Overflow in out_limit calculation

[Miroslav Lichvar]

A static analyzer reports a possible integer overflow in
_nc_setupscreen(): 

        sp->out_limit = (size_t) ((2 + slines) * (6 + scolumns));

slines and scolumns are ints, possibly parsed from the well-known
environment variables, before they are validated in newwin()->...->
dimension_limit(), which might accept any value if NCURSES_SIZE_T is
int.

This doesn't seem to have any security implications, but maybe it
could be improved to prevent the overflow by casting the variables to
size_t or validating the dimensions before that. Does anyone need
COLUMNS or LINES larger than 32767?

-- 
Miroslav Lichvar