Fix array bounds violation

git-svn-id: http://svn.code.sf.net/p/netpbm/code/trunk@3279 9d0c8265-081b-0410-96cb-a4ca84ce46f8

3 files changed, 16 insertions, 2 deletions

diff --git a/converter/other/pstopnm.c b/converter/other/pstopnm.c
index a89224ee..73954d86 100644
--- a/converter/other/pstopnm.c
+++ b/converter/other/pstopnm.c
@@ -334,7 +334,7 @@ computeSizeRes(struct CmdlineInfo  const cmdline,
   Figure out how big the output image should be and what output device
   resolution Ghostscript should assume (return as *imageDimP).
 
-  A resolution number is the number of pixels per inch that the a
+  A resolution number is the number of pixels per inch that the
   printer prints.  Since we're emulating a printed page with a PNM
   image, and a PNM image has no spatial dimension (you can't say how
   many inches wide a PNM image is), it's kind of confusing.
@@ -347,7 +347,7 @@ computeSizeRes(struct CmdlineInfo  const cmdline,
   tell Ghostscript that our horizontal output device resolution is 500
   pixels per inch.
 
-  X and Y in all returned values is with respect to the image, not the
+  X and Y in all returned values are with respect to the image, not the
   page.  Note that the image might be placed sideways on the page, so that
   page X and Y would be reversed from image X and Y.
 -----------------------------------------------------------------------------*/
diff --git a/doc/HISTORY b/doc/HISTORY
index 3d1edd84..9622feeb 100644
--- a/doc/HISTORY
+++ b/doc/HISTORY
@@ -16,6 +16,9 @@ not yet  BJH  Release 10.83.00
               not contain pixel resolution information.  Introduced in Netpbm
               10.48 (September 2009)
 
+              Pbmmask: Fix invalid memory reference with zero-dimension
+              input image.  Broken in primordial Netpbm, ca 1989.
+
               libnetpbm: Add pnm_colorspec_rgb_integer,
               pnm_colorspec_rgb_norm, pnm_colorspec_rgb_x11,
               pnm_colorspec_dict, pnm_colorspec_dict_close.
diff --git a/editor/pbmmask.c b/editor/pbmmask.c
index 7fc3f446..0be10435 100644
--- a/editor/pbmmask.c
+++ b/editor/pbmmask.c
@@ -11,6 +11,7 @@
 */
 
 #include <stdbool.h>
+#include <assert.h>
 
 #include "pbm.h"
 #include "shhopt.h"
@@ -99,6 +100,8 @@ backcolorFmImage(bit **       const bits,
     unsigned int col;
     unsigned int wcount;
 
+    assert(cols > 0); assert(rows > 0);
+
     wcount = 0;
     for (row = 0; row < rows; ++row) {
         if (bits[row][0] == PBM_WHITE)
@@ -164,6 +167,8 @@ floodEdge(bit **       const bits,
     /* Flood the entire edge.  Probably the first call will be enough, but
        might as well be sure.
     */
+    assert(cols > 0); assert(rows > 0);
+
     for (col = cols - 3; col >= 2; col -= 2) {
         addflood(bits, mask, col, rows - 1, backcolor);
         addflood(bits, mask, col, 0, backcolor);
@@ -183,6 +188,8 @@ flood(bit **       const bits,
       bit          const backcolor,
       bit **       const mask) {
 
+    assert(cols > 0); assert(rows > 0);
+
     floodEdge(bits, cols, rows, backcolor, mask);
 
     while (fstackp > 0) {
@@ -285,6 +292,10 @@ pbmmask(FILE *             const ifP,
 
     bits = pbm_readpbm(ifP, &cols, &rows);
 
+    if (cols == 0 || rows == 0)
+        pm_error("Image contains no pixels, so there is no such thing "
+                 "as background and foreground");
+
     mask = pbm_allocarray(cols, rows);
 
     clearMask(mask, cols, rows);