Release 10.89.03

git-svn-id: http://svn.code.sf.net/p/netpbm/code/advanced@3771 9d0c8265-081b-0410-96cb-a4ca84ce46f8

6 files changed, 49 insertions, 13 deletions

diff --git a/converter/other/pbmtopgm.c b/converter/other/pbmtopgm.c
index 69b20fb2..c35e1cbe 100644
--- a/converter/other/pbmtopgm.c
+++ b/converter/other/pbmtopgm.c
@@ -3,6 +3,7 @@
  */
 
 #include <stdio.h>
+#include <limits.h>
 
 #include "pm_c_util.h"
 #include "pgm.h"
@@ -29,8 +30,13 @@ main(int argc, char *argv[]) {
     height = atoi(argv[2]);
     if (width < 1 || height < 1)
         pm_error("width and height must be > 0");
+    if (width > INT_MAX / height)
+        /* prevent overflow of "value" below */
+        pm_error("sample area (%u columns %u rows) too large",
+                 width, height);
+
     left=width/2; right=width-left;
-    up=width/2; down=height-up;
+    up=height/2; down=height-up;
 
     if (argc == 4)
         ifd = pm_openr(argv[3]);
diff --git a/doc/HISTORY b/doc/HISTORY
index c5a8b4c8..6b9905ac 100644
--- a/doc/HISTORY
+++ b/doc/HISTORY
@@ -4,6 +4,27 @@ Netpbm.
 CHANGE HISTORY 
 --------------
 
+20.03.22 BJH  Release 10.89.03
+
+              pbmtopgm: Fix incorrect output when convolution area is not
+              square.  Always broken.  pbmtopgm was in primordial Netpbm,
+              ca 1991.
+
+              pbmtopgm: Fix crash when convolution matrix too large for word
+              size.  Always broken.  pbmtopgm was in primordial Netpbm, ca
+              1991.
+
+              pnmshear: Fix arithmetic overflow with shear angle near +/- 90
+              degrees.
+
+              pamdice: Fix crash when -width or -height is zero.
+
+              pamdice: Fix incorrect file names when -outstem contains "%s",
+              etc.
+
+20.02.14 BJH  Release 10.89.02
+
+              libnetpbm: pm_getline: ?
 
 20.01.15 BJH  Release 10.89.01
 
diff --git a/editor/pamdice.c b/editor/pamdice.c
index f4b05a8d..32881129 100644
--- a/editor/pamdice.c
+++ b/editor/pamdice.c
@@ -84,7 +84,9 @@ parseCommandLine(int argc, char ** argv,
         /* Uses and sets argc, argv, and some of *cmdline_p and others. */
 
     if (cmdlineP->sliceVertically) {
-        if (hoverlapSpec) {
+        if (cmdlineP->width < 1)
+            pm_error("-width value must not be zero");
+        else if (hoverlapSpec) {
             if (cmdlineP->hoverlap > cmdlineP->width - 1)
                 pm_error("-hoverlap value must be less than -width (%u).  "
                          "You specified %u.",
@@ -93,7 +95,9 @@ parseCommandLine(int argc, char ** argv,
             cmdlineP->hoverlap = 0;
     }
     if (cmdlineP->sliceHorizontally) {
-        if (voverlapSpec) {
+        if (cmdlineP->height < 1)
+            pm_error("-height value must not be zero");
+        else if (voverlapSpec) {
             if (cmdlineP->voverlap > cmdlineP->height - 1)
                 pm_error("-voverlap value must be less than -height (%u).  "
                          "You specified %u.",
@@ -209,7 +213,6 @@ ndigits(unsigned int const arg) {
 
 static void
 computeOutputFilenameFormat(int           const format, 
-                            char          const outstem[],
                             unsigned int  const nHorizSlice,
                             unsigned int  const nVertSlice,
                             const char ** const filenameFormatP) {
@@ -224,9 +227,8 @@ computeOutputFilenameFormat(int           const format,
     default:       filenameSuffix = "";    break;
     }
     
-    pm_asprintf(filenameFormatP, "%s_%%0%uu_%%0%uu.%s",
-                outstem, ndigits(nHorizSlice), ndigits(nVertSlice),
-                filenameSuffix);
+    pm_asprintf(filenameFormatP, "%%s_%%0%uu_%%0%uu.%s",
+                ndigits(nHorizSlice), ndigits(nVertSlice), filenameSuffix);
 
     if (*filenameFormatP == NULL)
         pm_error("Unable to allocate memory for filename format string");
@@ -253,13 +255,13 @@ openOutStreams(struct pam   const inpam,
     const char * filenameFormat;
     unsigned int vertSlice;
 
-    computeOutputFilenameFormat(inpam.format, outstem, nHorizSlice, nVertSlice,
+    computeOutputFilenameFormat(inpam.format, nHorizSlice, nVertSlice,
                                 &filenameFormat);
 
     for (vertSlice = 0; vertSlice < nVertSlice; ++vertSlice) {
         const char * filename;
 
-        pm_asprintf(&filename, filenameFormat, horizSlice, vertSlice);
+        pm_asprintf(&filename, filenameFormat, outstem, horizSlice, vertSlice);
 
         if (filename == NULL)
             pm_error("Unable to allocate memory for output filename");
diff --git a/editor/pnmshear.c b/editor/pnmshear.c
index 1c330bb7..c705c261 100644
--- a/editor/pnmshear.c
+++ b/editor/pnmshear.c
@@ -217,6 +217,7 @@ main(int argc, const char * argv[]) {
     int row;
     xelval maxval, newmaxval;
     double shearfac;
+    double newcolsD;
 
     struct CmdlineInfo cmdline;
 
@@ -242,7 +243,12 @@ main(int argc, const char * argv[]) {
 
     shearfac = fabs(tan(cmdline.angle));
 
-    newcols = rows * shearfac + cols + 0.999999;
+    newcolsD = (double) rows * shearfac + cols + 0.999999;
+    if (newcolsD > INT_MAX-2)
+        pm_error("angle is too close to +/-90 degrees; "
+                 "output image too wide for computation");
+    else
+        newcols = (int) newcolsD;
 
     pnm_writepnminit(stdout, newcols, rows, newmaxval, newformat, 0);
     newxelrow = pnm_allocrow(newcols);
diff --git a/lib/pmfileio.c b/lib/pmfileio.c
index bfb0d117..bea01abe 100644
--- a/lib/pmfileio.c
+++ b/lib/pmfileio.c
@@ -908,11 +908,12 @@ pm_getline(FILE *   const ifP,
     }
 
     if (gotLine) {
-        REALLOCARRAY(buffer, nReadSoFar+1);
+        bufferSz = nReadSoFar + 1;
+        REALLOCARRAY(buffer, bufferSz);
         if (!buffer) {
             pm_error("Failed to allocate %lu bytes for buffer "
                      "to assemble a line of input",
-                     (unsigned long) nReadSoFar+1);
+                     (unsigned long) bufferSz);
         }
         buffer[nReadSoFar] = '\0';
     }
diff --git a/version.mk b/version.mk
index f65501cb..03e242d2 100644
--- a/version.mk
+++ b/version.mk
@@ -1,3 +1,3 @@
 NETPBM_MAJOR_RELEASE = 10
 NETPBM_MINOR_RELEASE = 89
-NETPBM_POINT_RELEASE = 1
+NETPBM_POINT_RELEASE = 3