Release 10.47.71

git-svn-id: http://svn.code.sf.net/p/netpbm/code/super_stable@3450 9d0c8265-081b-0410-96cb-a4ca84ce46f8

9 files changed, 94 insertions, 29 deletions

diff --git a/converter/other/bmptopnm.c b/converter/other/bmptopnm.c
index 3d108bf7..dfd175aa 100644
--- a/converter/other/bmptopnm.c
+++ b/converter/other/bmptopnm.c
@@ -631,11 +631,11 @@ BMPreadinfoheader(FILE *                 const ifP,
         readWindowsInfoHeader(ifP, cInfoHeaderSize, headerP);
         break;
     case 108:
-        pm_error("%s: this is a Version 4 Windows BMP; "
+        pm_error("This is a Version 4 Windows BMP; "
                  "this program knows only Version 1");
         break;
     case 124:
-        pm_error("%s: this is a Version 5 Windows BMP; "
+        pm_error("This is a Version 5 Windows BMP; "
                  "this program knows only Version 1");
         break;
     default:
@@ -834,6 +834,15 @@ convertRow32(unsigned char      const bmprow[],
 } 
 
 
+static void
+validateIndex(unsigned int const index,
+	      unsigned int const cmapsize ) {
+
+    if (index >= cmapsize)
+        pm_error("Error: invalid index to color palette.");
+}
+
+
 
 static void
 convertRow(unsigned char      const bmprow[], 
@@ -841,7 +850,8 @@ convertRow(unsigned char      const bmprow[],
            int                const cols, 
            unsigned int       const cBitCount, 
            struct pixelformat const pixelformat,
-           xel                const colormap[]
+           xel                const colormap[],
+           unsigned int       const cmapsize
            ) {
 /*----------------------------------------------------------------------------
    Convert a row in raw BMP raster format bmprow[] to a row of xels xelrow[].
@@ -861,9 +871,12 @@ convertRow(unsigned char      const bmprow[],
         convertRow32(bmprow, xelrow, cols, pixelformat);
     else if (cBitCount == 8) {            
         /* It's a whole byte colormap index */
-        unsigned int col;
-        for (col = 0; col < cols; ++col)
-            xelrow[col] = colormap[bmprow[col]];
+        unsigned int col; 
+        for (col = 0; col < cols; ++col) {
+            unsigned int const index = bmprow[col];
+            validateIndex(index, cmapsize);
+            xelrow[col] = colormap[index];
+        }
     } else if (cBitCount < 8) {
         /* It's a bit field color index */
         unsigned char const mask = ( 1 << cBitCount ) - 1;
@@ -875,6 +888,7 @@ convertRow(unsigned char      const bmprow[],
             unsigned int const shift = 8 - ((col*cBitCount) % 8) - cBitCount;
             unsigned int const index = 
                 (bmprow[cursor] & (mask << shift)) >> shift;
+            validateIndex(index, cmapsize);
             xelrow[col] = colormap[index];
         }
     } else
@@ -1351,6 +1365,7 @@ readBmp(FILE *               const ifP,
         unsigned int *       const cBitCountP, 
         struct pixelformat * const pixelformatP,
         xel **               const colormapP,
+        unsigned int *       const cmapsizeP,
         bool                 const verbose) {
 
     xel * colormap;  /* malloc'ed */
@@ -1408,6 +1423,7 @@ readBmp(FILE *               const ifP,
     *cBitCountP   = BMPheader.cBitCount;
     *pixelformatP = BMPheader.pixelformat;
     *colormapP    = colormap;
+    *cmapsizeP    = BMPheader.cmapsize;
 }
 
 
@@ -1419,7 +1435,8 @@ writeRasterGen(unsigned char **   const BMPraster,
                int                const format,
                unsigned int       const cBitCount, 
                struct pixelformat const pixelformat,
-               xel                const colormap[]) {
+               xel                const colormap[],
+               unsigned int       const cmapsize) {
 /*----------------------------------------------------------------------------
   Write the PNM raster to Standard Output, corresponding to the raw BMP
   raster BMPraster.  Write the raster assuming the PNM image has 
@@ -1440,7 +1457,7 @@ writeRasterGen(unsigned char **   const BMPraster,
 
     for (row = 0; row < rows; ++row) {
         convertRow(BMPraster[row], xelrow, cols, cBitCount, pixelformat,
-                   colormap);
+                   colormap, cmapsize);
         pnm_writepnmrow(stdout, xelrow, cols, bmpMaxval, format, FALSE);
     }
     pnm_freerow(xelrow);
@@ -1529,6 +1546,13 @@ main(int argc, char ** argv) {
         /* Malloc'ed colormap (palette) from the BMP.  Contents of map
            undefined if not a colormapped BMP.
          */
+    unsigned int cmapsize;
+        /* Number of colormap entries.  Described in the BMP header.
+           Note that a file may be 8 bits per pixel but have less than
+           256 colors.  In the 1 bit per pixel case, there should be
+           2 entries according to the official specification, but we
+           allow files with just 1.
+	 */
 
     pnm_init(&argc, argv);
 
@@ -1541,7 +1565,7 @@ main(int argc, char ** argv) {
         ifname = cmdline.input_filespec;
 
     readBmp(ifP, &BMPraster, &cols, &rows, &grayPresent, &colorPresent, 
-            &cBitCount, &pixelformat, &colormap,
+            &cBitCount, &pixelformat, &colormap, &cmapsize,
             cmdline.verbose);
     pm_close(ifP);
 
@@ -1562,7 +1586,7 @@ main(int argc, char ** argv) {
     } else {
         pnm_writepnminit(stdout, cols, rows, bmpMaxval, outputType, FALSE);
         writeRasterGen(BMPraster, cols, rows, outputType, cBitCount,
-                       pixelformat, colormap); 
+                       pixelformat, colormap, cmapsize); 
     }
     free(colormap);
     free(BMPraster);
diff --git a/converter/other/jbig/jbig.c b/converter/other/jbig/jbig.c
index ebd7c08f..f33f80be 100644
--- a/converter/other/jbig/jbig.c
+++ b/converter/other/jbig/jbig.c
@@ -818,7 +818,7 @@ void jbg_enc_options(struct jbg_enc_state *s, int order, int options,
   if (order >= 0 && order <= 0x0f) s->order = order;
   if (options >= 0) s->options = options;
   if (l0 >= 0) s->l0 = l0;
-  if (mx >= 0 && my < 128) s->mx = mx;
+  if (mx >= 0 && mx < 128) s->mx = mx;
   if (my >= 0 && my < 256) s->my = my;
 
   return;
diff --git a/converter/other/jpeg2000/libjasper/jpc/jpc_util.c b/converter/other/jpeg2000/libjasper/jpc/jpc_util.c
index 82f4b285..ecc4b914 100644
--- a/converter/other/jpeg2000/libjasper/jpc/jpc_util.c
+++ b/converter/other/jpeg2000/libjasper/jpc/jpc_util.c
@@ -151,7 +151,7 @@ int jpc_atoaf(const char *s, int *numvalues, double **values)
 	if ((cp = strtok(buf, delim))) {
 		++n;
 		while ((cp = strtok(0, delim))) {
-			if (cp != '\0') {
+			if (cp[0] != '\0') {
 				++n;
 			}
 		}
@@ -169,7 +169,7 @@ int jpc_atoaf(const char *s, int *numvalues, double **values)
 			vs[n] = atof(cp);
 			++n;
 			while ((cp = strtok(0, delim))) {
-				if (cp != '\0') {
+				if (cp[0] != '\0') {
 					vs[n] = atof(cp);
 					++n;
 				}
diff --git a/converter/other/jpeg2000/pamtojpeg2k.c b/converter/other/jpeg2000/pamtojpeg2k.c
index 70774725..69ceb22b 100644
--- a/converter/other/jpeg2000/pamtojpeg2k.c
+++ b/converter/other/jpeg2000/pamtojpeg2k.c
@@ -348,7 +348,7 @@ convertToJasperImage(struct pam *   const inpamP,
                                   JAS_IMAGE_CT_COLOR(JAS_IMAGE_CT_RGB_B));
         }
     } else {
-        if (strncmp(inpamP->tuple_type, "GRAYSCALE", 9 == 0) ||
+        if (strncmp(inpamP->tuple_type, "GRAYSCALE", 9) == 0 ||
             strncmp(inpamP->tuple_type, "BLACKANDWHITE", 13) == 0) {
             jas_image_setclrspc(jasperP, JAS_CLRSPC_GENGRAY);
             jas_image_setcmpttype(jasperP, 0,
diff --git a/converter/ppm/picttoppm.c b/converter/ppm/picttoppm.c
index 9a7d8e7c..77efc6f2 100644
--- a/converter/ppm/picttoppm.c
+++ b/converter/ppm/picttoppm.c
@@ -790,19 +790,25 @@ dumpRect(const char * const label,
 static void
 read_rect(struct Rect * const r) {
 
-    r->top    = read_word();
-    r->left   = read_word();
-    r->bottom = read_word();
-    r->right  = read_word();
-
-    if (r->top > r->bottom || r->right < r->left)
-        dumpRect("Invalid rectangle", *r);
-
-    if (r->top > r->bottom)
-        pm_error("Invalid PICT: a rectangle has a top below its bottom");
-    if (r->right < r->left)
-        pm_error("Invalid PICT: a rectangle has a right edge "
-                 "left of its left edge");
+    /* We don't have a formal specification for the Pict format, but we have
+       seen samples that have the rectangle corners either in top left, bottom
+       right order or bottom right, top left.  top left, bottom right is the
+       only one Picttoppm handled until October 2018, when we saw several
+       images in the bottom right, top left order and other Pict processing
+       programs considered that fine.
+
+       So now we accept all 4 possibilities.
+    */
+
+    word const y1 = read_word();
+    word const x1 = read_word();
+    word const y2 = read_word();
+    word const x2 = read_word();
+
+    r->top    = MIN(y1, y2);
+    r->left   = MIN(x1, x2);
+    r->bottom = MAX(y1, y2);
+    r->right  = MAX(x1, x2);
 }
 
 
diff --git a/doc/HISTORY b/doc/HISTORY
index 45bb971a..de601759 100644
--- a/doc/HISTORY
+++ b/doc/HISTORY
@@ -4,6 +4,32 @@ Netpbm.
 CHANGE HISTORY 
 --------------
 
+18.12.05 BJH  Release 10.47.71
+
+              picttoppm: accept rectangle specifications in input that have
+              the corners in any order, not just upper left, then lower right.
+
+              bmptopnm: Fix array bounds violation when index value in raster
+              is too big.  Broken after Netpbm 10.10 (October 2002) but before
+              10.19 (November 2003).
+
+              libnetpbm: Fix invalid memory reference in color name processing
+              when trivial memory allocation fails.
+
+              pamtojpeg2k: fix incorrect interpretation of -ilyrrates option
+              when it contains multiple delimiter characters in a row.  Always
+              broken (pamtojpeg2k was new in Netpbm 10.12 (November 2002)).
+
+              pamtojpeg2k: Fix incorrect metadata in output with GRAYSCALE PAM
+              input.  Always broken (pamtojpeg2k was new in Netpbm 10.12
+              (November 2002)).
+
+              pnmtojbig: fix incorrect handling of -x option.  Always broken
+              (pnmtojbig was new in Netpbm 9.2 (May 2000)).
+
+              Merge build: fix so legacy program names 'pnmtopnm', 'ppmnorm',
+              and 'ppmtotga' work again.
+
 18.09.29 BJH  Release 10.47.70
 
               pstopnm: Fix divide-by-zero crash when Postscript input says
diff --git a/lib/colorname.c b/lib/colorname.c
index cfaf026a..415cd0c3 100644
--- a/lib/colorname.c
+++ b/lib/colorname.c
@@ -195,7 +195,12 @@ pm_parse_dictionary_name(char    const colorname[],
     pixval r,g,b;
 
     f = pm_openColornameFile(NULL, TRUE);  /* exits if error */
-    canoncolor = strdup(colorname);
+    canoncolor = pm_strdup(colorname);
+
+    if (!canoncolor)
+        pm_error("Failed to allocate memory for %u-byte color name",
+                 (unsigned)strlen(colorname));
+
     pm_canonstr(canoncolor);
     gotit = FALSE;
     colorfileExhausted = FALSE;
diff --git a/netpbm.c b/netpbm.c
index c47cb37e..5b722158 100644
--- a/netpbm.c
+++ b/netpbm.c
@@ -55,6 +55,9 @@ main(int argc, char *argv[]) {
     TRY("gemtopbm", main_gemtopnm);
     TRY("pnminterp", main_pamstretch);
     TRY("pgmoil", main_pamoil);
+    TRY("pnmtopnm", main_pamtopnm);
+    TRY("ppmnorm", main_pnmnorm);
+    TRY("ppmtotga", main_pamtotga);
 
     /* We don't do the ppmtojpeg alias because if user doesn't have a JPEG
        library, there is no main_pnmtojpeg library.  The right way to do
@@ -63,6 +66,7 @@ main(int argc, char *argv[]) {
        or not.  But that's too much work.
 
     TRY("ppmtojpeg", main_pnmtojpeg); 
+    TRY("pamrgbatopng", main_pamtopng);
     */
     TRY("bmptoppm", main_bmptopnm);
     TRY("pgmnorm", main_pnmnorm);
diff --git a/version.mk b/version.mk
index 797019a9..6688e866 100644
--- a/version.mk
+++ b/version.mk
@@ -1,3 +1,3 @@
 NETPBM_MAJOR_RELEASE = 10
 NETPBM_MINOR_RELEASE = 47
-NETPBM_POINT_RELEASE = 70
+NETPBM_POINT_RELEASE = 71