--- lib/libc/xdr/xdr_array.c:1.8	Fri Aug 27 19:02:55 1999
+++ lib/libc/xdr/xdr_array.c	Wed Jul 31 10:11:59 2002
@@ -42,6 +42,7 @@
  * arrays.  See xdr.h for more info on the interface to xdr.
  */
 
+#include <limits.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
@@ -73,11 +74,12 @@
 	register u_int nodesize;
 
 	/* like strings, arrays are really counted arrays */
-	if (! xdr_u_int(xdrs, sizep)) {
+	if (!xdr_u_int(xdrs, sizep)) {
 		return (FALSE);
 	}
 	c = *sizep;
-	if ((c > maxsize) && (xdrs->x_op != XDR_FREE)) {
+	if ((c > maxsize || UINT_MAX/elsize < c) &&
+	    (xdrs->x_op != XDR_FREE)) {
 		return (FALSE);
 	}
 	nodesize = c * elsize;
@@ -145,7 +147,7 @@
 
 	elptr = basep;
 	for (i = 0; i < nelem; i++) {
-		if (! (*xdr_elem)(xdrs, elptr, LASTUNSIGNED)) {
+		if (!(*xdr_elem)(xdrs, elptr, LASTUNSIGNED)) {
 			return(FALSE);
 		}
 		elptr += elemsize;