(pbm_load): Allow color values up to 65535.

Throw an error if max_color_idx is outside the supported range.
Report an error when image size is invalid.
Read two bytes at a time when raw images have max_color_idx above 255.

diff --git a/src/ChangeLog b/src/ChangeLog
index d54ad87e772ab5b56995bc8f0bd79af6b6b65c98..b0a940292e5e90c130ffb845aa50856386e8e916 100644 (file)
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,3 +1,10 @@
+2008-03-28  Jason Rumney  <jasonr@gnu.org>
+
+       * image.c (pbm_load): Allow color values up to 65535.
+       Throw an error if max_color_idx is outside the supported range.
+       Report an error when image size is invalid.
+       Read two bytes at a time when raw images have max_color_idx above 255.
+
 2008-03-26  Alexandre Oliva  <aoliva@redhat.com>  (tiny change)
 
        * regex.c (EXTEND_BUFFER): Change order of pointer addition

diff --git a/src/image.c b/src/image.c
index 71a8c4b4995d4dce5fdc0f30776092927abbd5d7..1651585264289da3575dbe066d0cd1ce4b527b3d 100644 (file)
--- a/src/image.c
+++ b/src/image.c
@@ -5776,13 +5776,18 @@ pbm_load (f, img)
   if (type != PBM_MONO)
     {
       max_color_idx = pbm_scan_number (&p, end);
-      if (raw_p && max_color_idx > 255)
-       max_color_idx = 255;
+      if (max_color_idx > 65535 || max_color_idx < 0)
+       {
+         image_error ("Unsupported maximum PBM color value", Qnil, Qnil);
+         goto error;
+       }
     }
 
-  if (!check_image_size (f, width, height)
-      || (type != PBM_MONO && max_color_idx < 0))
-    goto error;
+  if (!check_image_size (f, width, height))
+    {
+      image_error ("Invalid image size", Qnil, Qnil);
+      goto error;
+    }
 
   if (!x_create_x_image_and_pixmap (f, width, height, 0,
                                    &ximg, &img->pixmap))
@@ -5842,10 +5847,13 @@ pbm_load (f, img)
     }
   else
     {
-      if (raw_p
-         && ((type == PBM_GRAY)
-             ? (p + height * width > end)
-             : (p + 3 * height * width > end)))
+      int expected_size = height * width;
+      if (max_color_idx > 255)
+       expected_size *= 2;
+      if (type == PBM_COLOR)
+       expected_size *= 3;
+
+      if (raw_p && p + expected_size > end)
        {
          x_destroy_x_image (ximg);
          x_clear_image (f, img);
@@ -5859,13 +5867,25 @@ pbm_load (f, img)
          {
            int r, g, b;
 
-           if (type == PBM_GRAY)
-             r = g = b = raw_p ? *p++ : pbm_scan_number (&p, end);
+           if (type == PBM_GRAY && raw_p)
+             {
+               r = g = b = *p++;
+               if (max_color_idx > 255)
+                 r = g = b = r * 256 + *p++;
+             }
+           else if (type == PBM_GRAY)
+             r = g = b = pbm_scan_number (&p, end);
            else if (raw_p)
              {
                r = *p++;
+               if (max_color_idx > 255)
+                 r = r * 256 + *p++;
                g = *p++;
+               if (max_color_idx > 255)
+                 g = g * 256 + *p++;
                b = *p++;
+               if (max_color_idx > 255)
+                 b = b * 256 + *p++;
              }
            else
              {