Release 10.47.23

git-svn-id: http://svn.code.sf.net/p/netpbm/code/stable@1374 9d0c8265-081b-0410-96cb-a4ca84ce46f8

5 files changed, 28 insertions, 12 deletions

diff --git a/converter/bmp.h b/converter/bmp.h
index b22be82f..8b2aa302 100644
--- a/converter/bmp.h
+++ b/converter/bmp.h
@@ -126,7 +126,7 @@ BMPleninfoheader(enum bmpClass const class) {
 static __inline__ unsigned int
 BMPlencolormap(enum bmpClass const class,
                unsigned int  const bitcount, 
-               int           const cmapsize) {
+               unsigned int  const cmapsize) {
 
     unsigned int lenrgb;
     unsigned int lencolormap;
@@ -141,7 +141,7 @@ BMPlencolormap(enum bmpClass const class,
         case C_OS2: lenrgb = 3; break;
         }
 
-        if (cmapsize < 0) 
+        if (!cmapsize) 
             lencolormap = (1 << bitcount) * lenrgb;
         else 
             lencolormap = cmapsize * lenrgb;
@@ -216,7 +216,7 @@ BMPoffbits(enum bmpClass const class,
 static __inline__ unsigned int
 BMPlenfileGen(enum bmpClass     const class,
               unsigned int      const bitcount, 
-              int               const cmapsize,
+              unsigned int      const cmapsize,
               unsigned int      const x,
               unsigned int      const y,
               unsigned int      const imageSize,
@@ -244,7 +244,7 @@ BMPlenfileGen(enum bmpClass     const class,
 static __inline__ unsigned int
 BMPlenfile(enum bmpClass const class,
            unsigned int  const bitcount, 
-           int           const cmapsize,
+           unsigned int  const cmapsize,
            unsigned int  const x,
            unsigned int  const y) {
 /*----------------------------------------------------------------------------
diff --git a/converter/other/bmptopnm.c b/converter/other/bmptopnm.c
index 647ae3c6..95ba099d 100644
--- a/converter/other/bmptopnm.c
+++ b/converter/other/bmptopnm.c
@@ -94,8 +94,11 @@ struct bmpInfoHeader {
            described by the "mask" values in the header, rather than
            fixed formats.
         */
-    int cmapsize;
-        /* Size in bytes of the colormap (palette) in the BMP file */
+    unsigned int cmapsize;
+        /* Size in bytes of the colormap (palette) in the BMP file.
+
+           Zero means there is no colormap.
+        */
     unsigned int imageSize;
         /* Size in bytes of the image data.  We only reference this 
            when the image is compressed. */    
@@ -360,6 +363,8 @@ readWindowsBasic40ByteInfoHeader(FILE *                 const ifP,
     headerP->cols = GetLong(ifP);
     {
         long const cy = GetLong(ifP);
+        if (cy == 0)
+            pm_error("Invalid BMP file: says height is zero");
         if (cy < 0) {
             headerP->rowOrder = TOPDOWN;
             headerP->rows = - cy;
@@ -387,7 +392,7 @@ readWindowsBasic40ByteInfoHeader(FILE *                 const ifP,
     GetLong(ifP);   /* YpixelsPerMeter */
     colorsused = GetLong(ifP);   /* ColorsUsed */
     /* See comments in bmp.h for info about the definition of the following
-       word and its relationship to the color map size (*pcmapsize).
+       word and its relationship to the color map size (headerP->cmapsize).
     */
     colorsimportant = GetLong(ifP);  /* ColorsImportant */
 
@@ -620,7 +625,7 @@ static void
 BMPreadcolormap(FILE *         const ifP, 
                 int            const class, 
                 xel **         const colormapP, 
-                int            const cmapsize,
+                unsigned int   const cmapsize,
                 unsigned int * const bytesReadP) {
 /*----------------------------------------------------------------------------
    Read the color map from the present position in the input BMP file
@@ -635,7 +640,7 @@ BMPreadcolormap(FILE *         const ifP,
    'class' is the class of BMP image - Windows or OS/2.
 -----------------------------------------------------------------------------*/
 
-    int i;
+    unsigned int i;
 
     xel * colormap;
     unsigned int bytesRead;
@@ -1175,7 +1180,7 @@ reportHeader(struct bmpInfoHeader const header,
                header.compression == COMP_JPEG ? "JPEG (not supported)" :
                header.compression == COMP_PNG ? "PNG (not supported)" :
                "???");                
-    pm_message("  Colors in color map: %d", header.cmapsize);
+    pm_message("  Colors in color map: %u", header.cmapsize);
 }        
 
 
diff --git a/converter/other/pngtopam.c b/converter/other/pngtopam.c
index 534439d2..80438674 100644
--- a/converter/other/pngtopam.c
+++ b/converter/other/pngtopam.c
@@ -1220,7 +1220,7 @@ convertpng(FILE *             const ifp,
     }
 
     pam.size        = sizeof(pam);
-    pam.len         = PAM_STRUCT_SIZE(maxval);
+    pam.len         = PAM_STRUCT_SIZE(tuple_type);
     pam.file        = stdout;
     pam.plainformat = 0;
     pam.height      = info_ptr->height;
diff --git a/doc/HISTORY b/doc/HISTORY
index e59b18f6..c1f2db89 100644
--- a/doc/HISTORY
+++ b/doc/HISTORY
@@ -4,6 +4,17 @@ Netpbm.
 CHANGE HISTORY 
 --------------
 
+10.12.10 BJH  Release 10.47.23
+
+              bmptopnm: Don't crash on invalid zero value of image height in
+              the BMP header of a compressed file.  Always broken.
+              
+              bmptopnm: don't crash on large invalid value of 'colorsused' in
+              the BMP header.
+
+              pngtopam: include tuple type in output.  Thanks
+              Thomas Henlich <thenlich@users.sourceforge.net>.
+
 10.11.01 BJH  Release 10.47.22
 
               pnmtops: Fix incorrect output with -flate.  Thanks Prophet of
diff --git a/version.mk b/version.mk
index 95d75e7d..8e77d543 100644
--- a/version.mk
+++ b/version.mk
@@ -1,3 +1,3 @@
 NETPBM_MAJOR_RELEASE = 10
 NETPBM_MINOR_RELEASE = 47
-NETPBM_POINT_RELEASE = 21
+NETPBM_POINT_RELEASE = 23