Release 10.73.23

git-svn-id: http://svn.code.sf.net/p/netpbm/code/stable@3449 9d0c8265-081b-0410-96cb-a4ca84ce46f8

4 files changed, 49 insertions, 12 deletions

diff --git a/converter/other/bmptopnm.c b/converter/other/bmptopnm.c
index 05749c27..9e476ef4 100644
--- a/converter/other/bmptopnm.c
+++ b/converter/other/bmptopnm.c
@@ -632,11 +632,11 @@ bmpReadinfoheader(FILE *                 const ifP,
         readWindowsInfoHeader(ifP, cInfoHeaderSize, headerP);
         break;
     case 108:
-        pm_error("%s: this is a Version 4 Windows BMP; "
+        pm_error("This is a Version 4 Windows BMP; "
                  "this program knows only Version 1");
         break;
     case 124:
-        pm_error("%s: this is a Version 5 Windows BMP; "
+        pm_error("This is a Version 5 Windows BMP; "
                  "this program knows only Version 1");
         break;
     default:
@@ -835,6 +835,15 @@ convertRow32(unsigned char      const bmprow[],
 } 
 
 
+static void
+validateIndex(unsigned int const index,
+	      unsigned int const cmapsize ) {
+
+    if (index >= cmapsize)
+        pm_error("Error: invalid index to color palette.");
+}
+
+
 
 static void
 convertRow(unsigned char      const bmprow[], 
@@ -842,7 +851,8 @@ convertRow(unsigned char      const bmprow[],
            int                const cols, 
            unsigned int       const cBitCount, 
            struct pixelformat const pixelformat,
-           xel                const colormap[]
+           xel                const colormap[],
+           unsigned int       const cmapsize
            ) {
 /*----------------------------------------------------------------------------
    Convert a row in raw BMP raster format bmprow[] to a row of xels xelrow[].
@@ -862,9 +872,12 @@ convertRow(unsigned char      const bmprow[],
         convertRow32(bmprow, xelrow, cols, pixelformat);
     else if (cBitCount == 8) {            
         /* It's a whole byte colormap index */
-        unsigned int col;
-        for (col = 0; col < cols; ++col)
-            xelrow[col] = colormap[bmprow[col]];
+        unsigned int col; 
+        for (col = 0; col < cols; ++col) {
+            unsigned int const index = bmprow[col];
+            validateIndex(index, cmapsize);
+            xelrow[col] = colormap[index];
+	}
     } else if (cBitCount == 1 || cBitCount == 2 || cBitCount == 4) {
         /* It's a bit field color index */
         unsigned char const mask = ( 1 << cBitCount ) - 1;
@@ -876,6 +889,7 @@ convertRow(unsigned char      const bmprow[],
             unsigned int const shift = 8 - ((col*cBitCount) % 8) - cBitCount;
             unsigned int const index = 
                 (bmprow[cursor] & (mask << shift)) >> shift;
+            validateIndex(index, cmapsize);
             xelrow[col] = colormap[index];
         }
     } else {
@@ -1338,6 +1352,7 @@ readBmp(FILE *               const ifP,
         unsigned int *       const cBitCountP, 
         struct pixelformat * const pixelformatP,
         xel **               const colormapP,
+        unsigned int *       const cmapsizeP,
         bool                 const verbose) {
 
     xel * colormap;  /* malloc'ed */
@@ -1394,6 +1409,7 @@ readBmp(FILE *               const ifP,
     *rowsP        = bmpHeader.rows;
     *pixelformatP = bmpHeader.pixelformat;
     *colormapP    = colormap;
+    *cmapsizeP    = bmpHeader.cmapsize;
 }
 
 
@@ -1405,7 +1421,8 @@ writeRasterGen(unsigned char **   const bmpRaster,
                int                const format,
                unsigned int       const cBitCount, 
                struct pixelformat const pixelformat,
-               xel                const colormap[]) {
+               xel                const colormap[],
+               unsigned int       const cmapsize) {
 /*----------------------------------------------------------------------------
   Write the PNM raster to Standard Output, corresponding to the raw BMP
   raster bmpRaster.  Write the raster assuming the PNM image has 
@@ -1426,7 +1443,7 @@ writeRasterGen(unsigned char **   const bmpRaster,
 
     for (row = 0; row < rows; ++row) {
         convertRow(bmpRaster[row], xelrow, cols, cBitCount, pixelformat,
-                   colormap);
+                   colormap, cmapsize);
         pnm_writepnmrow(stdout, xelrow, cols, bmpMaxval, format, FALSE);
     }
     pnm_freerow(xelrow);
@@ -1508,6 +1525,13 @@ main(int argc, const char ** argv) {
         /* Malloc'ed colormap (palette) from the BMP.  Contents of map
            undefined if not a colormapped BMP.
          */
+    unsigned int cmapsize;
+        /* Number of colormap entries.  Described in the BMP header.
+           Note that a file may be 8 bits per pixel but have less than
+           256 colors.  In the 1 bit per pixel case, there should be
+           2 entries according to the official specification, but we
+           allow files with just 1.
+	 */
 
     pm_proginit(&argc, argv);
 
@@ -1520,7 +1544,7 @@ main(int argc, const char ** argv) {
         ifname = cmdline.inputFileName;
 
     readBmp(ifP, &bmpRaster, &cols, &rows, &grayPresent, &colorPresent, 
-            &cBitCount, &pixelformat, &colormap,
+            &cBitCount, &pixelformat, &colormap, &cmapsize,
             cmdline.verbose);
     pm_close(ifP);
 
@@ -1541,7 +1565,7 @@ main(int argc, const char ** argv) {
     } else {
         pnm_writepnminit(stdout, cols, rows, bmpMaxval, outputType, FALSE);
         writeRasterGen(bmpRaster, cols, rows, outputType, cBitCount,
-                       pixelformat, colormap); 
+                       pixelformat, colormap, cmapsize); 
     }
     free(colormap);
     free(bmpRaster);
diff --git a/doc/HISTORY b/doc/HISTORY
index fded5db4..b34e2244 100644
--- a/doc/HISTORY
+++ b/doc/HISTORY
@@ -4,6 +4,15 @@ Netpbm.
 CHANGE HISTORY 
 --------------
 
+18.11.05 BJH  Release 10.73.23
+
+              bmptopnm: Fix array bounds violation when index value in raster
+              is too big.  Broken after Netpbm 10.10 (October 2002) but before
+              10.19 (November 2003).
+
+              Merge build: fix so legacy program names 'pnmtopnm', 'ppmnorm',
+              and 'ppmtotga' work again.
+
 18.11.02 BJH  Release 10.73.22
 
               picttoppm: accept rectangle specifications in input that have
diff --git a/netpbm.c b/netpbm.c
index f647ad15..eeb82acc 100644
--- a/netpbm.c
+++ b/netpbm.c
@@ -80,16 +80,20 @@ main(int argc, char *argv[]) {
     TRY("ppmnorm", main_pnmnorm);
     TRY("ppmtotga", main_pamtotga);
     TRY("ppmtouil", main_pamtouil);
+    TRY("pnmtopnm", main_pamtopnm);
+    TRY("ppmnorm", main_pnmnorm);
+    TRY("ppmtotga", main_pamtotga);
 
     /* We don't do the ppmtojpeg alias because if user doesn't have a JPEG
        library, there is no main_pnmtojpeg library.  The right way to do
        this is to have these TRY's generated by the subdirectory makes,
        which would know whether pnmtojpeg was built into the merged binary
-       or not.  But that's too much work.  Same with TIFF converters.
+       or not.  But that's too much work.  Same with TIFF and PNG converters.
 
     TRY("ppmtojpeg", main_pnmtojpeg); 
     TRY("pngtopnm", main_pngtopam); 
     TRY("pnmtotiff", main_pamtotiff);
+    TRY("pamrgbatopng", main_pamtopng);
     */
 
     fprintf(stderr,"'%s' is an unknown Netpbm program name \n", cp );
diff --git a/version.mk b/version.mk
index 5727e98d..528b929a 100644
--- a/version.mk
+++ b/version.mk
@@ -1,3 +1,3 @@
 NETPBM_MAJOR_RELEASE = 10
 NETPBM_MINOR_RELEASE = 73
-NETPBM_POINT_RELEASE = 22
+NETPBM_POINT_RELEASE = 23