Release 10.35.97

git-svn-id: http://svn.code.sf.net/p/netpbm/code/super_stable@2634 9d0c8265-081b-0410-96cb-a4ca84ce46f8

5 files changed, 33 insertions, 4 deletions

diff --git a/Makefile.version b/Makefile.version
index e43f481f..fc720c62 100644
--- a/Makefile.version
+++ b/Makefile.version
@@ -1,3 +1,3 @@
 NETPBM_MAJOR_RELEASE = 10
 NETPBM_MINOR_RELEASE = 35
-NETPBM_POINT_RELEASE = 96
+NETPBM_POINT_RELEASE = 97
diff --git a/converter/other/pnmtopclxl.c b/converter/other/pnmtopclxl.c
index 7c85d09c..23c7bd3a 100644
--- a/converter/other/pnmtopclxl.c
+++ b/converter/other/pnmtopclxl.c
@@ -250,9 +250,14 @@ out(XY_rle *rle,int count) {
         rle->fbpos+=count;
     }
     if(rle->fbpos+129>rle->fbufsize) {
+        if (rle->fbufsize > INT_MAX/1.2)
+            pm_error("Arithmetic overflow during attempt to expand RLE "
+                     "output buffer beyond %u", rle->fbufsize);
         rle->fbufsize*=1.2; 
         rle->fbuf=realloc(rle->fbuf,rle->fbufsize);
         if(rle->fbuf==NULL) {
+            pm_error("Out of memory while attempting to expand RLE "
+                     "output buffer beyond %u", rle->fbufsize);
             rle->error=-1;
             rle->fbpos=0;
             return -1;
@@ -323,7 +328,7 @@ XY_Write(int fd, const void *buf,int cnt) {
         while(len<cnt) {
                 int n = write(fd,(char*)buf+len,cnt-len);
                 if(n<=0)
-                        return n;
+                    pm_error("Failed to write %u bytes to fd %d", cnt - len, fd);
                 len+=n;
         }
         return len;
@@ -816,6 +821,8 @@ convertAndWriteImage(int                  const outFd,
     xl_attr_ubyte(outFd, aDestinationSize);   
     XL_Operator(outFd, oBeginImage);
 
+    if (pclGenP->linelen > INT_MAX / 20)
+        pm_error("Image too big");
     rle = XY_RLEnew(pclGenP->linelen*20);
     if (!rle) 
         pm_error("Unable to allocate %d bytes for the RLE buffer",
diff --git a/converter/pgm/sbigtopgm.c b/converter/pgm/sbigtopgm.c
index c6785152..228b71b3 100644
--- a/converter/pgm/sbigtopgm.c
+++ b/converter/pgm/sbigtopgm.c
@@ -124,7 +124,7 @@ int main(argc, argv)
 	}
 	*cp = 0;
         if (strncmp(hdr, "ST-", 3) == 0  ||
-            (hdr == &hdr[0] && strstr(hdr,"Image") != NULL)) {
+            (hdr == &header[0] && strstr(hdr,"Image") != NULL)) {
             char *ep = strchr(hdr + 3, ' ');
 
 	    if (ep != NULL) {
diff --git a/converter/ppm/ppmtoilbm.c b/converter/ppm/ppmtoilbm.c
index 7b38dd4d..fcc6053f 100644
--- a/converter/ppm/ppmtoilbm.c
+++ b/converter/ppm/ppmtoilbm.c
@@ -635,7 +635,7 @@ ppm_to_ham(fp, cols, rows, maxval, colormap, colors, cmapmaxval, hamplanes)
     if( DO_COMPRESS )
         write_body_rows();
     else
-        do_ham_body(fp, NULL, cols, rows, maxval, hammaxval, 
+        do_ham_body(fp, stdout, cols, rows, maxval, hammaxval, 
                     nPlanes, colormap, colors);
 }
 
diff --git a/doc/HISTORY b/doc/HISTORY
index dc406771..212a652c 100644
--- a/doc/HISTORY
+++ b/doc/HISTORY
@@ -4,6 +4,28 @@ Netpbm.
 CHANGE HISTORY 
 --------------
 
+15.09.26 BJH  Release 10.35.97
+
+              sbigtopgm: Fix detection of camera type.  Broken in
+              Netpbm 10.35.96 (June 2015).
+
+              fitstopnm: Fix -min and -max.  Broken in Netpbm 10.39 (June
+              2007).
+
+              Pnmtopclxl: fix wild memory access when out of memory.  Always
+              broken (Pnmtopclxl was new in Netpbm 10.6 (July 2002)).
+
+              Pnmtopclxl: fix wild memory access with pathologically large and
+              uncompressible image.  Always broken (Pnmtopclxl was new in
+              Netpbm 10.6 (July 2002)).
+
+              Pnmtopclxl: fix silent output corruption when a file write
+              fails.  Always broken (Pnmtopclxl was new in Netpbm 10.6 (July
+              2002)).
+
+              ppmtoilbm: Fix failure with -hamforce and -nocompression.
+              Broken in Netpbm 9.12 (March 2001).
+
 15.06.28 BJH  Release 10.35.96
 
               palmtopnm: Fix distorted output with PackBits compressed input.