--- lib/Xm/XpmCrBufFrI.c
+++ lib/Xm/XpmCrBufFrI.c
@@ -38,20 +38,20 @@
 
 #include "XpmI.h"
 
-LFUNC(WriteColors, int, (char **dataptr, unsigned int *data_size,
-			 unsigned int *used_size, XpmColor *colors,
+LFUNC(WriteColors, int, (char **dataptr, size_t *data_size,
+			 size_t *used_size, XpmColor *colors,
 			 unsigned int ncolors, unsigned int cpp));
 
-LFUNC(WritePixels, void, (char *dataptr, unsigned int *used_size,
+LFUNC(WritePixels, void, (char *dataptr, size_t *used_size,
 			  unsigned int width, unsigned int height,
 			  unsigned int cpp, unsigned int *pixels,
 			  XpmColor *colors));
 
-LFUNC(WriteExtensions, void, (char *dataptr, unsigned int *used_size,
+LFUNC(WriteExtensions, void, (char *dataptr, size_t *used_size,
 			      XpmExtension *ext, unsigned int num));
 
-LFUNC(ExtensionsSize, int, (XpmExtension *ext, unsigned int num));
-LFUNC(CommentsSize, int, (XpmInfo *info));
+LFUNC(ExtensionsSize, size_t, (XpmExtension *ext, unsigned int num));
+LFUNC(CommentsSize, size_t, (XpmInfo *info));
 
 int
 XpmCreateBufferFromImage(display, buffer_return, image, shapeimage, attributes)
@@ -108,10 +108,11 @@
     /* calculation variables */
     int ErrorStatus;
     char buf[BUFSIZ];
-    unsigned int cmts, extensions, ext_size = 0;
-    unsigned int l, cmt_size = 0;
+    unsigned int cmts, extensions;
+    size_t ext_size = 0;
+    size_t l, cmt_size = 0;
     char *ptr = NULL, *p;
-    unsigned int ptr_size, used_size;
+    size_t ptr_size, used_size;
 
     *buffer_return = NULL;
 
@@ -248,8 +249,8 @@
 static int
 WriteColors(dataptr, data_size, used_size, colors, ncolors, cpp)
     char **dataptr;
-    unsigned int *data_size;
-    unsigned int *used_size;
+    size_t *data_size;
+    size_t *used_size;
     XpmColor *colors;
     unsigned int ncolors;
     unsigned int cpp;
@@ -294,7 +295,7 @@
 static void
 WritePixels(dataptr, used_size, width, height, cpp, pixels, colors)
     char *dataptr;
-    unsigned int *used_size;
+    size_t *used_size;
     unsigned int width;
     unsigned int height;
     unsigned int cpp;
@@ -324,12 +325,13 @@
     *used_size += s - dataptr;
 }
 
-static int
+static size_t
 ExtensionsSize(ext, num)
     XpmExtension *ext;
     unsigned int num;
 {
-    unsigned int x, y, a, size;
+    unsigned int x, y, a;
+    size_t size;
     char **line;
 
     size = 0;
@@ -348,7 +350,7 @@
 static void
 WriteExtensions(dataptr, used_size, ext, num)
     char *dataptr;
-    unsigned int *used_size;
+    size_t *used_size;
     XpmExtension *ext;
     unsigned int num;
 {
@@ -379,11 +381,11 @@
     *used_size += s - dataptr + 13;
 }
 
-static int
+static size_t
 CommentsSize(info)
     XpmInfo *info;
 {
-    int size = 0;
+    size_t size = 0;
 
     /* 5 = 2 (for "/_*") + 3 (for "*_/\n") */
     if (info->hints_cmt)
--- lib/Xm/XpmI.h
+++ lib/Xm/XpmI.h
@@ -184,9 +184,9 @@
     unsigned int type;
     union {
 	FILE *file;
-	char **data;
+	unsigned char **data;
     }     stream;
-    char *cptr;
+    unsigned char *cptr;
     unsigned int line;
     int CommentLength;
     char Comment[XPMMAXCMTLEN];
--- lib/Xm/XpmRdFToI.c
+++ lib/Xm/XpmRdFToI.c
@@ -119,6 +119,27 @@
     return (ErrorStatus);
 }
 
+
+/* Quote filename and prepend prefix. */
+static char *quote_file(prefix, filename, len)
+    const char *prefix, *filename;
+    size_t len;
+{
+    char *buf = XpmMalloc(strlen(prefix) + len * 2 + 1);
+    char *p = buf, *q;
+
+    if (!buf)
+	return 0;
+    strcpy(p, prefix);
+    p += strlen(p);
+    for (q = filename; *q; q++) {
+	*p++ = '\\';
+	*p++ = *q;
+    }
+    return buf;
+}
+  
+
 /*
  * open the given file to be read as an xpmData which is returned.
  */
@@ -128,7 +149,7 @@
     xpmData *mdata;
 {
 #ifndef NO_ZPIPE
-    char *compressfile, buf[(2*MAXPATHLEN) + 1];
+    char *compressfile, *buf;
 # ifdef STAT_ZFILE
     struct stat status;
 # endif
@@ -139,17 +160,25 @@
 	mdata->type = XPMFILE;
     } else {
 #ifndef NO_ZPIPE
-	int len = strlen(filename);
+	size_t len = strlen(filename);
 	if ((len > 2) && !strcmp(".Z", filename + (len - 2))) {
 	    mdata->type = XPMPIPE;
-	    sprintf(buf, "uncompress -c \"%s\"", filename);
-	    if (!(mdata->stream.file = popen(buf, "r")))
+	    buf = quote_file("uncompress -c ", filename, len);
+	    if (!buf)
+		return (XpmNoMemory);
+	    mdata->stream.file = popen(buf, "r");
+	    XpmFree(buf);
+	    if (!mdata->stream.file)
 		return (XpmOpenFailed);
 
 	} else if ((len > 3) && !strcmp(".gz", filename + (len - 3))) {
 	    mdata->type = XPMPIPE;
-	    sprintf(buf, "gunzip -qc \"%s\"", filename);
-	    if (!(mdata->stream.file = popen(buf, "r")))
+	    buf = quote_file("gunzip -qc ", filename, len);
+	    if (!buf)
+		return (XpmNoMemory);
+	    mdata->stream.file = popen(buf, "r");
+	    XpmFree(buf);
+	    if (!mdata->stream.file)
 		return (XpmOpenFailed);
 
 	} else {
@@ -159,28 +188,32 @@
 
 	    sprintf(compressfile, "%s.Z", filename);
 	    if (!stat(compressfile, &status)) {
-		sprintf(buf, "uncompress -c \"%s\"", compressfile);
-		if (!(mdata->stream.file = popen(buf, "r"))) {
-		    XpmFree(compressfile);
+		buf = quote_file("uncompress -c ", compressfile, len + 2);
+		XpmFree(compressfile);
+		if (!buf)
+		    return (XpmNoMemory);
+		mdata->stream.file = popen(buf, "r");
+		XpmFree(buf);
+		if (!mdata->stream.file)
 		    return (XpmOpenFailed);
-		}
 		mdata->type = XPMPIPE;
 	    } else {
 		sprintf(compressfile, "%s.gz", filename);
 		if (!stat(compressfile, &status)) {
-		    sprintf(buf, "gunzip -c \"%s\"", compressfile);
-		    if (!(mdata->stream.file = popen(buf, "r"))) {
-			XpmFree(compressfile);
+		    buf = quote_file("gunzip -c ", compressfile, len + 3);
+		    XpmFree(compressfile);
+		    if (!buf)
+			return (XpmNoMemory);
+		    mdata->stream.file = popen(buf, "r");
+		    XpmFree(buf);
+		    if (!mdata->stream.file)
 			return (XpmOpenFailed);
-		    }
 		    mdata->type = XPMPIPE;
 		} else {
+		    XpmFree(compressfile);
 # endif
 #endif
 		    if (!(mdata->stream.file = fopen(filename, "r"))) {
-#if !defined(NO_ZPIPE) && defined(STAT_ZFILE)
-			XpmFree(compressfile);
-#endif
 			return (XpmOpenFailed);
 		    }
 		    mdata->type = XPMFILE;
@@ -188,7 +221,6 @@
 # ifdef STAT_ZFILE
 		}
 	    }
-	    XpmFree(compressfile);
 # endif
 	}
 #endif
--- lib/Xm/Xpmdata.c
+++ lib/Xm/Xpmdata.c
@@ -292,7 +292,7 @@
 
     if (!mdata->type || mdata->type == XPMBUFFER) {
 	if (mdata->cptr) {
-	    char *start = mdata->cptr;
+	    unsigned char *start = mdata->cptr;
 	    while ((c = *mdata->cptr) && c != mdata->Eos)
 		mdata->cptr++;
 	    n = mdata->cptr - start + 1;
--- lib/Xm/Xpmhashtab.c
+++ lib/Xm/Xpmhashtab.c
@@ -143,7 +143,9 @@
 
     t = atomTable;
     HASH_TABLE_GROWS
-	table->size = size;
+    if (size <= 0)
+	return (XpmNoMemory);
+    table->size = size;
     table->limit = size / 3;
     atomTable = (xpmHashAtom *) XpmMalloc(size * sizeof(*atomTable));
     if (!atomTable)
--- lib/Xm/Xpmmisc.c
+++ lib/Xm/Xpmmisc.c
@@ -47,7 +47,7 @@
     char *s1;
 {
     char *s2;
-    int l = strlen(s1) + 1;
+    size_t l = strlen(s1) + 1;
 
     if (s2 = (char *) XpmMalloc(l))
 	strcpy(s2, s1);
--- lib/Xm/Xpmparse.c
+++ lib/Xm/Xpmparse.c
@@ -307,6 +307,17 @@
 	*hotspot = 0;
 	*extensions = 0;
     }
+
+    /* Do some plausibility checks.  */
+    if (*width == 0 || *height == 0 || *ncolors == 0 || *cpp == 0)
+	return XpmFileInvalid;
+    if (*cpp > 8)
+	return XpmFileInvalid;
+    if (*width > (1 << (sizeof(int) - 4)) / *height)
+	return XpmFileInvalid;
+    if (*ncolors > (1 << (sizeof(int) - 4)) / (*width * *height))
+	return XpmFileInvalid;
+
     return (XpmSuccess);
 }
 
@@ -393,6 +404,10 @@
 			xpmFreeColorTable(colorTable, ncolors);
 			return (XpmFileInvalid);
 		    }
+		    if (strlen(curbuf) + l + 2 >= sizeof(curbuf)) {
+			xpmFreeColorTable(colorTable, ncolors);
+			return (XpmNoMemory);
+		    }
 		    if (!lastwaskey)
 			strcat(curbuf, " ");	/* append space */
 		    buf[l] = '\0';
@@ -449,6 +464,10 @@
 	    xpmNextString(data);	/* get to the next string */
 	    *curbuf = '\0';		/* init curbuf */
 	    while (l = xpmNextWord(data, buf, BUFSIZ)) {
+		if (strlen(curbuf) + l + 2 >= sizeof(curbuf)) {
+		    xpmFreeColorTable(colorTable, ncolors);
+		    return (XpmNoMemory);
+		}
 		if (*curbuf != '\0')
 		    strcat(curbuf, " ");/* append space */
 		buf[l] = '\0';
@@ -541,7 +560,7 @@
 
 	    bzero((char *)cidx, 256 * sizeof(unsigned short *)); /* init */
 	    for (a = 0; a < ncolors; a++) {
-		char1 = colorTable[a].string[0];
+		char1 = (unsigned char)colorTable[a].string[0];
 		if (cidx[char1] == NULL) { /* get new memory */
 		    cidx[char1] = (unsigned short *)
 			XpmCalloc(256, sizeof(unsigned short));
