Release 10.73.31

git-svn-id: http://svn.code.sf.net/p/netpbm/code/super_stable@3776 9d0c8265-081b-0410-96cb-a4ca84ce46f8

6 files changed, 67 insertions, 19 deletions

diff --git a/converter/other/pbmtopgm.c b/converter/other/pbmtopgm.c
index 69b20fb2..c35e1cbe 100644
--- a/converter/other/pbmtopgm.c
+++ b/converter/other/pbmtopgm.c
@@ -3,6 +3,7 @@
  */
 
 #include <stdio.h>
+#include <limits.h>
 
 #include "pm_c_util.h"
 #include "pgm.h"
@@ -29,8 +30,13 @@ main(int argc, char *argv[]) {
     height = atoi(argv[2]);
     if (width < 1 || height < 1)
         pm_error("width and height must be > 0");
+    if (width > INT_MAX / height)
+        /* prevent overflow of "value" below */
+        pm_error("sample area (%u columns %u rows) too large",
+                 width, height);
+
     left=width/2; right=width-left;
-    up=width/2; down=height-up;
+    up=height/2; down=height-up;
 
     if (argc == 4)
         ifd = pm_openr(argv[3]);
diff --git a/doc/HISTORY b/doc/HISTORY
index d3b6a62a..29ef58d8 100644
--- a/doc/HISTORY
+++ b/doc/HISTORY
@@ -4,6 +4,29 @@ Netpbm.
 CHANGE HISTORY 
 --------------
 
+20.03.26 BJH  Release 10.73.31
+
+              pbmtopgm: Fix incorrect output when convolution area is not
+              square.  Always broken.  pbmtopgm was in primordial Netpbm,
+              ca 1991.
+
+              pbmtopgm: Fix crash when convolution matrix too large for word
+              size.  Always broken.  pbmtopgm was in primordial Netpbm, ca
+              1991.
+
+              pnmshear: Fix arithmetic overflow with shear angle near +/- 90
+              degrees.
+
+              pamdice: Fix junk output when -width or -height not specified.
+
+              pamdice: Fix crash when -width or -height is zero.
+
+              pamdice: Fix incorrect file names when -outstem contains "%s",
+              etc.
+
+              libnetpbm: pm_read_unknown_size, rawtopgm, zeisstopnm: crash
+              when out of memory
+
 19.12.25 BJH  Release 10.73.30
 
               pamrubber: Fix bug: -frame doesn't work.  Always broken.
diff --git a/editor/pamdice.c b/editor/pamdice.c
index 2c53a110..32881129 100644
--- a/editor/pamdice.c
+++ b/editor/pamdice.c
@@ -84,7 +84,9 @@ parseCommandLine(int argc, char ** argv,
         /* Uses and sets argc, argv, and some of *cmdline_p and others. */
 
     if (cmdlineP->sliceVertically) {
-        if (hoverlapSpec) {
+        if (cmdlineP->width < 1)
+            pm_error("-width value must not be zero");
+        else if (hoverlapSpec) {
             if (cmdlineP->hoverlap > cmdlineP->width - 1)
                 pm_error("-hoverlap value must be less than -width (%u).  "
                          "You specified %u.",
@@ -93,7 +95,9 @@ parseCommandLine(int argc, char ** argv,
             cmdlineP->hoverlap = 0;
     }
     if (cmdlineP->sliceHorizontally) {
-        if (voverlapSpec) {
+        if (cmdlineP->height < 1)
+            pm_error("-height value must not be zero");
+        else if (voverlapSpec) {
             if (cmdlineP->voverlap > cmdlineP->height - 1)
                 pm_error("-voverlap value must be less than -height (%u).  "
                          "You specified %u.",
@@ -150,14 +154,15 @@ computeSliceGeometry(struct cmdlineInfo const cmdline,
             *nHorizSliceP = 1 + divup(inpam.height - cmdline.height, 
                                       cmdline.height - cmdline.voverlap);
         *sliceHeightP = cmdline.height;
+
+        *bottomSliceHeightP = 
+            inpam.height - (*nHorizSliceP-1) * (cmdline.height - cmdline.voverlap);
     } else {
         *nHorizSliceP = 1;
         *sliceHeightP = inpam.height;
+        *bottomSliceHeightP = inpam.height;
     }
 
-    *bottomSliceHeightP = 
-        inpam.height - (*nHorizSliceP-1) * (cmdline.height - cmdline.voverlap);
-
     if (cmdline.sliceVertically) {
         if (cmdline.width >= inpam.width)
             *nVertSliceP = 1;
@@ -165,14 +170,14 @@ computeSliceGeometry(struct cmdlineInfo const cmdline,
             *nVertSliceP = 1 + divup(inpam.width - cmdline.width, 
                                      cmdline.width - cmdline.hoverlap);
         *sliceWidthP = cmdline.width;
+        *rightSliceWidthP = 
+            inpam.width - (*nVertSliceP-1) * (cmdline.width - cmdline.hoverlap);
     } else {
         *nVertSliceP = 1;
         *sliceWidthP = inpam.width;
+        *rightSliceWidthP = inpam.width;
     }
 
-    *rightSliceWidthP = 
-        inpam.width - (*nVertSliceP-1) * (cmdline.width - cmdline.hoverlap);
-
     if (verbose) {
         pm_message("Creating %u images, %u across by %u down; "
                    "each %u w x %u h",
@@ -208,7 +213,6 @@ ndigits(unsigned int const arg) {
 
 static void
 computeOutputFilenameFormat(int           const format, 
-                            char          const outstem[],
                             unsigned int  const nHorizSlice,
                             unsigned int  const nVertSlice,
                             const char ** const filenameFormatP) {
@@ -223,9 +227,8 @@ computeOutputFilenameFormat(int           const format,
     default:       filenameSuffix = "";    break;
     }
     
-    pm_asprintf(filenameFormatP, "%s_%%0%uu_%%0%uu.%s",
-                outstem, ndigits(nHorizSlice), ndigits(nVertSlice),
-                filenameSuffix);
+    pm_asprintf(filenameFormatP, "%%s_%%0%uu_%%0%uu.%s",
+                ndigits(nHorizSlice), ndigits(nVertSlice), filenameSuffix);
 
     if (*filenameFormatP == NULL)
         pm_error("Unable to allocate memory for filename format string");
@@ -252,13 +255,13 @@ openOutStreams(struct pam   const inpam,
     const char * filenameFormat;
     unsigned int vertSlice;
 
-    computeOutputFilenameFormat(inpam.format, outstem, nHorizSlice, nVertSlice,
+    computeOutputFilenameFormat(inpam.format, nHorizSlice, nVertSlice,
                                 &filenameFormat);
 
     for (vertSlice = 0; vertSlice < nVertSlice; ++vertSlice) {
         const char * filename;
 
-        pm_asprintf(&filename, filenameFormat, horizSlice, vertSlice);
+        pm_asprintf(&filename, filenameFormat, outstem, horizSlice, vertSlice);
 
         if (filename == NULL)
             pm_error("Unable to allocate memory for output filename");
@@ -468,7 +471,10 @@ main(int argc, char ** argv) {
 
     for (horizSlice = 0; horizSlice < nHorizSlice; ++horizSlice) {
         unsigned int const thisSliceFirstRow = 
-            horizSlice * (sliceHeight - cmdline.voverlap);
+            horizSlice > 0 ? horizSlice * (sliceHeight - cmdline.voverlap) : 0;
+            /* Note that 'cmdline.voverlap' is not defined when there is only
+               one horizontal slice
+            */
         unsigned int const thisSliceHeight = 
             horizSlice < nHorizSlice-1 ? sliceHeight : bottomSliceHeight;
 
diff --git a/editor/pnmshear.c b/editor/pnmshear.c
index 99fa3026..02323824 100644
--- a/editor/pnmshear.c
+++ b/editor/pnmshear.c
@@ -217,6 +217,7 @@ main(int argc, const char * argv[]) {
     int row;
     xelval maxval, newmaxval;
     double shearfac;
+    double newcolsD;
 
     struct CmdlineInfo cmdline;
 
@@ -242,7 +243,12 @@ main(int argc, const char * argv[]) {
 
     shearfac = fabs(tan(cmdline.angle));
 
-    newcols = rows * shearfac + cols + 0.999999;
+    newcolsD = (double) rows * shearfac + cols + 0.999999;
+    if (newcolsD > INT_MAX-2)
+        pm_error("angle is too close to +/-90 degrees; "
+                 "output image too wide for computation");
+    else
+        newcols = (int) newcolsD;
 
     pnm_writepnminit(stdout, newcols, rows, newmaxval, newformat, 0);
     newxelrow = pnm_allocrow(newcols);
diff --git a/lib/pmfileio.c b/lib/pmfileio.c
index 8176ae6a..a0810e52 100644
--- a/lib/pmfileio.c
+++ b/lib/pmfileio.c
@@ -807,6 +807,10 @@ pm_read_unknown_size(FILE * const file,
     nalloc = PM_BUF_SIZE;
     MALLOCARRAY(buf, nalloc);
 
+    if (!buf)
+        pm_error("Failed to allocate %lu bytes for read buffer",
+                 (unsigned long) nalloc);
+
     eof = FALSE;  /* initial value */
 
     while(!eof) {
@@ -817,7 +821,10 @@ pm_read_unknown_size(FILE * const file,
                 nalloc += PM_MAX_BUF_INC;
             else
                 nalloc += nalloc;
-            REALLOCARRAY_NOFAIL(buf, nalloc);
+            REALLOCARRAY(buf, nalloc);
+            if (!buf)
+                pm_error("Failed to allocate %lu bytes for read buffer",
+                         (unsigned long) nalloc);
         }
 
         val = getc(file);
diff --git a/version.mk b/version.mk
index d47296cb..ea2ed166 100644
--- a/version.mk
+++ b/version.mk
@@ -1,3 +1,3 @@
 NETPBM_MAJOR_RELEASE = 10
 NETPBM_MINOR_RELEASE = 73
-NETPBM_POINT_RELEASE = 30
+NETPBM_POINT_RELEASE = 31