Add a check to make sure pair doesn't overflow.

It's not clear if COLOR_PAIRS can be larger than SHRT_MAX + 1, so make
sure with a check.

1 files changed, 6 insertions, 0 deletions

diff --git a/color.c b/color.c
index 1dec01b2..93a01e8a 100644
--- a/color.c
+++ b/color.c
@@ -370,6 +370,12 @@ static int _mutt_alloc_color (int fg, int bg, int type)
    * to COLOR_PAIRS-1 pairs. */
   if (UserColors >= (COLOR_PAIRS - 1))
     return (0);
+
+  /* Check for pair overflow too.  We are currently using init_pair(), which
+   * only accepts size short. */
+  if ((pair > SHRT_MAX) || (pair < 0))
+    return (0);
+
   UserColors++;
 
   p = (COLOR_LIST *) safe_calloc (1, sizeof (COLOR_LIST));