Release 10.70.06

git-svn-id: http://svn.code.sf.net/p/netpbm/code/advanced@2528 9d0c8265-081b-0410-96cb-a4ca84ce46f8

2 files changed, 19 insertions, 17 deletions

diff --git a/converter/other/cameratopam/ljpeg.c b/converter/other/cameratopam/ljpeg.c
index 29e4ff98..d5e21d3b 100644
--- a/converter/other/cameratopam/ljpeg.c
+++ b/converter/other/cameratopam/ljpeg.c
@@ -33,21 +33,26 @@ ljpeg_start (FILE * ifp, struct jhead *jh)
   do {
     fread (data, 2, 2, ifp);
     tag =  data[0] << 8 | data[1];
-    len = (data[2] << 8 | data[3]) - 2;
-    if (tag <= 0xff00 || len > 255) return 0;
-    fread (data, 1, len, ifp);
-    switch (tag) {
+    len = (data[2] << 8 | data[3]);
+    if (len < 2)
+      pm_error("Length field is %u; must be at least 2", len);
+    else {
+      unsigned int const dataLen = len - 2;
+      if (tag <= 0xff00 || dataLen > 255) return 0;
+      fread (data, 1, dataLen, ifp);
+      switch (tag) {
       case 0xffc3:
-    jh->bits = data[0];
-    jh->high = data[1] << 8 | data[2];
-    jh->wide = data[3] << 8 | data[4];
-    jh->clrs = data[5];
-    break;
+        jh->bits = data[0];
+        jh->high = data[1] << 8 | data[2];
+        jh->wide = data[3] << 8 | data[4];
+        jh->clrs = data[5];
+        break;
       case 0xffc4:
-    for (dp = data; dp < data+len && *dp < 4; ) {
-      jh->huff[*dp] = free_decode;
-      dp = make_decoder (++dp, 0);
-    }
+        for (dp = data; dp < data+dataLen && *dp < 4; ) {
+          jh->huff[*dp] = free_decode;
+          dp = make_decoder (++dp, 0);
+        }
+      }
     }
   } while (tag != 0xffda);
   jh->row = calloc (jh->wide*jh->clrs, 2);
diff --git a/converter/other/pnmtorle.c b/converter/other/pnmtorle.c
index 180b144f..8908c356 100644
--- a/converter/other/pnmtorle.c
+++ b/converter/other/pnmtorle.c
@@ -212,7 +212,6 @@ main(int argc, char **  argv) {
 
     const char * pnmname;
     const char * outname;
-    static char filename[BUFSIZ];
     int oflag;
 
     pnm_init(&argc, argv);
@@ -239,11 +238,9 @@ main(int argc, char **  argv) {
 
     /* Open the file. */
     if (pnmname == NULL) {
-        strcpy(filename, "stdin");
         fp = pm_openr("-");
     } else {
-        strcpy(filename, pnmname);
-        fp = pm_openr(filename);
+        fp = pm_openr(pnmname);
     }
 
     hdr.rle_file = rle_open_f( hdr.cmd, outname, "wb" );