Release 10.35.34

git-svn-id: http://svn.code.sf.net/p/netpbm/code/stable@472 9d0c8265-081b-0410-96cb-a4ca84ce46f8

7 files changed, 33 insertions, 8 deletions

diff --git a/Makefile.version b/Makefile.version
index f00a8739..661f42f4 100644
--- a/Makefile.version
+++ b/Makefile.version
@@ -1,3 +1,3 @@
 NETPBM_MAJOR_RELEASE = 10
 NETPBM_MINOR_RELEASE = 35
-NETPBM_POINT_RELEASE = 33
+NETPBM_POINT_RELEASE = 34
diff --git a/analyzer/pamsharpmap.c b/analyzer/pamsharpmap.c
index 73923ab9..8a08f981 100644
--- a/analyzer/pamsharpmap.c
+++ b/analyzer/pamsharpmap.c
@@ -137,7 +137,7 @@ main(int argc, char **argv) {
 
     ifP = pm_openr(cmdline.inputFilespec);
 
-	tuplenarray = pnm_readpamn(ifP, &inpam, sizeof(inpam));
+	tuplenarray = pnm_readpamn(ifP, &inpam, PAM_STRUCT_SIZE(tuple_type));
 
     mappam = inpam;
     mappam.file = stdout;
diff --git a/analyzer/pamsharpness.c b/analyzer/pamsharpness.c
index 7e52a9ba..2cb5edb9 100644
--- a/analyzer/pamsharpness.c
+++ b/analyzer/pamsharpness.c
@@ -136,7 +136,7 @@ main(int argc, char **argv) {
 
     ifP = pm_openr(cmdline.inputFilespec);
 
-	tuplenarray = pnm_readpamn(ifP, &inpam, sizeof(inpam));
+	tuplenarray = pnm_readpamn(ifP, &inpam, PAM_STRUCT_SIZE(tuple_type));
 
     if (inpam.height < 3 || inpam.width < 3)
         pm_error("sharpness is undefined for an image less than 3 pixels "
diff --git a/converter/other/pamtopfm.c b/converter/other/pamtopfm.c
index 44a8ab08..ee44eeb5 100644
--- a/converter/other/pamtopfm.c
+++ b/converter/other/pamtopfm.c
@@ -279,7 +279,7 @@ main(int argc, char **argv ) {
 
     ifP = pm_openr(cmdline.inputFilespec);
 
-    tuplenArray = pnm_readpamn(ifP, &pam, sizeof(pam));
+    tuplenArray = pnm_readpamn(ifP, &pam, PAM_STRUCT_SIZE(tuple_type));
 
     writePfmHeader(stdout, 
                    makePfmHeader(&pam, cmdline.scale, cmdline.endian));
diff --git a/converter/other/xwdtopnm.c b/converter/other/xwdtopnm.c
index 28c38cfc..4ff7d2ec 100644
--- a/converter/other/xwdtopnm.c
+++ b/converter/other/xwdtopnm.c
@@ -222,7 +222,15 @@ processX10Header(X10WDFileHeader *  const h10P,
         /* Must be grayscale. */
         *formatP = PGM_TYPE;
         *visualclassP = StaticGray;
-        *maxvalP = ( 1 << h10P->display_planes ) - 1;
+        if (h10P->display_planes > sizeof(*maxvalP) * 8 - 1)
+            pm_error("XWD header says display_planes = %u, which is "
+                     "too large for this program to compute",
+                     h10P->display_planes);
+        *maxvalP = ((xelval)1 << h10P->display_planes) - 1;
+        if (*maxvalP > PNM_OVERALLMAXVAL)
+            pm_error("XWD header says display_planes = %u, which is too "
+                     "large for maximum maxval of %u",
+                     h10P->display_planes, PNM_OVERALLMAXVAL);
         *colorsP = pnm_allocrow( *maxvalP + 1 );
         for ( i = 0; i <= *maxvalP; ++i )
             PNM_ASSIGN1( (*colorsP)[i], i );
@@ -520,7 +528,15 @@ processX11Header(X11WDFileHeader *  const h11P,
     } else if ( *visualclassP == StaticGray ) {
         unsigned int i;
         *formatP = PGM_TYPE;
-        *maxvalP = ( 1 << h11FixedP->bits_per_pixel ) - 1;
+        if (h11FixedP->bits_per_pixel > sizeof(*maxvalP) * 8 - 1)
+            pm_error("XWD header says bits_per_pixel = %u, which is "
+                     "too large for this program to compute",
+                     h11FixedP->bits_per_pixel);
+        *maxvalP = ((xelval)1 << h11FixedP->bits_per_pixel) - 1;
+        if (*maxvalP > PNM_OVERALLMAXVAL)
+            pm_error("XWD header says bits_per_pixel = %u, which is too "
+                     "large for maximum maxval of %u",
+                     h11FixedP->bits_per_pixel, PNM_OVERALLMAXVAL);
         *colorsP = pnm_allocrow( *maxvalP + 1 );
         for ( i = 0; i <= *maxvalP; ++i )
             PNM_ASSIGN1( (*colorsP)[i], i );
diff --git a/doc/HISTORY b/doc/HISTORY
index d9c04bd9..4256cbfa 100644
--- a/doc/HISTORY
+++ b/doc/HISTORY
@@ -4,6 +4,14 @@ Netpbm.
 CHANGE HISTORY 
 --------------
 
+07.11.26 BJH  Release 10.35.34
+
+              xwdtopnm: deal with too-large bits per pixel value in XWD 
+              header.
+
+              pamditherbw, pamsharpness, pamsharpmask, pamtopfm:
+              fix crash due to write to arbitrary memory.
+
 07.11.13 BJH  Release 10.35.33
 
               pnmcrop: fix -verbose message about background color with
diff --git a/editor/pamditherbw.c b/editor/pamditherbw.c
index 61c23103..e4c0d4c6 100644
--- a/editor/pamditherbw.c
+++ b/editor/pamditherbw.c
@@ -145,6 +145,7 @@ parseCommandLine(int argc, char ** argv,
 }
 
 
+
 static struct pam
 makeOutputPam(unsigned int const width,
               unsigned int const height) {
@@ -331,7 +332,7 @@ doHilbert(FILE *       const ifP,
     int *x,*y;
     int sum;
 
-    grays = pnm_readpam(ifP, &graypam, sizeof(graypam));
+    grays = pnm_readpam(ifP, &graypam, PAM_STRUCT_SIZE(tuple_type));
 
     bitpam = makeOutputPam(graypam.width, graypam.height);
 
@@ -693,7 +694,7 @@ main(int argc, char *argv[]) {
         tuple * bitrow;
         int row;
 
-        pnm_readpaminit(ifP, &graypam, sizeof(graypam));
+        pnm_readpaminit(ifP, &graypam, PAM_STRUCT_SIZE(tuple_type));
 
         bitpam = makeOutputPam(graypam.width, graypam.height);