summaryrefslogtreecommitdiff
path: root/src/create.c
diff options
context:
space:
mode:
Diffstat (limited to 'src/create.c')
-rw-r--r--src/create.c99
1 files changed, 75 insertions, 24 deletions
diff --git a/src/create.c b/src/create.c
index 790e23e..a6f105e 100644
--- a/src/create.c
+++ b/src/create.c
@@ -1,3 +1,4 @@
+/* $XdotOrg: xc/extras/Xpm/lib/create.c,v 1.2.4.2 2004/12/17 01:09:36 gisburn Exp $ */
/*
* Copyright (C) 1989-95 GROUPE BULL
*
@@ -44,6 +45,8 @@
* Lorens Younes (d93-hyo@nada.kth.se) 4/96
*/
+/* October 2004, source code review by Thomas Biege <thomas@suse.de> */
+
#include "XpmI.h"
#include <ctype.h>
@@ -585,7 +588,7 @@ CreateColors(display, attributes, colors, ncolors, image_pixels, mask_pixels,
*/
} else {
#endif
- int i;
+ unsigned int i;
#ifndef AMIGA
ncols = visual->map_entries;
@@ -745,12 +748,14 @@ FreeColors(display, colormap, pixels, n, closure)
/* function call in case of error */
+
#undef RETURN
#define RETURN(status) \
+do \
{ \
ErrorStatus = status; \
goto error; \
-}
+} while(0)
int
XpmCreateImageFromXpmImage(display, image,
@@ -816,6 +821,9 @@ XpmCreateImageFromXpmImage(display, image,
ErrorStatus = XpmSuccess;
+ if (image->ncolors >= UINT_MAX / sizeof(Pixel))
+ return (XpmNoMemory);
+
/* malloc pixels index tables */
image_pixels = (Pixel *) XpmMalloc(sizeof(Pixel) * image->ncolors);
if (!image_pixels)
@@ -988,7 +996,13 @@ CreateXImage(display, visual, depth, format, width, height, image_return)
return (XpmNoMemory);
#if !defined(FOR_MSW) && !defined(AMIGA)
+ if (height != 0 && (*image_return)->bytes_per_line >= INT_MAX / height) {
+ XDestroyImage(*image_return);
+ return XpmNoMemory;
+ }
/* now that bytes_per_line must have been set properly alloc data */
+ if((*image_return)->bytes_per_line == 0 || height == 0)
+ return XpmNoMemory;
(*image_return)->data =
(char *) XpmMalloc((*image_return)->bytes_per_line * height);
@@ -1017,7 +1031,7 @@ CreateXImage(display, visual, depth, format, width, height, image_return)
LFUNC(_putbits, void, (register char *src, int dstoffset,
register int numbits, register char *dst));
-LFUNC(_XReverse_Bytes, int, (register unsigned char *bpt, register int nb));
+LFUNC(_XReverse_Bytes, int, (register unsigned char *bpt, register unsigned int nb));
static unsigned char Const _reverse_byte[0x100] = {
0x00, 0x80, 0x40, 0xc0, 0x20, 0xa0, 0x60, 0xe0,
@@ -1057,12 +1071,12 @@ static unsigned char Const _reverse_byte[0x100] = {
static int
_XReverse_Bytes(bpt, nb)
register unsigned char *bpt;
- register int nb;
+ register unsigned int nb;
{
do {
*bpt = _reverse_byte[*bpt];
bpt++;
- } while (--nb > 0);
+ } while (--nb > 0); /* is nb user-controled? */
return 0;
}
@@ -1201,7 +1215,7 @@ PutImagePixels(image, width, height, pixelindex, pixels)
register char *src;
register char *dst;
register unsigned int *iptr;
- register int x, y, i;
+ register unsigned int x, y, i;
register char *data;
Pixel pixel, px;
int nbytes, depth, ibu, ibpp;
@@ -1211,8 +1225,8 @@ PutImagePixels(image, width, height, pixelindex, pixels)
depth = image->depth;
if (depth == 1) {
ibu = image->bitmap_unit;
- for (y = 0; y < height; y++)
- for (x = 0; x < width; x++, iptr++) {
+ for (y = 0; y < height; y++) /* how can we trust height */
+ for (x = 0; x < width; x++, iptr++) { /* how can we trust width */
pixel = pixels[*iptr];
for (i = 0, px = pixel; i < sizeof(unsigned long);
i++, px >>= 8)
@@ -1287,12 +1301,12 @@ PutImagePixels32(image, width, height, pixelindex, pixels)
{
unsigned char *data;
unsigned int *iptr;
- int y;
+ unsigned int y;
Pixel pixel;
#ifdef WITHOUT_SPEEDUPS
- int x;
+ unsigned int x;
unsigned char *addr;
data = (unsigned char *) image->data;
@@ -1329,7 +1343,7 @@ PutImagePixels32(image, width, height, pixelindex, pixels)
#else /* WITHOUT_SPEEDUPS */
- int bpl = image->bytes_per_line;
+ unsigned int bpl = image->bytes_per_line;
unsigned char *data_ptr, *max_data;
data = (unsigned char *) image->data;
@@ -1397,11 +1411,11 @@ PutImagePixels16(image, width, height, pixelindex, pixels)
{
unsigned char *data;
unsigned int *iptr;
- int y;
+ unsigned int y;
#ifdef WITHOUT_SPEEDUPS
- int x;
+ unsigned int x;
unsigned char *addr;
data = (unsigned char *) image->data;
@@ -1425,7 +1439,7 @@ PutImagePixels16(image, width, height, pixelindex, pixels)
Pixel pixel;
- int bpl = image->bytes_per_line;
+ unsigned int bpl = image->bytes_per_line;
unsigned char *data_ptr, *max_data;
data = (unsigned char *) image->data;
@@ -1478,11 +1492,11 @@ PutImagePixels8(image, width, height, pixelindex, pixels)
{
char *data;
unsigned int *iptr;
- int y;
+ unsigned int y;
#ifdef WITHOUT_SPEEDUPS
- int x;
+ unsigned int x;
data = image->data;
iptr = pixelindex;
@@ -1492,7 +1506,7 @@ PutImagePixels8(image, width, height, pixelindex, pixels)
#else /* WITHOUT_SPEEDUPS */
- int bpl = image->bytes_per_line;
+ unsigned int bpl = image->bytes_per_line;
char *data_ptr, *max_data;
data = image->data;
@@ -1527,12 +1541,12 @@ PutImagePixels1(image, width, height, pixelindex, pixels)
PutImagePixels(image, width, height, pixelindex, pixels);
else {
unsigned int *iptr;
- int y;
+ unsigned int y;
char *data;
#ifdef WITHOUT_SPEEDUPS
- int x;
+ unsigned int x;
data = image->data;
iptr = pixelindex;
@@ -1755,6 +1769,9 @@ PutPixel1(ximage, x, y, pixel)
Pixel px;
int nbytes;
+ if(x < 0 || y < 0)
+ return 0;
+
for (i=0, px=pixel; i<sizeof(unsigned long); i++, px>>=8)
((unsigned char *)&pixel)[i] = px;
src = &ximage->data[XYINDEX(x, y, ximage)];
@@ -1785,7 +1802,10 @@ PutPixel(ximage, x, y, pixel)
register char *dst;
register int i;
Pixel px;
- int nbytes, ibpp;
+ unsigned int nbytes, ibpp;
+
+ if(x < 0 || y < 0)
+ return 0;
ibpp = ximage->bits_per_pixel;
if (ximage->depth == 4)
@@ -1819,6 +1839,9 @@ PutPixel32(ximage, x, y, pixel)
{
unsigned char *addr;
+ if(x < 0 || y < 0)
+ return 0;
+
addr = &((unsigned char *)ximage->data) [ZINDEX32(x, y, ximage)];
*((unsigned long *)addr) = pixel;
return 1;
@@ -1834,6 +1857,9 @@ PutPixel32MSB(ximage, x, y, pixel)
{
unsigned char *addr;
+ if(x < 0 || y < 0)
+ return 0;
+
addr = &((unsigned char *)ximage->data) [ZINDEX32(x, y, ximage)];
addr[0] = pixel >> 24;
addr[1] = pixel >> 16;
@@ -1851,6 +1877,9 @@ PutPixel32LSB(ximage, x, y, pixel)
{
unsigned char *addr;
+ if(x < 0 || y < 0)
+ return 0;
+
addr = &((unsigned char *)ximage->data) [ZINDEX32(x, y, ximage)];
addr[3] = pixel >> 24;
addr[2] = pixel >> 16;
@@ -1868,6 +1897,9 @@ PutPixel16MSB(ximage, x, y, pixel)
{
unsigned char *addr;
+ if(x < 0 || y < 0)
+ return 0;
+
addr = &((unsigned char *)ximage->data) [ZINDEX16(x, y, ximage)];
addr[0] = pixel >> 8;
addr[1] = pixel;
@@ -1883,6 +1915,9 @@ PutPixel16LSB(ximage, x, y, pixel)
{
unsigned char *addr;
+ if(x < 0 || y < 0)
+ return 0;
+
addr = &((unsigned char *)ximage->data) [ZINDEX16(x, y, ximage)];
addr[1] = pixel >> 8;
addr[0] = pixel;
@@ -1896,6 +1931,9 @@ PutPixel8(ximage, x, y, pixel)
int y;
unsigned long pixel;
{
+ if(x < 0 || y < 0)
+ return 0;
+
ximage->data[ZINDEX8(x, y, ximage)] = pixel;
return 1;
}
@@ -1907,6 +1945,9 @@ PutPixel1MSB(ximage, x, y, pixel)
int y;
unsigned long pixel;
{
+ if(x < 0 || y < 0)
+ return 0;
+
if (pixel & 1)
ximage->data[ZINDEX1(x, y, ximage)] |= 0x80 >> (x & 7);
else
@@ -1921,6 +1962,9 @@ PutPixel1LSB(ximage, x, y, pixel)
int y;
unsigned long pixel;
{
+ if(x < 0 || y < 0)
+ return 0;
+
if (pixel & 1)
ximage->data[ZINDEX1(x, y, ximage)] |= 1 << (x & 7);
else
@@ -2055,6 +2099,9 @@ xpmParseDataAndCreate(display, data, image_return, shapeimage_return,
xpmGetCmt(data, &colors_cmt);
/* malloc pixels index tables */
+ if (ncolors >= UINT_MAX / sizeof(Pixel))
+ RETURN(XpmNoMemory);
+
image_pixels = (Pixel *) XpmMalloc(sizeof(Pixel) * ncolors);
if (!image_pixels)
RETURN(XpmNoMemory);
@@ -2165,7 +2212,7 @@ xpmParseDataAndCreate(display, data, image_return, shapeimage_return,
* free the hastable
*/
if (ErrorStatus != XpmSuccess)
- RETURN(ErrorStatus)
+ RETURN(ErrorStatus);
else if (USE_HASHTABLE)
xpmHashTableFree(&hashtable);
@@ -2309,7 +2356,8 @@ ParseAndPutPixels(
}
obm = SelectObject(*dc, image->bitmap);
#endif
-
+ if (ncolors > 256)
+ return (XpmFileInvalid);
bzero((char *)colidx, 256 * sizeof(short));
for (a = 0; a < ncolors; a++)
@@ -2356,11 +2404,11 @@ if (cidx[f]) XpmFree(cidx[f]);}
/* array of pointers malloced by need */
unsigned short *cidx[256];
- int char1;
+ unsigned int char1;
bzero((char *)cidx, 256 * sizeof(unsigned short *)); /* init */
for (a = 0; a < ncolors; a++) {
- char1 = colorTable[a].string[0];
+ char1 = (unsigned char) colorTable[a].string[0];
if (cidx[char1] == NULL) { /* get new memory */
cidx[char1] = (unsigned short *)
XpmCalloc(256, sizeof(unsigned short));
@@ -2415,6 +2463,9 @@ if (cidx[f]) XpmFree(cidx[f]);}
char *s;
char buf[BUFSIZ];
+ if (cpp >= sizeof(buf))
+ return (XpmFileInvalid);
+
buf[cpp] = '\0';
if (USE_HASHTABLE) {
xpmHashAtom *slot;
generated by cgit v1.2.3 (git 2.39.1) at 2024-04-27 14:14:21 +0000