File imlib2-1.4.0-more-fixes.patch of Package imlib2

Overview Repositories Revisions Requests Users Attributes Meta

File imlib2-1.4.0-more-fixes.patch of Package imlib2 (Revision b5a668e6a1e6e76d1f1682c0858bab06)

Currently displaying revision b5a668e6a1e6e76d1f1682c0858bab06 , Show latest

--- src/modules/loaders/loader_argb.c
+++ src/modules/loaders/loader_argb.c
@@ -10,7 +10,7 @@
 load(ImlibImage * im, ImlibProgressFunction progress,
      char progress_granularity, char immediate_load)
 {
-   int                 w, h, alpha;
+   int                 w = 0, h = 0, alpha = 0;
    FILE               *f;
 
    if (im->data)
@@ -23,6 +23,8 @@
    {
       char                buf[256], buf2[256];
 
+      memset(buf, 0, sizeof(buf));
+      memset(buf2, 0, sizeof(buf2));
       if (!fgets(buf, 255, f))
         {
            fclose(f);
--- src/modules/loaders/loader_bmp.c
+++ src/modules/loaders/loader_bmp.c
@@ -519,6 +519,7 @@
                   unsigned char *buffer_end_minus_1 = buffer_end - 1;
                   x = 0;
                   y = 0;
+		  g = 1; // Better say 1 than uninitialized; what is this good for anyway? jw@suse.de
                   for (i = 0; i < imgsize && buffer_ptr < buffer_end_minus_1 && g; i++)
                     {
                        byte1 = buffer_ptr[0];
--- src/modules/loaders/loader_jpeg.c
+++ src/modules/loaders/loader_jpeg.c
@@ -78,6 +78,7 @@
         im->h = h = cinfo.output_height;
 	if ((w < 1) || (h < 1) || (w > 8192) || (h > 8192))
 	  {
+             im->w = im->h = 0;
              jpeg_destroy_decompress(&cinfo);
              fclose(f);
              return 0;
@@ -96,6 +97,7 @@
 
         if (cinfo.rec_outbuf_height > 16)
           {
+             im->w = im->h = 0;
              jpeg_destroy_decompress(&cinfo);
              fclose(f);
              return 0;
@@ -103,6 +105,7 @@
         data = malloc(w * 16 * 3);
         if (!data)
           {
+             im->w = im->h = 0;
              jpeg_destroy_decompress(&cinfo);
              fclose(f);
              return 0;
@@ -111,6 +114,7 @@
         ptr2 = im->data = malloc(w * h * sizeof(DATA32));
         if (!im->data)
           {
+             im->w = im->h = 0;
              free(data);
              jpeg_destroy_decompress(&cinfo);
              fclose(f);
--- src/modules/loaders/loader_lbm.c
+++ src/modules/loaders/loader_lbm.c
@@ -437,6 +437,7 @@
         }
     }
     if (!full || !ok) {
+	im->w = im->h = 0;
         freeilbm(&ilbm);
         return ok;
     }
@@ -452,11 +453,11 @@
     plane[0] = NULL;
 
     im->data = malloc(im->w * im->h * sizeof(DATA32));
-    if (im->data) {
+    plane[0] = malloc(((im->w + 15) / 16) * 2 * n);
+    if (im->data && plane[0]) {
         n = ilbm.depth;
         if (ilbm.mask == 1) n++;
 
-        plane[0] = malloc(((im->w + 15) / 16) * 2 * n);
         for (i = 1; i < n; i++) plane[i] = plane[i - 1] + ((im->w + 15) / 16) * 2;
 
         z = ((im->w + 15) / 16) * 2 * n;
@@ -492,9 +493,10 @@
 
   /*----------
    * We either had a successful decode, the user cancelled, or we couldn't get
-   * the memory for im->data.
+   * the memory for im->data or plane[0].
    *----------*/
     if (!ok) {
+	im->w = im->h = 0;
         if (im->data) free(im->data);
         im->data = NULL;
     }
--- src/modules/loaders/loader_pnm.c
+++ src/modules/loaders/loader_pnm.c
@@ -68,7 +68,7 @@
              int                 i = 0;
 
              /* read numbers */
-             while (c != EOF && !isspace(c))
+             while (c != EOF && (i+1 < sizeof(buf)) && !isspace(c))
                {
                   buf[i++] = c;
                   c = fgetc(f);
--- src/modules/loaders/loader_tga.c
+++ src/modules/loaders/loader_tga.c
@@ -350,7 +350,7 @@
                   else
                      dataptr = im->data + (y * im->w);
 
-                  for (x = 0; x < im->w; x++)   /* for each pixel in the row */
+                  for (x = 0; (x < im->w) && (bufptr+bpp/8 < bufend); x++)   /* for each pixel in the row */
                     {
                        switch (bpp)
                          {
@@ -412,6 +412,10 @@
 
                   curbyte = *bufptr++;
                   count = (curbyte & 0x7F) + 1;
+                  if (dataptr+count > final_pixel)
+                    {
+                       count = final_pixel - dataptr;
+                    }
 
                   if (curbyte & 0x80)   /* RLE packet */
                     {
--- src/modules/loaders/loader_xpm.c
+++ src/modules/loaders/loader_xpm.c
@@ -154,6 +154,9 @@
    pixels = 0;
    count = 0;
    line = malloc(lsz);
+   if (!line)
+     return NULL;
+
    backslash = 0;
    memset(lookup, 0, sizeof(lookup));
    while (!done)

Places

File imlib2-1.4.0-more-fixes.patch of Package imlib2 (Revision b5a668e6a1e6e76d1f1682c0858bab06)

Places