Merge branch 'ebassi/memdup2' into 'master'

Use g_memdup2()

See merge request GNOME/gtk!3157

25 files changed, 129 insertions, 52 deletions

diff --git a/gdk/broadway/broadway-server.c b/gdk/broadway/broadway-server.c
index a82b3e82df..b54ae55149 100644
--- a/gdk/broadway/broadway-server.c
+++ b/gdk/broadway/broadway-server.c
@@ -36,6 +36,10 @@
 #include <string.h>
 #endif
 
+#if !GLIB_CHECK_VERSION (2, 67, 3)
+# define g_memdup2(mem,size)    g_memdup((mem), (size))
+#endif
+
 typedef struct {
   int id;
   guint32 tag;
@@ -605,7 +609,7 @@ update_future_pointer_info (BroadwayServer *server, BroadwayInputPointerMsg *dat
 static void
 queue_input_message (BroadwayServer *server, BroadwayInputMsg *msg)
 {
-  server->input_messages = g_list_append (server->input_messages, g_memdup (msg, sizeof (BroadwayInputMsg)));
+  server->input_messages = g_list_append (server->input_messages, g_memdup2 (msg, sizeof (BroadwayInputMsg)));
 }
 
 static void
diff --git a/gdk/broadway/gdkbroadway-server.c b/gdk/broadway/gdkbroadway-server.c
index 1aeb1649e9..02b6f93183 100644
--- a/gdk/broadway/gdkbroadway-server.c
+++ b/gdk/broadway/gdkbroadway-server.c
@@ -13,6 +13,8 @@
 #include "gdkbroadway-server.h"
 
 #include "gdkprivate-broadway.h"
+#include "gdk-private.h"
+
 #include <gdk/gdktextureprivate.h>
 
 #include <glib.h>
@@ -233,7 +235,7 @@ static void
 parse_all_input (GdkBroadwayServer *server)
 {
   guint8 *p, *end;
-  guint32 size;
+  size_t size;
   BroadwayReply *reply;
 
   p = server->recv_buffer;
@@ -245,7 +247,7 @@ parse_all_input (GdkBroadwayServer *server)
       if (p + size > end)
         break;
 
-      reply = g_memdup (p, size);
+      reply = g_memdup2 (p, size);
       p += size;
 
       server->incoming = g_list_append (server->incoming, reply);
diff --git a/gdk/broadway/gdksurface-broadway.c b/gdk/broadway/gdksurface-broadway.c
index 0d90e270a6..36930072c4 100644
--- a/gdk/broadway/gdksurface-broadway.c
+++ b/gdk/broadway/gdksurface-broadway.c
@@ -41,6 +41,7 @@
 #include "gdksurfaceprivate.h"
 #include "gdktextureprivate.h"
 #include "gdktoplevelprivate.h"
+#include "gdk-private.h"
 
 #include <graphene.h>
 #include <stdlib.h>
@@ -1025,7 +1026,7 @@ _gdk_broadway_moveresize_handle_event (GdkDisplay *display,
                 *mv_resize->moveresize_pending_event = *event;
               else
                 mv_resize->moveresize_pending_event =
-                  g_memdup (event, sizeof (BroadwayInputMsg));
+                  g_memdup2 (event, sizeof (BroadwayInputMsg));
 
               break;
             }
@@ -1043,7 +1044,7 @@ _gdk_broadway_moveresize_handle_event (GdkDisplay *display,
             *mv_resize->moveresize_pending_event = *event;
           else
             mv_resize->moveresize_pending_event =
-              g_memdup (event, sizeof (BroadwayInputMsg));
+              g_memdup2 (event, sizeof (BroadwayInputMsg));
 
           break;
         }
diff --git a/gdk/gdk-private.h b/gdk/gdk-private.h
index 3df7d3215c..fb3c18cd6f 100644
--- a/gdk/gdk-private.h
+++ b/gdk/gdk-private.h
@@ -49,4 +49,12 @@ guint gdk_parse_debug_var (const char        *variable,
                            const GdkDebugKey *keys,
                            guint              nkeys);
 
+/* Backward compatibility shim, to avoid bumping up the minimum
+ * required version of GLib; most of our uses of g_memdup() are
+ * safe, and those that aren't have been fixed
+ */
+#if !GLIB_CHECK_VERSION (2, 67, 3)
+# define g_memdup2(mem,size)    g_memdup((mem),(size))
+#endif
+
 #endif /* __GDK__PRIVATE_H__ */
diff --git a/gdk/gdkcontentproviderimpl.c b/gdk/gdkcontentproviderimpl.c
index aeeca742ba..f987d05abf 100644
--- a/gdk/gdkcontentproviderimpl.c
+++ b/gdk/gdkcontentproviderimpl.c
@@ -27,6 +27,8 @@
 #include "gdkintl.h"
 #include "gdkcontentproviderimpl.h"
 
+#include "gdk-private.h"
+
 #define GDK_TYPE_CONTENT_PROVIDER_VALUE            (gdk_content_provider_value_get_type ())
 #define GDK_CONTENT_PROVIDER_VALUE(obj)            (G_TYPE_CHECK_INSTANCE_CAST ((obj), GDK_TYPE_CONTENT_PROVIDER_VALUE, GdkContentProviderValue))
 #define GDK_IS_CONTENT_PROVIDER_VALUE(obj)         (G_TYPE_CHECK_INSTANCE_TYPE ((obj), GDK_TYPE_CONTENT_PROVIDER_VALUE))
@@ -426,7 +428,7 @@ gdk_content_provider_new_union (GdkContentProvider **providers,
   result = g_object_new (GDK_TYPE_CONTENT_PROVIDER_UNION, NULL);
 
   result->n_providers = n_providers;
-  result->providers = g_memdup (providers, sizeof (GdkContentProvider *) * n_providers);
+  result->providers = g_memdup2 (providers, sizeof (GdkContentProvider *) * n_providers);
 
   for (i = 0; i < n_providers; i++)
     {
diff --git a/gdk/gdkevents.c b/gdk/gdkevents.c
index 177f06d494..2ce34f80ec 100644
--- a/gdk/gdkevents.c
+++ b/gdk/gdkevents.c
@@ -332,7 +332,7 @@ gdk_event_type_register_static (const char             *type_name,
   info.base_finalize = NULL;
   info.class_init = gdk_event_generic_class_init;
   info.class_finalize = NULL;
-  info.class_data = g_memdup (type_info, sizeof (GdkEventTypeInfo));
+  info.class_data = g_memdup2 (type_info, sizeof (GdkEventTypeInfo));
 
   info.instance_size = type_info->instance_size;
   info.n_preallocs = 0;
@@ -1146,7 +1146,7 @@ gdk_event_dup_axes (GdkEvent *event)
 
   if (gdk_event_get_axes (event, &axes, &n_axes))
     {
-      double *axes_copy = g_memdup (axes, n_axes * sizeof (double));
+      double *axes_copy = g_memdup2 (axes, n_axes * sizeof (double));
 
       return axes_copy;
     }
diff --git a/gdk/macos/gdkmacosclipboard.c b/gdk/macos/gdkmacosclipboard.c
index 288a7c64d5..7ddf47d83b 100644
--- a/gdk/macos/gdkmacosclipboard.c
+++ b/gdk/macos/gdkmacosclipboard.c
@@ -23,6 +23,7 @@
 
 #include "gdkmacosclipboard-private.h"
 #include "gdkmacosutils-private.h"
+#include "gdk-private.h"
 
 struct _GdkMacosClipboard
 {
@@ -213,7 +214,7 @@ create_stream_from_nsdata (NSData *data)
   const guint8 *bytes = [data bytes];
   gsize len = [data length];
 
-  return g_memory_input_stream_new_from_data (g_memdup (bytes, len), len, g_free);
+  return g_memory_input_stream_new_from_data (g_memdup2 (bytes, len), len, g_free);
 }
 
 static void
@@ -309,7 +310,7 @@ _gdk_macos_clipboard_read_async (GdkClipboard        *clipboard,
       color[2] = 0xffff * [nscolor blueComponent];
       color[3] = 0xffff * [nscolor alphaComponent];
 
-      stream = g_memory_input_stream_new_from_data (g_memdup (&color, sizeof color),
+      stream = g_memory_input_stream_new_from_data (g_memdup2 (&color, sizeof color),
                                                     sizeof color,
                                                     g_free);
     }
diff --git a/gdk/macos/gdkmacosseat.c b/gdk/macos/gdkmacosseat.c
index a7b7c59915..b003bb7ca6 100644
--- a/gdk/macos/gdkmacosseat.c
+++ b/gdk/macos/gdkmacosseat.c
@@ -28,6 +28,8 @@
 #include "gdkmacosdevice.h"
 #include "gdkmacosseat-private.h"
 
+#include "gdk-private.h"
+
 typedef struct
 {
   NSUInteger device_id;
@@ -622,6 +624,5 @@ _gdk_macos_seat_get_tablet_axes_from_nsevent (GdkMacosSeat *seat,
                                   [nsevent rotation], &tablet->axes[GDK_AXIS_ROTATION]);
     }
 
-  return g_memdup (tablet->axes,
-                   sizeof (double) * GDK_AXIS_LAST);
+  return g_memdup2 (tablet->axes, sizeof (double) * GDK_AXIS_LAST);
 }
diff --git a/gdk/wayland/gdkdevice-wayland.c b/gdk/wayland/gdkdevice-wayland.c
index 8e3cef103d..947302c219 100644
--- a/gdk/wayland/gdkdevice-wayland.c
+++ b/gdk/wayland/gdkdevice-wayland.c
@@ -39,6 +39,8 @@
 #include "gdkdropprivate.h"
 #include "gdkprimary-wayland.h"
 #include "gdkseatprivate.h"
+#include "gdk-private.h"
+
 #include "pointer-gestures-unstable-v1-client-protocol.h"
 #include "tablet-unstable-v2-client-protocol.h"
 
@@ -3472,8 +3474,7 @@ tablet_tool_handle_proximity_out (void                      *data,
 static double *
 tablet_copy_axes (GdkWaylandTabletData *tablet)
 {
-  return g_memdup (tablet->axes,
-                   sizeof (double) * GDK_AXIS_LAST);
+  return g_memdup2 (tablet->axes, sizeof (double) * GDK_AXIS_LAST);
 }
 
 static void
diff --git a/gdk/win32/gdkclipdrop-win32.c b/gdk/win32/gdkclipdrop-win32.c
index 5c1d361a36..2c3eab6d36 100644
--- a/gdk/win32/gdkclipdrop-win32.c
+++ b/gdk/win32/gdkclipdrop-win32.c
@@ -284,6 +284,7 @@ Otherwise it's similar to how the clipboard works. Only the DnD server
 #include "gdkwin32dnd-private.h"
 #include "gdkwin32.h"
 #include "gdkintl.h"
+#include "gdk-private.h"
 
 #define HIDA_GetPIDLFolder(pida) (LPCITEMIDLIST)(((LPBYTE)pida)+(pida)->aoffset[0])
 #define HIDA_GetPIDLItem(pida, i) (LPCITEMIDLIST)(((LPBYTE)pida)+(pida)->aoffset[i+1])
@@ -2073,7 +2074,7 @@ _gdk_win32_add_w32format_to_pairs (UINT                      w32format,
 
 static void
 transmute_cf_unicodetext_to_utf8_string (const guchar    *data,
-                                         int              length,
+                                         gsize            length,
                                          guchar         **set_data,
                                          gsize           *set_data_length,
                                          GDestroyNotify  *set_data_destroy)
@@ -2113,7 +2114,7 @@ transmute_cf_unicodetext_to_utf8_string (const guchar    *data,
 
 static void
 transmute_utf8_string_to_cf_unicodetext (const guchar    *data,
-                                         int              length,
+                                         gsize            length,
                                          guchar         **set_data,
                                          gsize           *set_data_length,
                                          GDestroyNotify  *set_data_destroy)
@@ -2188,7 +2189,7 @@ wchar_to_str (const wchar_t  *wstr,
 
 static void
 transmute_utf8_string_to_cf_text (const guchar    *data,
-                                  int              length,
+                                  gsize            length,
                                   guchar         **set_data,
                                   gsize           *set_data_length,
                                   GDestroyNotify  *set_data_destroy)
@@ -2274,7 +2275,7 @@ str_to_wchar (const char  *str,
 
 static void
 transmute_cf_text_to_utf8_string (const guchar    *data,
-                                  int              length,
+                                  gsize            length,
                                   guchar         **set_data,
                                   gsize           *set_data_length,
                                   GDestroyNotify  *set_data_destroy)
@@ -2320,7 +2321,7 @@ transmute_cf_text_to_utf8_string (const guchar    *data,
 
 static void
 transmute_cf_dib_to_image_bmp (const guchar    *data,
-                               int              length,
+                               gsize            length,
                                guchar         **set_data,
                                gsize           *set_data_length,
                                GDestroyNotify  *set_data_destroy)
@@ -2354,8 +2355,8 @@ transmute_cf_dib_to_image_bmp (const guchar    *data,
   BITMAPINFOHEADER *bi = (BITMAPINFOHEADER *) data;
   BITMAPFILEHEADER *bf;
   gpointer result;
-  int data_length = length;
-  int new_length;
+  gsize data_length = length;
+  gsize new_length;
   gboolean make_dibv5 = FALSE;
   BITMAPV5HEADER *bV5;
   guchar *p;
@@ -2473,11 +2474,11 @@ transmute_cf_dib_to_image_bmp (const guchar    *data,
   memcpy (p, ((char *) bi) + bi->biSize,
           data_length - sizeof (BITMAPINFOHEADER));
 
-  for (i = 0; i < bV5->bV5SizeImage/4; i++)
+  for (i = 0; i < bV5->bV5SizeImage / 4; i++)
     {
       if (p[3] != 0)
         {
-          double inverse_alpha = 255./p[3];
+          double inverse_alpha = 255. / p[3];
 
           p[0] = p[0] * inverse_alpha + 0.5;
           p[1] = p[1] * inverse_alpha + 0.5;
@@ -2490,7 +2491,7 @@ transmute_cf_dib_to_image_bmp (const guchar    *data,
 
 static void
 transmute_cf_shell_id_list_to_text_uri_list (const guchar    *data,
-                                             int              length,
+                                             gsize            length,
                                              guchar         **set_data,
                                              gsize           *set_data_length,
                                              GDestroyNotify  *set_data_destroy)
@@ -2540,12 +2541,12 @@ transmute_cf_shell_id_list_to_text_uri_list (const guchar    *data,
 
 void
 transmute_image_bmp_to_cf_dib (const guchar    *data,
-                               int              length,
+                               gsize            length,
                                guchar         **set_data,
                                gsize           *set_data_length,
                                GDestroyNotify  *set_data_destroy)
 {
-  int size;
+  gsize size;
   guchar *ptr;
 
   g_return_if_fail (length >= sizeof (BITMAPFILEHEADER));
@@ -2572,7 +2573,9 @@ _gdk_win32_transmute_windows_data (UINT          from_w32format,
                                    gsize        *set_data_length)
 {
   const guchar *data;
-  SIZE_T        length;
+  SIZE_T hdata_length;
+  gsize length;
+  gboolean res = FALSE;
 
   /* FIXME: error reporting */
 
@@ -2581,7 +2584,11 @@ _gdk_win32_transmute_windows_data (UINT          from_w32format,
       return FALSE;
     }
 
-  length = GlobalSize (hdata);
+  hdata_length = GlobalSize (hdata);
+  if (hdata_length > G_MAXSIZE)
+    goto out;
+
+  length = (gsize) hdata_length;
 
   if ((to_contentformat == _gdk_win32_clipdrop_atom (GDK_WIN32_ATOM_INDEX_IMAGE_PNG) &&
        from_w32format == _gdk_win32_clipdrop_cf (GDK_WIN32_CF_INDEX_PNG)) ||
@@ -2591,46 +2598,51 @@ _gdk_win32_transmute_windows_data (UINT          from_w32format,
        from_w32format == _gdk_win32_clipdrop_cf (GDK_WIN32_CF_INDEX_GIF)))
     {
       /* No transmutation needed */
-      *set_data = g_memdup (data, length);
+      *set_data = g_memdup2 (data, length);
       *set_data_length = length;
     }
   else if (to_contentformat == _gdk_win32_clipdrop_atom (GDK_WIN32_ATOM_INDEX_TEXT_PLAIN_UTF8) &&
            from_w32format == CF_UNICODETEXT)
     {
       transmute_cf_unicodetext_to_utf8_string (data, length, set_data, set_data_length, NULL);
+      res = TRUE;
     }
   else if (to_contentformat == _gdk_win32_clipdrop_atom (GDK_WIN32_ATOM_INDEX_TEXT_PLAIN_UTF8) &&
            from_w32format == CF_TEXT)
     {
       transmute_cf_text_to_utf8_string (data, length, set_data, set_data_length, NULL);
+      res = TRUE;
     }
   else if (to_contentformat == _gdk_win32_clipdrop_atom (GDK_WIN32_ATOM_INDEX_IMAGE_BMP) &&
            (from_w32format == CF_DIB || from_w32format == CF_DIBV5))
     {
       transmute_cf_dib_to_image_bmp (data, length, set_data, set_data_length, NULL);
+      res = TRUE;
     }
   else if (to_contentformat == _gdk_win32_clipdrop_atom (GDK_WIN32_ATOM_INDEX_TEXT_URI_LIST) &&
            from_w32format == _gdk_win32_clipdrop_cf (GDK_WIN32_CF_INDEX_CFSTR_SHELLIDLIST))
     {
       transmute_cf_shell_id_list_to_text_uri_list (data, length, set_data, set_data_length, NULL);
+      res = TRUE;
     }
   else
     {
       g_warning ("Don't know how to transmute W32 format 0x%x to content format 0x%p (%s)",
                  from_w32format, to_contentformat, to_contentformat);
-      return FALSE;
+      goto out;
     }
 
+out:
   GlobalUnlock (hdata);
 
-  return TRUE;
+  return res;
 }
 
 gboolean
 _gdk_win32_transmute_contentformat (const char    *from_contentformat,
                                     UINT           to_w32format,
                                     const guchar  *data,
-                                    int            length,
+                                    gsize          length,
                                     guchar       **set_data,
                                     gsize         *set_data_length)
 {
@@ -2642,7 +2654,7 @@ _gdk_win32_transmute_contentformat (const char    *from_contentformat,
        to_w32format == _gdk_win32_clipdrop_cf (GDK_WIN32_CF_INDEX_GIF)))
     {
       /* No conversion needed */
-      *set_data = g_memdup (data, length);
+      *set_data = g_memdup2 (data, length);
       *set_data_length = length;
     }
   else if (from_contentformat == _gdk_win32_clipdrop_atom (GDK_WIN32_ATOM_INDEX_TEXT_PLAIN_UTF8) &&
diff --git a/gdk/win32/gdkclipdrop-win32.h b/gdk/win32/gdkclipdrop-win32.h
index 714f83fe66..1be94dad8f 100644
--- a/gdk/win32/gdkclipdrop-win32.h
+++ b/gdk/win32/gdkclipdrop-win32.h
@@ -252,7 +252,7 @@ void     _gdk_win32_clipboard_default_output_done                  (GObject
 gboolean _gdk_win32_transmute_contentformat                        (const char                  *from_contentformat,
                                                                     UINT                         to_w32format,
                                                                     const guchar                *data,
-                                                                    int                          length,
+                                                                    gsize                        length,
                                                                     guchar                     **set_data,
                                                                     gsize                       *set_data_length);
 
diff --git a/gdk/x11/gdkdevice-xi2.c b/gdk/x11/gdkdevice-xi2.c
index 0102f65c7a..d59dc37612 100644
--- a/gdk/x11/gdkdevice-xi2.c
+++ b/gdk/x11/gdkdevice-xi2.c
@@ -26,6 +26,8 @@
 #include "gdkprivate-x11.h"
 #include "gdkdisplay-x11.h"
 
+#include "gdk-private.h"
+
 #include <stdlib.h>
 #include <X11/Xlib.h>
 #include <X11/Xutil.h>
@@ -760,7 +762,7 @@ gdk_x11_device_xi2_store_axes (GdkX11DeviceXI2 *device,
   g_free (device->last_axes);
 
   if (axes && n_axes)
-    device->last_axes = g_memdup (axes, sizeof (double) * n_axes);
+    device->last_axes = g_memdup2 (axes, sizeof (double) * n_axes);
   else
     device->last_axes = NULL;
 }
diff --git a/gdk/x11/gdksurface-x11.c b/gdk/x11/gdksurface-x11.c
index feecf917a2..1ab71a7cce 100644
--- a/gdk/x11/gdksurface-x11.c
+++ b/gdk/x11/gdksurface-x11.c
@@ -4232,7 +4232,7 @@ _gdk_x11_moveresize_handle_event (const XEvent *event)
             *mv_resize->moveresize_pending_event = *event;
           else
             mv_resize->moveresize_pending_event =
-              g_memdup (event, sizeof (XEvent));
+              g_memdup2 (event, sizeof (XEvent));
 
           break;
         }
diff --git a/gsk/gskrendernodeimpl.c b/gsk/gskrendernodeimpl.c
index 473ce551f2..896dfc6566 100644
--- a/gsk/gskrendernodeimpl.c
+++ b/gsk/gskrendernodeimpl.c
@@ -28,6 +28,8 @@
 #include "gsktransformprivate.h"
 
 #include "gdk/gdktextureprivate.h"
+#include "gdk/gdk-private.h"
+
 #include <cairo-ft.h>
 
 static inline void
@@ -1744,7 +1746,7 @@ draw_shadow_corner (cairo_t               *cr,
       cairo_fill (mask_cr);
       gsk_cairo_blur_surface (mask, radius, GSK_BLUR_X | GSK_BLUR_Y);
       cairo_destroy (mask_cr);
-      g_hash_table_insert (corner_mask_cache, g_memdup (&key, sizeof (key)), mask);
+      g_hash_table_insert (corner_mask_cache, g_memdup2 (&key, sizeof (key)), mask);
     }
 
   gdk_cairo_set_source_rgba (cr, color);
diff --git a/gtk/gtkbuilderparser.c b/gtk/gtkbuilderparser.c
index b368d82cc5..ba409bb22c 100644
--- a/gtk/gtkbuilderparser.c
+++ b/gtk/gtkbuilderparser.c
@@ -28,6 +28,9 @@
 #include "gtkversion.h"
 #include "gdkprofilerprivate.h"
 
+/* XXX: For g_memdup2() */
+#include "gtkprivate.h"
+
 #include <gio/gio.h>
 #include <string.h>
 
@@ -1610,7 +1613,7 @@ create_subparser (GObject       *object,
   subparser->child = child;
   subparser->tagname = g_strdup (element_name);
   subparser->start = element_name;
-  subparser->parser = g_memdup (parser, sizeof (GtkBuildableParser));
+  subparser->parser = g_memdup2 (parser, sizeof (GtkBuildableParser));
   subparser->data = user_data;
 
   return subparser;
diff --git a/gtk/gtkcellareaboxcontext.c b/gtk/gtkcellareaboxcontext.c
index 9ad1ba6e7c..fc50547b25 100644
--- a/gtk/gtkcellareaboxcontext.c
+++ b/gtk/gtkcellareaboxcontext.c
@@ -25,6 +25,9 @@
 #include "gtkcellareaboxcontextprivate.h"
 #include "gtkorientable.h"
 
+/* XXX: For g_memdup2() */
+#include "gtkprivate.h"
+
 /* GObjectClass */
 static void      _gtk_cell_area_box_context_finalize              (GObject               *object);
 
@@ -407,6 +410,7 @@ _gtk_cell_area_box_init_groups (GtkCellAreaBoxContext *box_context,
                                 gboolean              *align_groups)
 {
   GtkCellAreaBoxContextPrivate *priv;
+  gsize groups_size;
 
   g_return_if_fail (GTK_IS_CELL_AREA_BOX_CONTEXT (box_context));
   g_return_if_fail (n_groups == 0 || expand_groups != NULL);
@@ -420,11 +424,13 @@ _gtk_cell_area_box_init_groups (GtkCellAreaBoxContext *box_context,
   g_array_set_size (priv->base_widths,  n_groups);
   g_array_set_size (priv->base_heights, n_groups);
 
+  groups_size = n_groups * sizeof (gboolean);
+
   g_free (priv->expand);
-  priv->expand = g_memdup (expand_groups, n_groups * sizeof (gboolean));
+  priv->expand = g_memdup2 (expand_groups, groups_size);
 
   g_free (priv->align);
-  priv->align = g_memdup (align_groups, n_groups * sizeof (gboolean));
+  priv->align = g_memdup2 (align_groups, groups_size);
 }
 
 void
diff --git a/gtk/gtkcsskeyframes.c b/gtk/gtkcsskeyframes.c
index e4a577379d..f66178cae4 100644
--- a/gtk/gtkcsskeyframes.c
+++ b/gtk/gtkcsskeyframes.c
@@ -24,6 +24,9 @@
 #include "gtkcssstylepropertyprivate.h"
 #include "gtkstylepropertyprivate.h"
 
+/* XXX: For g_memdup2() */
+#include "gtkprivate.h"
+
 #include <stdlib.h>
 #include <string.h>
 
@@ -441,9 +444,9 @@ _gtk_css_keyframes_compute (GtkCssKeyframes  *keyframes,
 
   resolved = gtk_css_keyframes_alloc ();
   resolved->n_keyframes = keyframes->n_keyframes;
-  resolved->keyframe_progress = g_memdup (keyframes->keyframe_progress, keyframes->n_keyframes * sizeof (double));
+  resolved->keyframe_progress = g_memdup2 (keyframes->keyframe_progress, keyframes->n_keyframes * sizeof (double));
   resolved->n_properties = keyframes->n_properties;
-  resolved->property_ids = g_memdup (keyframes->property_ids, keyframes->n_properties * sizeof (guint));
+  resolved->property_ids = g_memdup2 (keyframes->property_ids, keyframes->n_properties * sizeof (guint));
   resolved->values = g_new0 (GtkCssValue *, resolved->n_keyframes * resolved->n_properties);
 
   for (p = 0; p < resolved->n_properties; p++)
diff --git a/gtk/gtkcssnodedeclaration.c b/gtk/gtkcssnodedeclaration.c
index ae78cf74ce..73d002a3fa 100644
--- a/gtk/gtkcssnodedeclaration.c
+++ b/gtk/gtkcssnodedeclaration.c
@@ -19,6 +19,9 @@
 
 #include "gtkcssnodedeclarationprivate.h"
 
+/* XXX: For g_memdup2() */
+#include "gtkprivate.h"
+
 #include <string.h>
 
 struct _GtkCssNodeDeclaration {
@@ -51,7 +54,7 @@ gtk_css_node_declaration_make_writable (GtkCssNodeDeclaration **decl)
 
   (*decl)->refcount--;
 
-  *decl = g_memdup (*decl, sizeof_this_node (*decl));
+  *decl = g_memdup2 (*decl, sizeof_this_node (*decl));
   (*decl)->refcount = 1;
 }
 
diff --git a/gtk/gtkexpression.c b/gtk/gtkexpression.c
index b08c8bf80f..7c3b016e1e 100644
--- a/gtk/gtkexpression.c
+++ b/gtk/gtkexpression.c
@@ -22,6 +22,9 @@
 
 #include "gtkexpression.h"
 
+/* XXX: For g_memdup2() */
+#include "gtkprivate.h"
+
 #include <gobject/gvaluecollector.h>
 
 /**
@@ -685,7 +688,7 @@ gtk_expression_type_register_static (const char                  *type_name,
   info.base_finalize = NULL;
   info.class_init = gtk_expression_generic_class_init;
   info.class_finalize = NULL;
-  info.class_data = g_memdup (type_info, sizeof (GtkExpressionTypeInfo));
+  info.class_data = g_memdup2 (type_info, sizeof (GtkExpressionTypeInfo));
 
   info.instance_size = type_info->instance_size;
   info.n_preallocs = 0;
diff --git a/gtk/gtkrange.c b/gtk/gtkrange.c
index bf119199b0..d0e4d70833 100644
--- a/gtk/gtkrange.c
+++ b/gtk/gtkrange.c
@@ -2831,7 +2831,7 @@ _gtk_range_get_stop_positions (GtkRange  *range,
   gtk_range_calc_marks (range);
 
   if (values)
-    *values = g_memdup (priv->mark_pos, priv->n_marks * sizeof (int));
+    *values = g_memdup2 (priv->mark_pos, priv->n_marks * sizeof (int));
 
   return priv->n_marks;
 }
diff --git a/gtk/gtkroundedbox.c b/gtk/gtkroundedbox.c
index 172f58c4d5..74f3eb8655 100644
--- a/gtk/gtkroundedbox.c
+++ b/gtk/gtkroundedbox.c
@@ -23,6 +23,9 @@
 #include "gtkcssnumbervalueprivate.h"
 #include "gtkcsstypesprivate.h"
 
+/* XXX: For g_memdup2() */
+#include "gtkprivate.h"
+
 #include <string.h>
 
 typedef struct {
@@ -106,7 +109,7 @@ append_arc (cairo_t *cr, double angle1, double angle2, gboolean negative)
         cairo_arc (tmp, 0.0, 0.0, 1.0, angle1, angle2);
 
       arc = fixup_path (cairo_copy_path (tmp));
-      g_hash_table_insert (arc_path_cache, g_memdup (&key, sizeof (key)), arc);
+      g_hash_table_insert (arc_path_cache, g_memdup2 (&key, sizeof (key)), arc);
 
       cairo_destroy (tmp);
       cairo_surface_destroy (surface);
diff --git a/gtk/gtktreednd.c b/gtk/gtktreednd.c
index fe038ea18c..84dee305fd 100644
--- a/gtk/gtktreednd.c
+++ b/gtk/gtktreednd.c
@@ -20,6 +20,7 @@
 #include "gtktreednd.h"
 #include "gtkintl.h"
 
+#include "gtkprivate.h"
 
 /**
  * SECTION:gtktreednd
@@ -245,7 +246,7 @@ struct _GtkTreeRowData
 static GtkTreeRowData *
 gtk_tree_row_data_copy (GtkTreeRowData *src)
 {
-  return g_memdup (src, sizeof (GtkTreeRowData) + strlen (src->path) + 1 -
+  return g_memdup2 (src, sizeof (GtkTreeRowData) + strlen (src->path) + 1 -
     (sizeof (GtkTreeRowData) - G_STRUCT_OFFSET (GtkTreeRowData, path)));
 }
 
diff --git a/gtk/inspector/gtktreemodelcssnode.c b/gtk/inspector/gtktreemodelcssnode.c
index 2939e438cf..3580748e34 100644
--- a/gtk/inspector/gtktreemodelcssnode.c
+++ b/gtk/inspector/gtktreemodelcssnode.c
@@ -20,6 +20,10 @@
 #include "gtktreemodelcssnode.h"
 #include "gtk/gtkcsstransientnodeprivate.h"
 
+#if !GLIB_CHECK_VERSION (2, 67, 3)
+# define g_memdup2(mem,size)    g_memdup((mem), (size))
+#endif
+
 struct _GtkTreeModelCssNodePrivate
 {
   GtkTreeModelCssNodeGetFunc    get_func;
@@ -401,17 +405,22 @@ gtk_tree_model_css_node_newv (GtkTreeModelCssNodeGetFunc  get_func,
 {
   GtkTreeModelCssNode *result;
   GtkTreeModelCssNodePrivate *priv;
+  gsize columns_size;
 
   g_return_val_if_fail (get_func != NULL, NULL);
   g_return_val_if_fail (n_columns > 0, NULL);
+  g_return_val_if_fail (n_columns <= G_MAXSIZE / sizeof (GType), NULL);
   g_return_val_if_fail (types != NULL, NULL);
 
   result = g_object_new (GTK_TYPE_TREE_MODEL_CSS_NODE, NULL);
+
   priv = result->priv;
 
+  columns_size = n_columns * sizeof (GType);
+
   priv->get_func = get_func;
   priv->n_columns = n_columns;
-  priv->column_types = g_memdup (types, sizeof (GType) * n_columns);
+  priv->column_types = g_memdup2 (types, columns_size);
 
   return GTK_TREE_MODEL (result);
 }
diff --git a/modules/printbackends/gtkprintbackendcups.c b/modules/printbackends/gtkprintbackendcups.c
index 6e69d66e3c..10a6d80dc4 100644
--- a/modules/printbackends/gtkprintbackendcups.c
+++ b/modules/printbackends/gtkprintbackendcups.c
@@ -87,6 +87,10 @@ typedef struct _GtkPrintBackendCupsClass GtkPrintBackendCupsClass;
 #define _CUPS_MAP_ATTR_INT(attr, v, a) {if (!g_ascii_strcasecmp (attr->name, (a))) v = attr->values[0].integer;}
 #define _CUPS_MAP_ATTR_STR(attr, v, a) {if (!g_ascii_strcasecmp (attr->name, (a))) v = attr->values[0].string.text;}
 
+#if !GLIB_CHECK_VERSION (2, 67, 3)
+# define g_memdup2(mem,size)    g_memdup((mem), (size))
+#endif
+
 typedef void (* GtkPrintCupsResponseCallbackFunc) (GtkPrintBackend *print_backend,
                                                    GtkCupsResult   *result,
                                                    gpointer         user_data);
@@ -6568,8 +6572,8 @@ localtime_to_utctime (const char *local_time)
       time_t rawtime;
       time (&rawtime);
 
-      actual_utc_time = g_memdup (gmtime (&rawtime), sizeof (struct tm));
-      actual_local_time = g_memdup (localtime (&rawtime), sizeof (struct tm));
+      actual_utc_time = g_memdup2 (gmtime (&rawtime), sizeof (struct tm));
+      actual_local_time = g_memdup2 (localtime (&rawtime), sizeof (struct tm));
 
       diff_time.tm_hour = actual_utc_time->tm_hour - actual_local_time->tm_hour;
       diff_time.tm_min  = actual_utc_time->tm_min  - actual_local_time->tm_min;
diff --git a/testsuite/gtk/timsort.c b/testsuite/gtk/timsort.c
index fa524ca162..f7930259f7 100644
--- a/testsuite/gtk/timsort.c
+++ b/testsuite/gtk/timsort.c
@@ -21,6 +21,10 @@
 
 #include "gtk/timsort/gtktimsortprivate.h"
 
+#if !GLIB_CHECK_VERSION (2, 67, 3)
+# define g_memdup2(mem,size)    g_memdup((mem), (size))
+#endif
+
 #define assert_sort_equal(a, b, size, n) \
   g_assert_cmpmem (a, sizeof (size) * n, b, sizeof (size) * n)
 
@@ -70,7 +74,9 @@ run_comparison (gpointer         a,
   gint64 start, mid, end;
   gpointer b;
 
-  b = g_memdup (a, element_size * n);
+  g_assert (n <= G_MAXSIZE / element_size);
+
+  b = g_memdup2 (a, element_size * n);
 
   start = g_get_monotonic_time ();
   gtk_tim_sort (a, n, element_size, compare_func, data);
@@ -209,7 +215,7 @@ test_steps (void)
   a = g_new (int, n);
   for (i = 0; i < n; i++)
     a[i] = g_test_rand_int ();
-  b = g_memdup (a, sizeof (int) * n);
+  b = g_memdup2 (a, sizeof (int) * n);
 
   gtk_tim_sort_init (&sort, a, n, sizeof (int), compare_int, NULL);
   gtk_tim_sort_set_max_merge_size (&sort, g_test_rand_int_range (512, 2048));