->errc = 1;
-+	}
- 	size = (p->outputChan * p->outputEnt);
- 	if (size != p->outputTable_size) {
- 		if (p->outputTable != NULL)
-@@ -5441,6 +5594,8 @@ static int icmMeasurement_write(
- 
- 	/* Allocate a file write buffer */
- 	len = p->get_size((icmBase *)p);
-+	if (icp->errc)
-+		return icp->errc;
- 	if ((buf = (char *) icp->al->malloc(icp->al, len)) == NULL) {
- 		sprintf(icp->err,"icmMeasurement_write malloc() failed");
- 		return icp->errc = 2;
-@@ -5712,13 +5867,20 @@ static unsigned int icmNamedColor_get_si
- 			len += p->nDeviceCoords * 1;	/* bytes for each named color */
- 		}
- 	} else {	/* Named Color 2 */
-+		unsigned int col;
- 		len += 8;			/* 8 bytes for tag and padding */
- 		len += 4;			/* 4 for vendor specific flags */
- 		len += 4;			/* 4 for count of named colors */
- 		len += 4;			/* 4 for number of device coords */
- 		len += 32;			/* 32 for prefix of color names */
- 		len += 32;			/* 32 for suffix of color names */
--		len += p->count * (32 + 6 + p->nDeviceCoords * 2);	/* bytes for each named color */
-+		col = 32 + 6 + p->nDeviceCoords * 2;
-+		if (p->nDeviceCoords > (UINT_MAX - (32 + 6)) / 2 ||
-+		    (p->count > 0 && col > (UINT_MAX - len) / p->count)) {
-+			p->icp->errc = 1;
-+			return (unsigned int) -1;
-+		}
-+		len += p->count * col;	/* bytes for each named color */
- 	}
- 	return len;
- }
-@@ -5882,6 +6044,8 @@ static int icmNamedColor_write(
- 
- 	/* Allocate a file write buffer */
- 	len = p->get_size((icmBase *)p);
-+	if (icp->errc)
-+		return icp->errc;
- 	if ((buf = (char *) icp->al->malloc(icp->al, len)) == NULL) {
- 		sprintf(icp->err,"icmNamedColor_write malloc() failed");
- 		return icp->errc = 2;
-@@ -6109,9 +6273,22 @@ static unsigned int icmTextDescription_g
- ) {
- 	icmTextDescription *p = (icmTextDescription *)pp;
- 	unsigned int len = 0;
-+	if (p->size > UINT_MAX - (8 + 4 + 8)) {
-+		p->icp->errc = 1;
-+		return (unsigned int) -1;
-+	}
- 	len += 8;			/* 8 bytes for tag and padding */
- 	len += 4 + p->size;	/* Ascii string length + ascii string */
--	len += 8 + 2 * p->ucSize;	/* Unicode language code + length + string */
-+	len += 8;               /* Unicode language code + length */
-+	if (p->ucSize > (UINT_MAX - len) / 2) {
-+		p->icp->errc = 1;
-+		return (unsigned int) -1;
-+	}
-+	len += 2 * p->ucSize;    /* Unicode string */
-+	if (len > (UINT_MAX - (3 + 67))) {
-+		p->icp->errc = 1;
-+		return (unsigned int) -1;
-+	}
- 	len += 3 + 67;		/* ScriptCode code, length string */
- 	return len;
- }
-@@ -6294,6 +6471,8 @@ static int icmTextDescription_write(
- 
- 	/* Allocate a file write buffer */
- 	len = p->get_size((icmBase *)p);
-+	if (icp->errc)
-+		return icp->errc;
- 	if ((buf = (char *) icp->al->malloc(icp->al, len)) == NULL) {
- 		sprintf(icp->err,"icmTextDescription_write malloc() failed");
- 		return icp->errc = 2;
-@@ -6544,7 +6723,7 @@ static int icmTextDescription_allocate(
- 	if (p->ucSize != p->uc_size) {
- 		if (p->ucDesc != NULL)
- 			icp->al->free(icp->al, p->ucDesc);
--		if ((p->ucDesc = (ORD16 *) icp->al->malloc(icp->al, p->ucSize * sizeof(ORD16))) == NULL) {
-+		if ((p->ucDesc = (ORD16 *) icp->al->calloc(icp->al, p->ucSize, sizeof(ORD16))) == NULL) {
- 			sprintf(icp->err,"icmTextDescription_alloc: malloc() of Unicode description failed");
- 			return icp->errc = 2;
- 		}
-@@ -6820,6 +6999,12 @@ static int icmProfileSequenceDesc_read(
- 	bp += 8;	/* Skip padding */
- 
- 	p->count = read_UInt32Number(bp);	/* Number of sequence descriptions */
-+	if (p->count > 1000) {
-+		sprintf(icp->err,"icmProfileSequenceDesc_read: too many sequence descriptions");
-+		icp->al->free(icp->al, buf);
-+		return icp->errc = 1;
-+	}
-+
- 	bp += 4;
- 
- 	/* Read all the sequence descriptions */
-@@ -6852,6 +7037,8 @@ static int icmProfileSequenceDesc_write(
- 
- 	/* Allocate a file write buffer */
- 	len = p->get_size((icmBase *)p);
-+	if (icp->errc)
-+		return icp->errc;
- 	if ((buf = (char *) icp->al->malloc(icp->al, len)) == NULL) {
- 		sprintf(icp->err,"icmProfileSequenceDesc_write malloc() failed");
- 		return icp->errc = 2;
-@@ -6922,7 +7109,7 @@ static int icmProfileSequenceDesc_alloca
- 	if (p->count != p->_count) {
- 		if (p->data != NULL)
- 			icp->al->free(icp->al, p->data);
--		if ((p->data = (icmDescStruct *) icp->al->malloc(icp->al, p->count * sizeof(icmDescStruct))) == NULL) {
-+		if ((p->data = (icmDescStruct *) icp->al->calloc(icp->al, p->count, sizeof(icmDescStruct))) == NULL) {
- 			sprintf(icp->err,"icmProfileSequenceDesc_allocate Allocation of DescStruct array failed");
- 			return icp->errc = 2;
- 		}
-@@ -7041,6 +7228,8 @@ static int icmSignature_write(
- 
- 	/* Allocate a file write buffer */
- 	len = p->get_size((icmBase *)p);
-+	if (icp->errc)
-+		return icp->errc;
- 	if ((buf = (char *) icp->al->malloc(icp->al, len)) == NULL) {
- 		sprintf(icp->err,"icmSignature_write malloc() failed");
- 		return icp->errc = 2;
-@@ -7156,6 +7345,10 @@ static unsigned int icmScreening_get_siz
- 	icmScreening *p = (icmScreening *)pp;
- 	unsigned int len = 0;
- 	len += 16;				/* 16 bytes for tag, padding, flag & channeles */
-+	if (p->channels > (UINT_MAX - len) / 12) {
-+		p->icp->errc = 1;
-+		return (unsigned int) -1;
-+	}
- 	len += p->channels * 12;	/* 12 bytes for each channel */
- 	return len;
- }
-@@ -7235,6 +7428,8 @@ static int icmScreening_write(
- 
- 	/* Allocate a file write buffer */
- 	len = p->get_size((icmBase *)p);
-+	if (icp->errc)
-+		return icp->errc;
- 	if ((buf = (char *) icp->al->malloc(icp->al, len)) == NULL) {
- 		sprintf(icp->err,"icmScreening_write malloc() failed");
- 		return icp->errc = 2;
-@@ -7315,7 +7510,7 @@ static int icmScreening_allocate(
- 	if (p->channels != p->_channels) {
- 		if (p->data != NULL)
- 			icp->al->free(icp->al, p->data);
--		if ((p->data = (icmScreeningData *) icp->al->malloc(icp->al, p->channels * sizeof(icmScreeningData))) == NULL) {
-+		if ((p->data = (icmScreeningData *) icp->al->calloc(icp->al, p->channels, sizeof(icmScreeningData))) == NULL) {
- 			sprintf(icp->err,"icmScreening_alloc: malloc() of icmScreening data failed");
- 			return icp->errc = 2;
- 		}
-@@ -7366,10 +7561,20 @@ static unsigned int icmUcrBg_get_size(
- 	icmUcrBg *p = (icmUcrBg *)pp;
- 	unsigned int len = 0;
- 	len += 8;			/* 8 bytes for tag and padding */
-+	if (p->UCRcount > (UINT_MAX - len - 4) / 2)
-+		goto overflow;
-+
- 	len += 4 + p->UCRcount * 2;	/* Undercolor Removal */
-+	if (p->BGcount > (UINT_MAX - len - 4 - p->size) / 2)
-+		goto overflow;
-+
- 	len += 4 + p->BGcount * 2;	/* Black Generation */
- 	len += p->size;				/* Description string */
- 	return len;
-+
-+ overflow:
-+	p->icp->errc = 1;
-+	return (unsigned int) -1;
- }
- 
- /* read the object, return 0 on success, error code on fail */
-@@ -7498,6 +7703,8 @@ static int icmUcrBg_write(
- 
- 	/* Allocate a file write buffer */
- 	len = p->get_size((icmBase *)p);
-+	if (icp->errc)
-+		return icp->errc;
- 	if ((buf = (char *) icp->al->malloc(icp->al, len)) == NULL) {
- 		sprintf(icp->err,"icmUcrBg_write malloc() failed");
- 		return icp->errc = 2;
-@@ -7663,7 +7870,7 @@ static int icmUcrBg_allocate(
- 	if (p->UCRcount != p->UCR_count) {
- 		if (p->UCRcurve != NULL)
- 			icp->al->free(icp->al, p->UCRcurve);
--		if ((p->UCRcurve = (double *) icp->al->malloc(icp->al, p->UCRcount * sizeof(double))) == NULL) {
-+		if ((p->UCRcurve = (double *) icp->al->calloc(icp->al, p->UCRcount, sizeof(double))) == NULL) {
- 			sprintf(icp->err,"icmUcrBg_allocate: malloc() of UCR curve data failed");
- 			return icp->errc = 2;
- 		}
-@@ -7672,7 +7879,7 @@ static int icmUcrBg_allocate(
- 	if (p->BGcount != p->BG_count) {
- 		if (p->BGcurve != NULL)
- 			icp->al->free(icp->al, p->BGcurve);
--		if ((p->BGcurve = (double *) icp->al->malloc(icp->al, p->BGcount * sizeof(double))) == NULL) {
-+		if ((p->BGcurve = (double *) icp->al->calloc(icp->al, p->BGcount, sizeof(double))) == NULL) {
- 			sprintf(icp->err,"icmUcrBg_allocate: malloc() of BG curve data failed");
- 			return icp->errc = 2;
- 		}
-@@ -7743,6 +7950,15 @@ static unsigned int icmVideoCardGamma_ge
- 		len += 2;       /* 2 bytes for channels */
- 		len += 2;       /* 2 for entry count */
- 		len += 2;       /* 2 for entry size */
-+		if (p->u.table.entryCount > 0 &&
-+		    p->u.table.entrySize > 0 &&
-+		    p->u.table.channels >
-+		    (UINT_MAX - len) /
-+		    p->u.table.entryCount /
-+		    p->u.table.entrySize) {
-+			p->icp->errc = 1;
-+			return (unsigned int) -1;
-+		}
- 		len += ( p->u.table.channels *     /* compute table size */
- 				 p->u.table.entryCount *
- 				 p->u.table.entrySize );
-@@ -7762,10 +7978,11 @@ static int icmVideoCardGamma_read(
- ) {
- 	icmVideoCardGamma *p = (icmVideoCardGamma *)pp;
- 	icc *icp = p->icp;
--	int rv, c;
-+	int rv;
- 	char *bp, *buf;
- 	unsigned char *pchar;
- 	unsigned short *pshort;
-+	unsigned long c;
- 
- 	if (len < 18) {
- 		sprintf(icp->err,"icmVideoCardGamma_read: Tag too small to be legal");
-@@ -7803,6 +8020,16 @@ static int icmVideoCardGamma_read(
- 		p->u.table.channels   = read_UInt16Number(bp+12);
- 		p->u.table.entryCount = read_UInt16Number(bp+14);
- 		p->u.table.entrySize  = read_UInt16Number(bp+16);
-+		if (p->u.table.entrySize > 65530 || p->u.table.entrySize == 0) {
-+			sprintf(icp->err,"icmVideoCardGamma_read: Too many entries (or none)");
-+			return icp->errc = 1;
-+		}
-+		if (p->u.table.entryCount > 0 && p->u.table.entrySize > 0 &&
-+		    p->u.table.channels >
-+		    UINT_MAX / p->u.table.entryCount / p->u.table.entrySize) {
-+			sprintf(icp->err,"icmVideoCardGamma_read: Overflow reading tag");
-+			return icp->errc = 1;
-+		}
- 		if (len-18 < p->u.table.channels*p->u.table.entryCount*p->u.table.entrySize) {
- 			sprintf(icp->err,"icmVideoCardGamma_read: Tag too small to be legal");
- 			return icp->errc = 1;
-@@ -7871,6 +8098,8 @@ static int icmVideoCardGamma_write(
- 
- 	/* Allocate a file write buffer */
- 	len = p->get_size((icmBase *)p);
-+	if (icp->errc)
-+		return icp->errc;
- 	if ((buf = (char *) icp->al->malloc(icp->al, len)) == NULL) {
- 		sprintf(icp->err,"icmViewingConditions_write malloc() failed");
- 		return icp->errc = 2;
-@@ -8049,7 +8278,7 @@ static int icmVideoCardGamma_allocate(
- ) {
- 	icmVideoCardGamma *p = (icmVideoCardGamma *)pp;
- 	icc *icp = p->icp;
--	int size;
-+	unsigned int size;
- 
- 	/* note: allocation is only relevant for table type
- 	 * and in that case the channels, entryCount, and entrySize
-@@ -8059,6 +8288,11 @@ static int icmVideoCardGamma_allocate(
- 	if (p->tagType == icmVideoCardGammaTableType) {
- 		if (p->u.table.data != NULL)
- 			icp->al->free(icp->al, p->u.table.data);
-+		if (p->u.table.entryCount > 0 &&
-+		    p->u.table.channels > UINT_MAX / p->u.table.entryCount) {
-+			sprintf(icp->err,"icmVideoCardGamma_alloc: table too large");
-+			return icp->errc = 1;
-+		}
- 		size = (p->u.table.channels *
- 				p->u.table.entryCount);
- 		switch (p->u.table.entrySize) {
-@@ -8066,6 +8300,10 @@ static int icmVideoCardGamma_allocate(
- 			size *= sizeof(unsigned char);
- 			break;
- 		case 2:
-+			if (size > UINT_MAX / sizeof(unsigned short)) {
-+				sprintf(icp->err,"icmVideoCardGamma_alloc: table too large");
-+				return icp->errc = 1;
-+			}
- 			size *= sizeof(unsigned short);
- 			break;
- 		default:
-@@ -8201,6 +8439,8 @@ static int icmViewingConditions_write(
- 
- 	/* Allocate a file write buffer */
- 	len = p->get_size((icmBase *)p);
-+	if (icp->errc)
-+		return icp->errc;
- 	if ((buf = (char *) icp->al->malloc(icp->al, len)) == NULL) {
- 		sprintf(icp->err,"icmViewingConditions_write malloc() failed");
- 		return icp->errc = 2;
-@@ -8433,6 +8673,8 @@ static int icmCrdInfo_write(
- 
- 	/* Allocate a file write buffer */
- 	len = p->get_size((icmBase *)p);
-+	if (icp->errc)
-+		return icp->errc;
- 	if ((buf = (char *) icp->al->malloc(icp->al, len)) == NULL) {
- 		sprintf(icp->err,"icmCrdInfo_write malloc() failed");
- 		return icp->errc = 2;
-@@ -8736,6 +8978,8 @@ static int icmHeader_write(
- 	int rv = 0;
- 
- 	len = p->get_size(p);
-+	if (icp->errc)
-+		return icp->errc;
- 	if ((buf = (char *) icp->al->calloc(icp->al,1,len)) == NULL) {			/* Zero it - some CMS are fussy */
- 		sprintf(icp->err,"icmHeader_write calloc() failed");
- 		return icp->errc = 2;
-@@ -9245,13 +9489,23 @@ static int icc_read(
- 	}
- 
- 	p->count = read_UInt32Number(tcbuf);		/* Tag count */
-+	if (p->count > 100) {
-+		sprintf(p->err,"icc_read: too many table tags");
-+		return p->errc = 1;
-+	}
- 	if (p->count > 0) {
- 		char *bp, *buf;
--		if ((p->data = (icmTag *) p->al->malloc(p->al, p->count * sizeof(icmTag))) == NULL) {
-+		if ((p->data = (icmTag *) p->al->calloc(p->al, p->count, sizeof(icmTag))) == NULL) {
- 			sprintf(p->err,"icc_read: Tag table malloc() failed");
- 			return p->errc = 2;
- 		}
- 	
-+		if (p->count > (UINT_MAX - 4) / 12) {
-+			sprintf(p->err,"icc_read: overflow");
-+			p->al->free(p->al, p->data);
-+			p->data = NULL;
-+			return p->errc = 1;
-+		}
- 		len = 4 + p->count * 12;
- 		if ((buf = (char *) p->al->malloc(p->al, len)) == NULL) {
- 			sprintf(p->err,"icc_read: Tag table read buffer malloc() failed");
-@@ -9281,6 +9535,14 @@ static int icc_read(
- 	    	    return p->errc = 1;
- 	    	}
- 	    	p->data[i].size = read_UInt32Number(bp + 8);	
-+			if (p->data[i].offset + p->data[i].size >
-+			    p->header->size) {
-+				sprintf(p->err,"icc_read: tag out of bounds");
-+				p->al->free(p->al, p->data);
-+				p->data = NULL;
-+				p->al->free(p->al, buf);
-+				return p->errc = 1;
-+			}
- 			if (   p->fp->seek(p->fp, of + p->data[i].offset) != 0
- 			    || p->fp->read(p->fp, tcbuf, 1, 4) != 4) {
- 				sprintf(p->err,"icc_read: fseek() or fread() failed on tag headers");
-@@ -9321,8 +9583,14 @@ static unsigned int icc_get_size(
- 	}
- 
- 	size += p->header->get_size(p->header);
-+	if (p->errc)
-+		return (unsigned int) -1;
- 
- 	size = DO_ALIGN(size);
-+	if (size == 0 || p->count > (UINT_MAX - 4 - size) / 12) {
-+		p->errc = 1;
-+		return (unsigned int) -1;
-+	}
- 	size += 4 + p->count * 12;	/* Tag table length */
- 	
- 	/* Reset touched flag for each tag type */
-@@ -9337,8 +9605,13 @@ static unsigned int icc_get_size(
- 	/* Get size for each tag type, skipping links */
- 	for (i = 0; i < p->count; i++) {
- 		if (p->data[i].objp->touched == 0) { /* Not alllowed for previously */
-+			unsigned int obj_size;
- 			size = DO_ALIGN(size);
--			size += p->data[i].objp->get_size(p->data[i].objp);
-+			obj_size = p->data[i].objp->get_size(p->data[i].objp);
-+			if (size == 0 || p->errc ||
-+			    obj_size > UINT_MAX - size)
-+				return (unsigned int) -1;
-+			size += obj_size;
- 			p->data[i].objp->touched = 1;	/* Don't account for this again */
- 		}
- 	}
-@@ -9373,9 +9646,19 @@ static int icc_write(
- 	}
- 
- 	size += p->header->get_size(p->header);
-+	if (p->errc)
-+		return p->errc;
- 
-+	if (p->count > (UINT_MAX - 4 - len) / 12) {
-+		sprintf(p->err,"icc_write: too many tags");
-+		return p->errc = 1;
-+	}
- 	len = 4 + p->count * 12;	/* Tag table length */
- 	size = DO_ALIGN(size);
-+	if (size == 0 || size > UINT_MAX - len) {
-+		sprintf(p->err,"icc_write: overflow writing tag table");
-+		return p->errc = 1;
-+	}
- 	size += len;
- 	
- 	/* Allocate memory buffer for tag table */
-@@ -9406,6 +9689,12 @@ static int icc_write(
- 			size = DO_ALIGN(size);
- 			p->data[i].offset = size;			/* Profile relative target */
- 			p->data[i].size = p->data[i].objp->get_size(p->data[i].objp);
-+			if (size == 0 ||
-+			    p->errc || p->data[i].size > UINT_MAX - size) {
-+				sprintf(p->err,"icc_write: internal error - overflow?");
-+				p->al->free(p->al, buf);
-+				return p->errc;
-+			}
- 			size += p->data[i].size;
- 			p->data[i].objp->touched = 1;	/* Allocated space for it */
- 		} else { /* must be linked - copy allocation */
-@@ -9529,6 +9818,11 @@ static icmBase *icc_add_tag(
- 	}
- 
- 	/* Make space in tag table for new tag item */
-+	if (p->count > (UINT_MAX / sizeof(icmTag)) - 1) {
-+		sprintf(p->err,"icc_add_tag: overflow");
-+		p->errc = 1;
-+		return NULL;
-+	}
- 	if (p->data == NULL)
- 		tp = p->al->malloc(p->al, (p->count+1) * sizeof(icmTag));
- 	else
-@@ -9612,6 +9906,11 @@ static icmBase *icc_link_tag(
- 	}
- 
- 	/* Make space in tag table for new tag item */
-+	if (p->count > (UINT_MAX / sizeof(icmTag)) - 1) {
-+		sprintf(p->err,"icc_link_tag: overflow");
-+		p->errc = 1;
-+		return NULL;
-+	}
- 	if (p->data == NULL)
- 		tp = p->al->malloc(p->al, (p->count+1) * sizeof(icmTag));
- 	else
-
diff --git a/print/ghostscript8/files/patch-Resource-Init-cidfmap b/print/ghostscript8/files/patch-Resource-Init-cidfmap
index f51d0be6848c..8ed71789f4fe 100644
--- a/print/ghostscript8/files/patch-Resource-Init-cidfmap
+++ b/print/ghostscript8/files/patch-Resource-Init-cidfmap
@@ -1,11 +1,11 @@
 --- Resource/Init/cidfmap.orig	2008-08-08 13:22:38.000000000 +0900
-+++ Resource/Init/cidfmap	2009-05-15 03:26:04.000000000 +0900
-@@ -26,3 +26,59 @@
++++ Resource/Init/cidfmap	2009-12-20 03:03:17.000000000 +0900
+@@ -26,3 +26,64 @@
  %   /ShinGo-Bold   /HeiseiKakuGo-W5 ;
  %   /Ryumin-Medium << /FileType /TrueType /Path (H:/AuxFiles/Fonts/BATANG.TTC) /SubfontID 3 /CSI [(Japan1) 2] >> ;
  %
-+/Ryumin-Light << /FileType /TrueType /Path (Ryumin-Light) /SubfontID 0 /CSI [(Japan1) 3] >> ;
-+/GothicBBB-Medium << /FileType /TrueType /Path (GothicBBB-Medium) /SubfontID 0 /CSI [(Japan1) 3] >> ;
++/Ryumin-Light << /FileType /TrueType /Path (Ryumin-Light) /SubfontID 0 /CSI [(Japan1) 6] >> ;
++/GothicBBB-Medium << /FileType /TrueType /Path (GothicBBB-Medium) /SubfontID 0 /CSI [(Japan1) 6] >> ;
 +
 +/Ryumin-Medium		/Ryumin-Light ;
 +/Ryumin-Regular		/Ryumin-Light ;
@@ -47,6 +47,11 @@
 +
 +/MidashiMinPro-MA31	/Ryumin-Light ;
 +
++/MS-Mincho		/Ryumin-Light ;
++/MS-PMincho		/Ryumin-Light ;
++/MS-Gothic		/GothicBBB-Medium ;
++/MS-PGothic		/GothicBBB-Medium ;
++
 +%/Munhwa-Regular	/Munhwa-Regular ;
 +%/MunhwaGothic-Regular	/MunhwaGothic-Regular ;
 +%/Munhwa-Bold		/Munhwa-Bold ;
diff --git a/print/ghostscript8/files/patch-Resource-Init-gs_statd.ps b/print/ghostscript8/files/patch-Resource-Init-gs_statd.ps
index 2432745941ad..ab50080daeb8 100644
--- a/print/ghostscript8/files/patch-Resource-Init-gs_statd.ps
+++ b/print/ghostscript8/files/patch-Resource-Init-gs_statd.ps
@@ -1,9 +1,9 @@
---- Resource/Init/gs_statd.ps.orig	Sat Feb 14 04:19:59 2004
-+++ Resource/Init/gs_statd.ps	Sat Feb 21 23:01:09 2004
-@@ -109,6 +109,12 @@
-  /halfletter {396 612 //.setpagesize exec} bind def
- 	% minimum of a4 and letter (a4 width, letter length)
+--- Resource/Init/gs_statd.ps.orig	2009-03-16 07:42:53.000000000 +0900
++++ Resource/Init/gs_statd.ps	2009-12-20 01:35:53.000000000 +0900
+@@ -111,6 +111,12 @@
   /pa4 {595 792 //.setpagesize exec} bind def
+ 	% Japanese postcard size, 100mm x 148mm
+  /hagaki {283 420 //.setpagesize exec} bind def
 + /postcard {284 419 //.setpagesize exec} bind def
 + /dbl_postcard {419 568 //.setpagesize exec} bind def
 + /Executive {522 756 //.setpagesize exec} bind def
@@ -13,11 +13,11 @@
  % /tabloid {792 1224 //.setpagesize exec} bind def  % 11x17 portrait
  % /csheet {1224 1584 //.setpagesize exec} bind def % ANSI C 17x22
  % /dsheet {1584 2448 //.setpagesize exec} bind def % ANSI D 22x34
-@@ -125,6 +131,7 @@
+@@ -127,6 +133,7 @@
   [ /letter /note	%do not change this line, needed by 'setpagetype'
     /legal /lettersmall
     /11x17 /ledger
-+   /postcard /dbl_postcard /Executive /jenv_you4 /jenv_you2 /jenv_kaku2
++   /postcard /dbl_postcard /Executive /hagaki /jenv_you4 /jenv_you2 /jenv_kaku2
     /a4small /a3 /a4
  STRICT { (%END SIZES) .skipeof } if
     /a0 /a1 /a2 /a5 /a6 /a7 /a8 /a9 /a10
diff --git a/print/ghostscript8/files/patch-base-devs.mak b/print/ghostscript8/files/patch-base-devs.mak
index 9507beb00f55..70fd478e9212 100644
--- a/print/ghostscript8/files/patch-base-devs.mak
+++ b/print/ghostscript8/files/patch-base-devs.mak
@@ -1,25 +1,24 @@
---- base/devs.mak.orig	2008-11-08 03:49:34.000000000 +0900
-+++ base/devs.mak	2009-03-29 03:39:04.000000000 +0900
-@@ -418,11 +418,11 @@
+--- base/devs.mak.orig	2009-02-14 09:46:58.000000000 +0900
++++ base/devs.mak	2009-12-20 01:39:02.000000000 +0900
+@@ -418,10 +418,10 @@
  ### NON PORTABLE, ONLY UNIX WITH GCC SUPPORT
  
  $(GLOBJ)lvga256.so : $(lvga256_)
--	$(CCLD) -shared -Wl,'-solvga256.so' $(lvga256_) -lvga -lvgagl
-+	$(CCLD) -shared -Wl,'-solvga256.so' $(lvga256_) -lvga -lvgagl $(XLDFLAGS)
- 	mv lvga256.so $(GLOBJ)lvga256.so
+-	$(CCLD) $(LDFLAGS) -shared -o $(GLOBJ)lvga256.so $(lvga256_) -lvga -lvgagl
++	$(CCLD) $(LDFLAGS) -shared -o $(GLOBJ)lvga256.so $(lvga256_) -lvga -lvgagl $(XLDFLAGS)
  
  $(GLOBJ)vgalib.so : $(vgalib_)
--	$(CCLD) -shared -Wl,'-sovgalib.so' $(vgalib_) -lvga -lvgagl
-+	$(CCLD) -shared -Wl,'-sovgalib.so' $(vgalib_) -lvga -lvgagl $(XLDFLAGS)
- 	mv vgalib.so $(GLOBJ)vgalib.so
+-	$(CCLD) $(LDFLAGS) -shared -o $(GLOBJ)vgalib.so $(vgalib_) -lvga -lvgagl
++	$(CCLD) $(LDFLAGS) -shared -o $(GLOBJ)vgalib.so $(vgalib_) -lvga -lvgagl $(XLDFLAGS)
  
  ### -------------------------- The X11 device -------------------------- ###
-@@ -526,7 +526,7 @@
+ 
+@@ -524,7 +524,7 @@
  ### NON PORTABLE, ONLY UNIX WITH GCC SUPPORT
  
  $(GLOBJ)X11.so : $(x11alt_) $(x11_)
--	$(CCLD) -shared -Wl,'-soX11.so' $(x11alt_) $(x11_) -L/usr/X11R6/lib -lXt -lSM -lICE -lXext -lX11 $(XLIBDIRS)
-+	$(CCLD) -shared -Wl,'-soX11.so' $(x11alt_) $(x11_) -lXt -lSM -lICE -lXext -lX11 $(XLIBDIRS)
- 	mv X11.so $(GLOBJ)X11.so
+-	$(CCLD) $(LDFLAGS) -shared -o $(GLOBJ)X11.so $(x11alt_) $(x11_) -L/usr/X11R6/lib -lXt -lSM -lICE -lXext -lX11 $(XLIBDIRS)
++	$(CCLD) $(LDFLAGS) -shared -o $(GLOBJ)X11.so $(x11alt_) $(x11_) -L$(X11BASE)/lib -lXt -lSM -lICE -lXext -lX11 $(XLIBDIRS)
  
  ###### --------------- Memory-buffered printer devices --------------- ######
+ 
diff --git a/print/ghostscript8/files/patch-psi-fapi_ft.c b/print/ghostscript8/files/patch-psi-fapi_ft.c
deleted file mode 100644
index 5737efec19b7..000000000000
--- a/print/ghostscript8/files/patch-psi-fapi_ft.c
+++ /dev/null
@@ -1,22 +0,0 @@
---- psi/fapi_ft.c.orig	Wed Jul 11 09:26:24 2007
-+++ psi/fapi_ft.c	Fri Aug 10 02:40:41 2007
-@@ -28,11 +28,14 @@
- #include "gserror.h"
- 
- /* FreeType headers */
--#include "freetype/freetype.h"
--#include "freetype/ftincrem.h"
--#include "freetype/ftglyph.h"
--#include "freetype/ftoutln.h"
--#include "freetype/fttrigon.h"
-+#include "ft2build.h"
-+#include FT_FREETYPE_H
-+#include FT_INCREMENTAL_H
-+#include FT_GLYPH_H
-+#include FT_OUTLINE_H
-+#include FT_TRIGONOMETRY_H
-+#include "gserrors.h"
-+#include "gserror.h"
- 
- /* Note: structure definitions here start with FF_, which stands for 'FAPI FreeType". */
-