diff -u -8 -p -r1.1.4.1 cairo-pen.c
--- a/gfx/cairo/cairo/src/cairo-pen.c	27 Sep 2005 23:09:01 -0000	1.1.4.1
+++ b/gfx/cairo/cairo/src/cairo-pen.c	16 Jan 2007 20:44:05 -0000
@@ -83,17 +83,22 @@ _cairo_pen_init (cairo_pen_t *pen, doubl
 	reflect = 0;
     } else {
 	reflect = 1;
     }
 
     pen->num_vertices = _cairo_pen_vertices_needed (gstate->tolerance,
 						    radius,
 						    &gstate->ctm);
-    
+
+    /* Make sure we don't overflow the size_t for malloc */
+    if (pen->num_vertices > 0xffff) {
+        return CAIRO_STATUS_NO_MEMORY;
+    }
+
     pen->vertices = malloc (pen->num_vertices * sizeof (cairo_pen_vertex_t));
     if (pen->vertices == NULL) {
 	return CAIRO_STATUS_NO_MEMORY;
     }
 
     /*
      * Compute pen coordinates.  To generate the right ellipse, compute points around
      * a circle in user space and transform them to device space.  To get a consistent
