Release 10.86.39

git-svn-id: http://svn.code.sf.net/p/netpbm/code/super_stable@4696 9d0c8265-081b-0410-96cb-a4ca84ce46f8

8 files changed, 77 insertions, 21 deletions

diff --git a/analyzer/pgmtexture.c b/analyzer/pgmtexture.c
index 4e0dd4d5..88a17433 100644
--- a/analyzer/pgmtexture.c
+++ b/analyzer/pgmtexture.c
@@ -950,6 +950,8 @@ main (int argc, const char ** argv) {
 
     pm_proginit(&argc, argv);
 
+    d = 1;
+
     argn = 1;
 
     /* Check for flags. */
@@ -977,11 +979,13 @@ main (int argc, const char ** argv) {
     if ( argn != argc )
         pm_usage( usage );
 
-    d = 1;
-
     grays = pgm_readpgm(ifP, &cols, &rows, &maxval);
     pm_close (ifP);
 
+    if (maxval > PGM_MAXMAXVAL)
+        pm_error("Maxval %u is too high.  We can handle only up to %u",
+                 maxval, PGM_MAXMAXVAL);
+
     /* Determine the number of different gray scales (not maxval) */
     for (i = 0; i <= PGM_MAXMAXVAL; ++i)
         tone[i] = -1;
diff --git a/converter/other/pamtosvg/fit.c b/converter/other/pamtosvg/fit.c
index 5ba7a2f6..2e4e8588 100644
--- a/converter/other/pamtosvg/fit.c
+++ b/converter/other/pamtosvg/fit.c
@@ -1379,14 +1379,26 @@ findHalfTangentBeg(curve *      const curveP,
         unsigned int const thisIndex = p + 1;
         float_coord  const thisPoint = CURVE_POINT(curveP, thisIndex);
 
-        /* Perhaps we should weight the tangent from `thisPoint' by some
-           factor dependent on the distance from the tangent point.
-        */
-        sum = Vadd(sum, Pdirection(thisPoint, tangentPoint));
-        ++n;
+        if (epsilon_equal(thisPoint.x, tangentPoint.x) &&
+            epsilon_equal(thisPoint.y, tangentPoint.y) &&
+            epsilon_equal(thisPoint.z, tangentPoint.z)) {
+            /* It's the same point; can't compute a slope */
+        } else {
+            /* Perhaps we should weight the tangent from `thisPoint' by some
+               factor dependent on the distance from the tangent point.
+            */
+            sum = Vadd(sum, Pdirection(thisPoint, tangentPoint));
+            ++n;
+        }
     }
 
-    mean = Vmult_scalar(sum, 1.0 / n);
+    if (n >= 1)
+        mean = Vmult_scalar(sum, 1.0 / n);
+    else {
+        mean.dx = 1.0;
+        mean.dy = 0.0;
+        mean.dz = 0.0;
+    }
 
     return mean;
 }
@@ -1418,11 +1430,23 @@ findHalfTangentEnd(curve *      const curveP,
         unsigned int const thisIndex = CURVE_LENGTH(curveP) - 1 - p;
         float_coord  const thisPoint = CURVE_POINT(curveP, thisIndex);
 
-        sum = Vadd(sum, Pdirection(tangentPoint, thisPoint));
-        ++n;
+        if (epsilon_equal(thisPoint.x, tangentPoint.x) &&
+            epsilon_equal(thisPoint.y, tangentPoint.y) &&
+            epsilon_equal(thisPoint.z, tangentPoint.z)) {
+            /* It's the same point; can't compute a slope */
+        } else {
+            sum = Vadd(sum, Pdirection(tangentPoint, thisPoint));
+            ++n;
+        }
     }
 
-    mean = Vmult_scalar(sum, 1.0 / n);
+    if (n >= 1)
+        mean = Vmult_scalar(sum, 1.0 / n);
+    else {
+        mean.dx = 1.0;
+        mean.dy = 0.0;
+        mean.dz = 0.0;
+    }
 
     return mean;
 }
diff --git a/converter/pbm/pbmtoxbm.c b/converter/pbm/pbmtoxbm.c
index ecb72b30..1a003189 100644
--- a/converter/pbm/pbmtoxbm.c
+++ b/converter/pbm/pbmtoxbm.c
@@ -353,6 +353,10 @@ convertRaster(FILE *          const ifP,
     unsigned char * bitrow;
     unsigned int row;
 
+    if (cols > UINT_MAX - bitsPerUnit)
+        pm_error("Image is too wide (%u columns) for computations",
+                 cols);
+
     putinit(xbmVersion);
 
     bitrow = pbm_allocrow_packed(cols + padright);
diff --git a/doc/HISTORY b/doc/HISTORY
index 55a5e9db..5e548f31 100644
--- a/doc/HISTORY
+++ b/doc/HISTORY
@@ -4,6 +4,23 @@ Netpbm.
 CHANGE HISTORY 
 --------------
 
+23.09.27 BJH  Release 10.86.39
+
+              pamtosvg: fix hang.
+
+              pamstack: Fail gracefully when total number of planes is too
+              large for unsigned integer.  Always broken (Pamstack was new in
+              Netpbm 10.0 (June 2002).
+
+              pgmtexture: Fix buffer overflow with maxval > 255.  Always
+              broken.  Maxvals > 255 were possible starting in Netpbm 9.0
+              (April 2000).
+
+              ppmrough: fix buffer overrun.  Always broken (Ppmrough was new
+              in Netpbm 10.9 (September 2002).
+
+              pbmtoxbm: Fix spurious output with really wide rows.
+
 23.03.25 BJH  Release 10.86.38
 
               jpegtopnm: Many fixes to -dumpexif.  Always broken.
diff --git a/generator/ppmrough.c b/generator/ppmrough.c
index e749c9c2..0f351aa9 100644
--- a/generator/ppmrough.c
+++ b/generator/ppmrough.c
@@ -92,6 +92,7 @@ procLeft(int          const r1,
          int          const r2,
          int          const c1,
          int          const c2, 
+         unsigned int const width,
          unsigned int const var) {
 
     int cm, rm, c;
@@ -101,11 +102,11 @@ procLeft(int          const r1,
     cm = (c1 + c2) >> 1;
     cm += (int)floor(((float)rand() / RAND_MAX - 0.5) * var + 0.5);
 
-    for (c = 0; c < cm; c++)
+    for (c = 0; c < MIN(width, MAX(0, cm)); c++)
         PPM_ASSIGN(PIX[rm][c], BG_RED, BG_GREEN, BG_BLUE);
 
-    procLeft(r1, rm, c1, cm, var);
-    procLeft(rm, r2, cm, c2, var);
+    procLeft(r1, rm, c1, cm, width, var);
+    procLeft(rm, r2, cm, c2, width, var);
 }
 
 
@@ -139,6 +140,7 @@ procTop(int          const c1,
         int          const c2,
         int          const r1,
         int          const r2,
+        unsigned int const height,
         unsigned int const var) {
 
     int rm, cm, r;
@@ -148,11 +150,11 @@ procTop(int          const c1,
     rm = (r1 + r2) >> 1;
     rm += (int)floor(((float)rand() / RAND_MAX - 0.5) * var + 0.5);
 
-    for (r = 0; r < rm; r++)
+    for (r = 0; r < MIN(height, MAX(0, rm)); r++)
         PPM_ASSIGN(PIX[r][cm], BG_RED, BG_GREEN, BG_BLUE);
 
-    procTop(c1, cm, r1, rm, var);
-    procTop(cm, c2, rm, r2, var);
+    procTop(c1, cm, r1, rm, height, var);
+    procTop(cm, c2, rm, r2, height, var);
 }
 
 
@@ -261,7 +263,7 @@ main(int argc, const char * argv[]) {
         for (col = 0; col < left_c2; ++col)
             PPM_ASSIGN(PIX[left_r2][col], BG_RED, BG_GREEN, BG_BLUE);
 
-        procLeft(left_r1, left_r2, left_c1, left_c2, cmdline.var);
+        procLeft(left_r1, left_r2, left_c1, left_c2, cmdline.width, cmdline.var);
     }
 
     /* Make a ragged right border */
@@ -296,7 +298,7 @@ main(int argc, const char * argv[]) {
         for (row = 0; row < top_r2; ++row)
             PPM_ASSIGN(PIX[row][top_c2], BG_RED, BG_GREEN, BG_BLUE);
 
-        procTop(top_c1, top_c2, top_r1, top_r2, cmdline.var);
+        procTop(top_c1, top_c2, top_r1, top_r2, cmdline.height, cmdline.var);
     }
 
     /* Make a ragged bottom border */
diff --git a/lib/libpbm2.c b/lib/libpbm2.c
index a611bec5..cfeee4c4 100644
--- a/lib/libpbm2.c
+++ b/lib/libpbm2.c
@@ -53,7 +53,7 @@ pbm_readpbminitrest( FILE * const file,
     if (*colsP < 0)
         pm_error("Number of columns in header is too large.");
     if (*rowsP < 0)
-        pm_error("Number of columns in header is too large.");
+        pm_error("Number of rows in header is too large.");
 }
 
 
diff --git a/other/pamstack.c b/other/pamstack.c
index 308852c8..9e56845f 100644
--- a/other/pamstack.c
+++ b/other/pamstack.c
@@ -186,6 +186,11 @@ processOneImageInAllStreams(unsigned int const nInput,
                 pm_error("Image no. %u does not have the same maxval as "
                          "Image 0.", inputSeq);
         }
+        if (inpam[inputSeq].depth > UINT_MAX - outputDepth)
+            pm_error("Total number of planes is too large to compute "
+                     "(at least %u plus %u)",
+                     outputDepth, inpam[inputSeq].depth);
+
         outputDepth += inpam[inputSeq].depth;
     }
 
diff --git a/version.mk b/version.mk
index 7aac55ea..abcc52cd 100644
--- a/version.mk
+++ b/version.mk
@@ -1,3 +1,3 @@
 NETPBM_MAJOR_RELEASE = 10
 NETPBM_MINOR_RELEASE = 86
-NETPBM_POINT_RELEASE = 38
+NETPBM_POINT_RELEASE = 39