Release 10.35.46

git-svn-id: http://svn.code.sf.net/p/netpbm/code/stable@654 9d0c8265-081b-0410-96cb-a4ca84ce46f8

6 files changed, 18 insertions, 6 deletions

diff --git a/Makefile.version b/Makefile.version
index d71952d2..9a21415e 100644
--- a/Makefile.version
+++ b/Makefile.version
@@ -1,3 +1,3 @@
 NETPBM_MAJOR_RELEASE = 10
 NETPBM_MINOR_RELEASE = 35
-NETPBM_POINT_RELEASE = 45
+NETPBM_POINT_RELEASE = 46
diff --git a/converter/other/pamtotga.c b/converter/other/pamtotga.c
index 1e0808ed..6c8769ed 100644
--- a/converter/other/pamtotga.c
+++ b/converter/other/pamtotga.c
@@ -461,7 +461,8 @@ computeTgaHeader(struct pam *          const pamP,
 static void
 releaseTgaHeader(struct ImageHeader const tgaHeader) {
 
-    strfree(tgaHeader.Id);
+    if (tgaHeader.IdLength > 0)
+        strfree(tgaHeader.Id);
 }
 
 
diff --git a/converter/other/pamtouil.c b/converter/other/pamtouil.c
index b9ddc749..f17fd94b 100644
--- a/converter/other/pamtouil.c
+++ b/converter/other/pamtouil.c
@@ -380,7 +380,7 @@ freeCmap(cixel_map cmap[], unsigned int const ncolors) {
         if (cmapEntry.uilname)
             freeString(cmapEntry.uilname);
         if (cmapEntry.rgbname)
-            freeString(cmapEntry.uilname);
+            freeString(cmapEntry.rgbname);
     }
 }
 
diff --git a/converter/other/pnmtopclxl.c b/converter/other/pnmtopclxl.c
index fe4833d8..7c85d09c 100644
--- a/converter/other/pnmtopclxl.c
+++ b/converter/other/pnmtopclxl.c
@@ -176,6 +176,7 @@ parseCommandLine(int argc, char ** argv,
     if (argc-1 < 1) {
         MALLOCVAR(cmdlineP->sourceP);
         cmdlineP->sourceP->name = "-";
+        cmdlineP->sourceP->next = NULL;
     } else {
         int i;
         InputSource ** nextLinkP;
diff --git a/doc/HISTORY b/doc/HISTORY
index d0b8b160..a6ae2a0e 100644
--- a/doc/HISTORY
+++ b/doc/HISTORY
@@ -4,6 +4,16 @@ Netpbm.
 CHANGE HISTORY 
 --------------
 
+08.06.22 BJH  Release 10.35.46
+
+              pbmtext: fix buffer overrun with tab characters.
+
+              pamtotga: fix free of unallocated memory with no -name option.
+
+              pamtouil: fix double free of memory.
+
+              pnmtopclxl: fix crash with Standard Input input.
+
 08.06.08 BJH  Release 10.35.45
 
               anytopnm: fix parsing of type description.
diff --git a/generator/pbmtext.c b/generator/pbmtext.c
index a5390d4b..d0a6291b 100644
--- a/generator/pbmtext.c
+++ b/generator/pbmtext.c
@@ -575,7 +575,7 @@ getText(const char          cmdline_text[],
     struct text input_text;
 
     if (cmdline_text) {
-        allocTextArray(&input_text, 1, strlen(cmdline_text));
+        allocTextArray(&input_text, 1, strlen(cmdline_text)*8);
         strcpy(input_text.textArray[0], cmdline_text);
         fix_control_chars(input_text.textArray[0], fn);
         input_text.lineCount = 1;
@@ -595,9 +595,9 @@ getText(const char          cmdline_text[],
         
         lineCount = 0;  /* initial value */
         while (fgets(buf, sizeof(buf), stdin) != NULL) {
-            if (strlen(buf) + 1 >= sizeof(buf))
+            if (strlen(buf)*8 + 1 >= sizeof(buf))
                 pm_error("A line of input text is longer than %u characters."
-                         "Cannot process.", sizeof(buf)-1);
+                         "Cannot process.", (sizeof(buf)-1)/8);
             fix_control_chars(buf, fn);
             if (lineCount >= maxlines) {
                 maxlines *= 2;