diff -up cups-filters-1.0.35/filter/pdftoopvp/oprs/OPVPSplash.cxx.CVE-2013-6475 cups-filters-1.0.35/filter/pdftoopvp/oprs/OPVPSplash.cxx
--- cups-filters-1.0.35/filter/pdftoopvp/oprs/OPVPSplash.cxx.CVE-2013-6475	2014-01-20 13:32:28.906801955 +0000
+++ cups-filters-1.0.35/filter/pdftoopvp/oprs/OPVPSplash.cxx	2014-01-20 13:34:03.581403757 +0000
@@ -1094,7 +1094,7 @@ void OPVPSplash::fillGlyph(SplashCoord x
     
     opvpbytes = (m+3)/4;
     opvpbytes *= 4;
-    bp = (Guchar *)gmalloc(opvpbytes*glyph->h);
+    bp = (Guchar *)gmallocn(opvpbytes, glyph->h);
     for (i = 0;i < glyph->h;i++) {
       memcpy(bp+i*opvpbytes,glyph->data+i*m,m);
     }
@@ -1238,8 +1238,8 @@ SplashError OPVPSplash::fillImageMaskFas
   /* align 4 */
   opvpbytes = (opvpbytes+3)/4;
   opvpbytes *= 4;
-  buf = (Guchar *)gmalloc(opvpbytes*h);
-  lineBuf = (SplashColorPtr)gmalloc(opvpbytes*8);
+  buf = (Guchar *)gmallocn(opvpbytes, h);
+  lineBuf = (SplashColorPtr)gmallocn(opvpbytes, 8);
 
   for (i = 0;i < h;i++) {
     int k;
@@ -1417,7 +1417,7 @@ SplashError OPVPSplash::fillImageMask(Sp
   imat[3] = mat[0]/det;
 
   /* read source image */
-  pixBuf = (SplashColorPtr)gmalloc(h * w);
+  pixBuf = (SplashColorPtr)gmallocn(h, w);
 
   p = pixBuf;
   for (i = 0; i < h; ++i) {
@@ -1571,7 +1571,7 @@ SplashError OPVPSplash::drawImageNotShea
     hs = h-1;
     he = -1;
   }
-  buf = (Guchar *)gmalloc(opvpbytes*h);
+  buf = (Guchar *)gmallocn(opvpbytes, h);
   lineBuf = (SplashColorPtr)gmalloc(lineBufSize);
   switch (colorMode) {
   case splashModeMono1:
@@ -1734,7 +1734,7 @@ SplashError OPVPSplash::drawImageFastWit
     return splashErrOPVP;
     break;
   }
-  buf = (Guchar *)gmalloc(opvpbytes*h);
+  buf = (Guchar *)gmallocn(opvpbytes, h);
 
   switch (colorMode) {
   case splashModeMono1:
@@ -1960,7 +1960,7 @@ SplashError OPVPSplash::drawImage(Splash
   }
 
   /* read source image */
-  pixBuf = (SplashColorPtr)gmalloc(h * linesize);
+  pixBuf = (SplashColorPtr)gmallocn(h, linesize);
 
   p = pixBuf;
   for (i = 0; i < h; ++i) {
diff -up cups-filters-1.0.35/filter/pdftoopvp/OPVPOutputDev.cxx.CVE-2013-6475 cups-filters-1.0.35/filter/pdftoopvp/OPVPOutputDev.cxx
--- cups-filters-1.0.35/filter/pdftoopvp/OPVPOutputDev.cxx.CVE-2013-6475	2014-01-20 13:34:26.782551214 +0000
+++ cups-filters-1.0.35/filter/pdftoopvp/OPVPOutputDev.cxx	2014-01-20 13:37:30.670719614 +0000
@@ -147,9 +147,9 @@ T3FontCache::T3FontCache(Ref *fontIDA, d
   } else {
     cacheSets = 1;
   }
-  cacheData = (Guchar *)gmalloc(cacheSets * cacheAssoc * glyphSize);
-  cacheTags = (T3FontCacheTag *)gmalloc(cacheSets * cacheAssoc *
-					sizeof(T3FontCacheTag));
+  cacheData = (Guchar *)gmallocn3(cacheSets, cacheAssoc, glyphSize);
+  cacheTags = (T3FontCacheTag *)gmallocn3(cacheSets, cacheAssoc,
+					  sizeof(T3FontCacheTag));
   for (i = 0; i < cacheSets * cacheAssoc; ++i) {
     cacheTags[i].mru = i & (cacheAssoc - 1);
   }
@@ -1424,7 +1424,7 @@ void OPVPOutputDev::drawImage(GfxState *
       }
       break;
     case splashModeRGB8:
-      imgData.lookup = (SplashColorPtr)gmalloc(3 * n);
+      imgData.lookup = (SplashColorPtr)gmallocn(3, n);
       for (i = 0; i < n; ++i) {
 	pix = (Guchar)i;
 	colorMap->getRGB(&pix, &rgb);
@@ -1434,7 +1434,7 @@ void OPVPOutputDev::drawImage(GfxState *
       }
       break;
     case splashModeBGR8:
-      imgData.lookup = (SplashColorPtr)gmalloc(3 * n);
+      imgData.lookup = (SplashColorPtr)gmallocn(3, n);
       for (i = 0; i < n; ++i) {
 	pix = (Guchar)i;
 	colorMap->getRGB(&pix, &rgb);
@@ -1445,7 +1445,7 @@ void OPVPOutputDev::drawImage(GfxState *
       break;
 #if SPLASH_CMYK
     case splashModeCMYK8:
-      imgData.lookup = (SplashColorPtr)gmalloc(4 * n);
+      imgData.lookup = (SplashColorPtr)gmallocn(4, n);
       for (i = 0; i < n; ++i) {
 	pix = (Guchar)i;
 	colorMap->getCMYK(&pix, &cmyk);
@@ -1680,7 +1680,7 @@ void OPVPOutputDev::drawMaskedImage(GfxS
       }
       break;
     case splashModeRGB8:
-      imgData.lookup = (SplashColorPtr)gmalloc(3 * n);
+      imgData.lookup = (SplashColorPtr)gmallocn(3, n);
       for (i = 0; i < n; ++i) {
 	pix = (Guchar)i;
 	colorMap->getRGB(&pix, &rgb);
@@ -1690,7 +1690,7 @@ void OPVPOutputDev::drawMaskedImage(GfxS
       }
       break;
     case splashModeBGR8:
-      imgData.lookup = (SplashColorPtr)gmalloc(3 * n);
+      imgData.lookup = (SplashColorPtr)gmallocn(3, n);
       for (i = 0; i < n; ++i) {
 	pix = (Guchar)i;
 	colorMap->getRGB(&pix, &rgb);
@@ -1701,7 +1701,7 @@ void OPVPOutputDev::drawMaskedImage(GfxS
       break;
 #if SPLASH_CMYK
     case splashModeCMYK8:
-      imgData.lookup = (SplashColorPtr)gmalloc(4 * n);
+      imgData.lookup = (SplashColorPtr)gmallocn(4, n);
       for (i = 0; i < n; ++i) {
 	pix = (Guchar)i;
 	colorMap->getCMYK(&pix, &cmyk);
@@ -1847,7 +1847,7 @@ void OPVPOutputDev::drawSoftMaskedImage(
       }
       break;
     case splashModeRGB8:
-      imgData.lookup = (SplashColorPtr)gmalloc(3 * n);
+      imgData.lookup = (SplashColorPtr)gmallocn(3, n);
       for (i = 0; i < n; ++i) {
 	pix = (Guchar)i;
 	colorMap->getRGB(&pix, &rgb);
@@ -1857,7 +1857,7 @@ void OPVPOutputDev::drawSoftMaskedImage(
       }
       break;
     case splashModeBGR8:
-      imgData.lookup = (SplashColorPtr)gmalloc(3 * n);
+      imgData.lookup = (SplashColorPtr)gmallocn(3, n);
       for (i = 0; i < n; ++i) {
 	pix = (Guchar)i;
 	colorMap->getRGB(&pix, &rgb);
@@ -1868,7 +1868,7 @@ void OPVPOutputDev::drawSoftMaskedImage(
       break;
 #if SPLASH_CMYK
     case splashModeCMYK8:
-      imgData.lookup = (SplashColorPtr)gmalloc(4 * n);
+      imgData.lookup = (SplashColorPtr)gmallocn(4, n);
       for (i = 0; i < n; ++i) {
 	pix = (Guchar)i;
 	colorMap->getCMYK(&pix, &cmyk);