From b9c89e11fbf44c471b60cd385d770597aea7c653 Mon Sep 17 00:00:00 2001 From: Jason Rumney Date: Fri, 28 Mar 2008 14:59:22 +0000 Subject: [PATCH] (pbm_load): Allow color values up to 65535. Throw an error if max_color_idx is outside the supported range. Report an error when image size is invalid. Read two bytes at a time when raw images have max_color_idx above 255. --- src/ChangeLog | 7 +++++++ src/image.c | 42 +++++++++++++++++++++++++++++++----------- 2 files changed, 38 insertions(+), 11 deletions(-) diff --git a/src/ChangeLog b/src/ChangeLog index d54ad87e772..b0a940292e5 100644 --- a/src/ChangeLog +++ b/src/ChangeLog @@ -1,3 +1,10 @@ +2008-03-28 Jason Rumney + + * image.c (pbm_load): Allow color values up to 65535. + Throw an error if max_color_idx is outside the supported range. + Report an error when image size is invalid. + Read two bytes at a time when raw images have max_color_idx above 255. + 2008-03-26 Alexandre Oliva (tiny change) * regex.c (EXTEND_BUFFER): Change order of pointer addition diff --git a/src/image.c b/src/image.c index 71a8c4b4995..16515852642 100644 --- a/src/image.c +++ b/src/image.c @@ -5776,13 +5776,18 @@ pbm_load (f, img) if (type != PBM_MONO) { max_color_idx = pbm_scan_number (&p, end); - if (raw_p && max_color_idx > 255) - max_color_idx = 255; + if (max_color_idx > 65535 || max_color_idx < 0) + { + image_error ("Unsupported maximum PBM color value", Qnil, Qnil); + goto error; + } } - if (!check_image_size (f, width, height) - || (type != PBM_MONO && max_color_idx < 0)) - goto error; + if (!check_image_size (f, width, height)) + { + image_error ("Invalid image size", Qnil, Qnil); + goto error; + } if (!x_create_x_image_and_pixmap (f, width, height, 0, &ximg, &img->pixmap)) @@ -5842,10 +5847,13 @@ pbm_load (f, img) } else { - if (raw_p - && ((type == PBM_GRAY) - ? (p + height * width > end) - : (p + 3 * height * width > end))) + int expected_size = height * width; + if (max_color_idx > 255) + expected_size *= 2; + if (type == PBM_COLOR) + expected_size *= 3; + + if (raw_p && p + expected_size > end) { x_destroy_x_image (ximg); x_clear_image (f, img); @@ -5859,13 +5867,25 @@ pbm_load (f, img) { int r, g, b; - if (type == PBM_GRAY) - r = g = b = raw_p ? *p++ : pbm_scan_number (&p, end); + if (type == PBM_GRAY && raw_p) + { + r = g = b = *p++; + if (max_color_idx > 255) + r = g = b = r * 256 + *p++; + } + else if (type == PBM_GRAY) + r = g = b = pbm_scan_number (&p, end); else if (raw_p) { r = *p++; + if (max_color_idx > 255) + r = r * 256 + *p++; g = *p++; + if (max_color_idx > 255) + g = g * 256 + *p++; b = *p++; + if (max_color_idx > 255) + b = b * 256 + *p++; } else { -- 2.39.2