Release 10.35.96

git-svn-id: http://svn.code.sf.net/p/netpbm/code/super_stable@2582 9d0c8265-081b-0410-96cb-a4ca84ce46f8

16 files changed, 100 insertions, 67 deletions

diff --git a/converter/pbm/escp2topbm.c b/converter/pbm/escp2topbm.c
index 049ed23c..28296da9 100644
--- a/converter/pbm/escp2topbm.c
+++ b/converter/pbm/escp2topbm.c
@@ -48,6 +48,8 @@ dec_epson_rle(unsigned        const int k,
         }
         dpos += i;
     }
+    if(dpos > k)
+      pm_error("Corrupt compressed block"); 
     return pos;        /* return number of treated input bytes */
 }
 
@@ -96,6 +98,7 @@ main(int    argc,
 
     /* filter out raster data */
     height = 0;  /* initial value */
+    width  = 0;  /* initial value */
     pos = 0;     /* initial value */
     opos = 0;    /* initial value */
 
@@ -104,9 +107,16 @@ main(int    argc,
         if (input[pos] == '\x1b' && input[pos+1] == '.') {
             unsigned int const k =
                 input[pos+5] * ((input[pos+7] * 256 + input[pos+6] + 7) / 8);
+            unsigned int const margin = 256;
+            if(input[pos+5] == 0)
+                pm_error("Abnormal height value in escape sequence");
             height += input[pos+5];
-            width = input[pos+7] * 256 + input[pos+6];
-            REALLOCARRAY(output, opos + k);
+            if(width == 0) /* initialize */
+                width = input[pos+7] * 256 + input[pos+6];
+            else if(width != input[pos+7] * 256 + input[pos+6])
+                pm_error("Abnormal width value in escape sequence");
+
+            REALLOCARRAY(output, opos + k + margin);
             if (output == NULL)
                 pm_error("Cannot allocate memory");
 
diff --git a/converter/pbm/pbmtoatk.c b/converter/pbm/pbmtoatk.c
index de7adf63..9399f602 100644
--- a/converter/pbm/pbmtoatk.c
+++ b/converter/pbm/pbmtoatk.c
@@ -125,7 +125,6 @@ main(int argc, char *argv[]) {
     register bit *bP;
     int rows, cols, format, row;
     int col;
-    char name[100], *cp;
     unsigned char curbyte, newbyte;
     int curcount, gather;
 
@@ -136,15 +135,8 @@ main(int argc, char *argv[]) {
 
     else if (argc-1 == 1) {
         ifd = pm_openr( argv[1] );
-        strcpy(name, argv[1]);
-        if (STREQ( name, "-"))
-            strcpy(name, "noname");
-        
-        if ((cp = strchr(name, '.')) != 0)
-            *cp = '\0';
     } else {
         ifd = stdin;
-        strcpy( name, "noname" );
     }
 
     pbm_readpbminit(ifd, &cols, &rows, &format);
diff --git a/converter/pbm/pbmtoepson.c b/converter/pbm/pbmtoepson.c
index d26734d4..1d1b1608 100644
--- a/converter/pbm/pbmtoepson.c
+++ b/converter/pbm/pbmtoepson.c
@@ -68,7 +68,7 @@ parseCommandLine(int                 argc,
     MALLOCARRAY_NOFAIL(option_def, 100);
 
     option_def_index = 0;   /* incremented by OPTENT3 */
-    OPTENT3(0, "protocol",   OPT_UINT,   &protocol,
+    OPTENT3(0, "protocol",   OPT_STRING,   &protocol,
             &protocolSpec,                    0);
     OPTENT3(0, "dpi",        OPT_UINT,   &cmdlineP->dpi,
             &dpiSpec,                    0);
diff --git a/converter/pbm/pbmtoescp2.c b/converter/pbm/pbmtoescp2.c
index 787f7027..9992fec9 100644
--- a/converter/pbm/pbmtoescp2.c
+++ b/converter/pbm/pbmtoescp2.c
@@ -164,6 +164,11 @@ main(int argc, char* argv[]) {
         for (idx = 0; idx < 24 && row+idx < rows; ++idx)
             pbm_readpbmrow_packed(ifP,bytes+idx*pbm_packed_bytes(cols),
                                   cols,format);
+        /* Add delimiter to end of rows, using inverse of final
+           data byte to prevent match. */
+        *(bytes+idx*pbm_packed_bytes(cols)) =
+          ~ *(bytes+idx*pbm_packed_bytes(cols)-1);
+
         /* Write raster data. */
         if (cmdline.compress != 0) {
             /* compressed */
diff --git a/converter/pbm/pbmtog3.c b/converter/pbm/pbmtog3.c
index 0b536390..77ea545a 100644
--- a/converter/pbm/pbmtog3.c
+++ b/converter/pbm/pbmtog3.c
@@ -436,7 +436,7 @@ main(int    argc,
 
     MALLOCARRAY_NOFAIL(bitrow, pbm_packed_bytes(cols) + sizeof(wordint));
 
-    MALLOCARRAY_NOFAIL(milepost, readcols + 1);
+    MALLOCARRAY_NOFAIL(milepost, readcols + 2);
 
     initOutStream(cmdline.reversebits);
     puteol();
diff --git a/converter/pbm/pbmtogo.c b/converter/pbm/pbmtogo.c
index 36b145c4..18f3ab6c 100644
--- a/converter/pbm/pbmtogo.c
+++ b/converter/pbm/pbmtogo.c
@@ -102,7 +102,7 @@ main( argc, argv )
     padright = rucols - cols;
 
     for (i = 0; i < BUFSIZE; ++i )
-      buffer[i] = 0;
+      buffer[i] = oldscanline[i] = 0;
     putinit();
 
     /* Start donwloading screen raster */
@@ -151,7 +151,7 @@ main( argc, argv )
                   {
                       olditem = buffer[nbyte++];
                       ucount++;
-                  } while ((olditem != buffer[nbyte])
+                  } while (nbyte < bytesperrow && (olditem != buffer[nbyte])
                            && (ucount < MIN(bytesperrow, MAX_REPEAT)));
                   
                 if ((ucount != MAX_REPEAT) && (nbyte != bytesperrow)) {
@@ -182,7 +182,7 @@ main( argc, argv )
                   {
                       olditem = buffer[nbyte++];
                       ecount++;
-                  } while ((olditem == buffer[nbyte])
+                  } while (nbyte < bytesperrow && (olditem == buffer[nbyte])
                            && (ecount < MIN(bytesperrow, MAX_REPEAT)));
                   
                 if (ecount > 1) {
diff --git a/converter/pbm/pbmtomacp.c b/converter/pbm/pbmtomacp.c
index ad0b22b1..9dc700e6 100644
--- a/converter/pbm/pbmtomacp.c
+++ b/converter/pbm/pbmtomacp.c
@@ -20,6 +20,8 @@
 #define EQUAL		1
 #define UNEQUAL		0
 
+#define MIN3(a,b,c)     (MIN((MIN((a),(b))),(c)))
+
 static void fillbits ARGS(( bit **bits, bit **bitsr, int top, int left, int bottom, int right ));
 static void writemacp ARGS(( bit **bits ));
 static int packit ARGS(( bit *pb, bit *bits ));
@@ -102,23 +104,18 @@ char *argv[];
     left = 0;
 
   if( rflg )
-  { if( right - left >= MAX_COLS )
-      right = left + MAX_COLS - 1;
-  }
+    right = MIN3( right, cols - 1, left + MAX_COLS - 1 );
   else
-    right = ( left + MAX_COLS > cols ) ? ( cols - 1 ) : ( left + MAX_COLS - 1 );
+    right = MIN( cols - 1,  left + MAX_COLS - 1 );
 
   if( !tflg )
     top = 0;
 
   if( bflg )
-  { if( bottom - top >= MAX_LINES )
-      bottom = top + MAX_LINES - 1;
-  }
+    bottom = MIN3( bottom, rows - 1, top + MAX_LINES - 1);
   else
-    bottom = ( top + MAX_LINES > rows ) ?
-		   ( rows - 1 ) : ( top + MAX_LINES - 1 );
-  
+    bottom = MIN( rows - 1, top + MAX_LINES - 1 );
+
     if( right <= left || left < 0 || right - left + 1 > MAX_COLS )
       pm_error("error in right (= %d) and/or left (=%d)",right,left );
     if( bottom <= top || top < 0 || bottom - top + 1 > MAX_LINES )
@@ -220,7 +217,7 @@ packit( pb, bits )
       save = *srcb++;
       charcount--;
       newcount = 1;
-      while( (*srcb == save) && charcount ) { 
+      while( charcount && (*srcb == save) ) { 
           srcb++;
           newcount++;
           charcount--;
diff --git a/converter/pbm/pbmtomatrixorbital.c b/converter/pbm/pbmtomatrixorbital.c
index 79347978..96e1406a 100644
--- a/converter/pbm/pbmtomatrixorbital.c
+++ b/converter/pbm/pbmtomatrixorbital.c
@@ -60,7 +60,7 @@ main(int argc, char * argv[]) {
 
     pbm_init(&argc, argv);
 
-    if (argc-1 > 0)
+    if (argc-1 > 1)
         pm_error("Too many arguments (%d).  The only valid argument is an "
                  "input file name.", argc-1);
     else if (argc-1 == 1) 
diff --git a/converter/pbm/pbmtomgr.c b/converter/pbm/pbmtomgr.c
index 7a6e7fc1..acf689e1 100644
--- a/converter/pbm/pbmtomgr.c
+++ b/converter/pbm/pbmtomgr.c
@@ -40,6 +40,10 @@ main( argc, argv )
 	ifp = stdin;
 
     pbm_readpbminit( ifp, &cols, &rows, &format );
+    if (cols > 4095)
+        pm_error("Image width too large: %u (max: 4095)", cols);
+    if (rows > 4095)
+        pm_error("Image heigth too large: %u (max: 4095)", cols);
     bitrow = pbm_allocrow( cols );
     
     /* Round cols up to the nearest multiple of 8. */
diff --git a/converter/pbm/pbmtopi3.c b/converter/pbm/pbmtopi3.c
index 06023d7a..8d178f61 100644
--- a/converter/pbm/pbmtopi3.c
+++ b/converter/pbm/pbmtopi3.c
@@ -14,6 +14,7 @@
 
 #include <stdio.h>
 #include "pbm.h"
+#include "pm_c_util.h"
 
 static void putinit ARGS(( void ));
 static void putbit ARGS(( bit b ));
@@ -28,8 +29,9 @@ main( argc, argv )
     FILE* ifp;
     bit* bitrow;
     register bit* bP;
-    int rows, cols, format, padright, row, col;
-
+    int inrows, incols, format, padright, row, col;
+    int const outcols = 640;
+    int const outrows = 400;
 
     pbm_init( &argc, argv );
 
@@ -41,27 +43,26 @@ main( argc, argv )
     else
 	ifp = stdin;
 
-    pbm_readpbminit( ifp, &cols, &rows, &format );
-    if (cols > 640)
-	cols = 640;
-    if (rows > 400)
-	rows = 400;
-    bitrow = pbm_allocrow( cols );
-    
+    pbm_readpbminit( ifp, &incols, &inrows, &format );
+    bitrow = pbm_allocrow( MAX(incols, outcols) );
+
     /* Compute padding to round cols up to 640 */
-    padright = 640 - cols;
+    if(incols < outcols)
+        padright = outcols - incols;
+    else 
+        padright = 0;
 
     putinit( );
-    for ( row = 0; row < rows; ++row )
+    for ( row = 0; row < MIN(inrows, outrows); ++row )
 	{
-	pbm_readpbmrow( ifp, bitrow, cols, format );
-        for ( col = 0, bP = bitrow; col < cols; ++col, ++bP )
+	pbm_readpbmrow( ifp, bitrow, incols, format );
+        for ( col = 0, bP = bitrow; col < MIN(incols, outcols); ++col, ++bP )
 	    putbit( *bP );
 	for ( col = 0; col < padright; ++col )
 	    putbit( 0 );
         }
-    while (row++ < 400)
-	for ( col = 0; col < 640; ++col)
+    while (row++ < outrows)
+	for ( col = 0; col < outcols; ++col)
 	    putbit( 0 );
 
     pm_close( ifp );
diff --git a/converter/pbm/pbmtopk.c b/converter/pbm/pbmtopk.c
index b84818b1..08aff49a 100644
--- a/converter/pbm/pbmtopk.c
+++ b/converter/pbm/pbmtopk.c
@@ -854,11 +854,17 @@ main(int argc, char *argv[]) {
     initialize_pk() ;
    
     if (--argc < 1) pm_usage(usage) ;
-    strcpy(pkname, *++argv) ;
+    ++argv;
+    if(strlen(*argv) + 4 > NAMELENGTH)
+        pm_error("pkname is too long");
+    strcpy(pkname, *argv) ;
     pbmtopk_add_suffix(pkname, ".pk") ;
    
-    if (--argc < 1) pm_usage(usage) ;
-    strcpy(tfmname, *++argv) ;
+    if (--argc < 1) pm_usage(usage);
+    ++argv;
+    if(strlen(*argv) + 4 > NAMELENGTH)
+        pm_error("tfmname is too long");
+    strcpy(tfmname, *argv) ;
     pbmtopk_add_suffix(tfmname, ".tfm") ;
    
     if (--argc < 1) pm_usage(usage) ;
diff --git a/converter/pbm/pbmtoppa/cutswath.c b/converter/pbm/pbmtoppa/cutswath.c
index 0d44ce45..d3f15c03 100644
--- a/converter/pbm/pbmtoppa/cutswath.c
+++ b/converter/pbm/pbmtoppa/cutswath.c
@@ -39,13 +39,15 @@ cut_pbm_swath(pbm_stat* pbm,ppa_stat* prn,int maxlines,ppa_sweep_data* sweep_dat
   int shift;
   ppa_nozzle_data nozzles[2];
 
+  ppa = NULL;
+
   /* shift = 6 if DPI==300  */
   /* shift = 12 if DPI==600 */ 
   shift = ( prn->DPI == 300 ? 6:12 ) ;
   
   /* safeguard against the user freeing these */
-  sweep_data->image_data=NULL;
-  sweep_data->nozzle_data=NULL;
+  sweep_data->image_data  = NULL;
+  sweep_data->nozzle_data = NULL;
 
   /* read the data from the input file */
   width8 = (pbm->width + 7) / 8;
@@ -66,7 +68,7 @@ cut_pbm_swath(pbm_stat* pbm,ppa_stat* prn,int maxlines,ppa_sweep_data* sweep_dat
     if(!pbm_readline(pbm,data))
     {
       fprintf(stderr,"cutswath(): A-could not read top margin\n");
-      free(data);
+      free (data); data=NULL;
       return 0;
     }
 
@@ -77,10 +79,10 @@ cut_pbm_swath(pbm_stat* pbm,ppa_stat* prn,int maxlines,ppa_sweep_data* sweep_dat
       if(!pbm_readline(pbm,data))
       {
 	fprintf(stderr,"cutswath(): could not clear bottom margin\n");
-	free(data);
+	free (data); data=NULL;
 	return 0;
       }
-    free(data);
+    free (data); data=NULL;
     return 1;
   }
 
@@ -95,7 +97,7 @@ cut_pbm_swath(pbm_stat* pbm,ppa_stat* prn,int maxlines,ppa_sweep_data* sweep_dat
     if(!pbm_readline(pbm,data+width8*numlines))
     {
       fprintf(stderr,"cutswath(): B-could not read next line\n");
-      free(data);
+      free (data); data=NULL;
       return 0;
     }
     if(!got_nonblank)
@@ -130,7 +132,7 @@ cut_pbm_swath(pbm_stat* pbm,ppa_stat* prn,int maxlines,ppa_sweep_data* sweep_dat
 	  {
 	    fprintf (stderr, "Ack! newleft=%d, newright=%d, left=%d, right=%d\n",
 		     newleft, newright, left, right);
-	    free (data);
+	    free (data); data=NULL;
 	    return 0;
 	  }
 
@@ -177,13 +179,13 @@ cut_pbm_swath(pbm_stat* pbm,ppa_stat* prn,int maxlines,ppa_sweep_data* sweep_dat
 	if(!pbm_readline(pbm,data))
 	{
 	  fprintf(stderr,"cutswath(): could not clear bottom margin\n");
-	  free(data);
+	  free (data); data=NULL;
 	  return 0;
 	}
-      free(data);
+      free (data); data=NULL;
       return 1;
     }
-    free(data);
+    free (data); data=NULL;
     return 0; /* error, since didn't get to lower margin, yet blank */
   }
 
@@ -197,7 +199,7 @@ cut_pbm_swath(pbm_stat* pbm,ppa_stat* prn,int maxlines,ppa_sweep_data* sweep_dat
       if(!pbm_readline(pbm,data+width8*numlines))
 	{
 	  fprintf(stderr,"cutswath(): C-could not read next line\n");
-	  free(data);
+	  free (data); data=NULL;
 	  return 0;
 	}
       numlines++;
@@ -225,7 +227,7 @@ cut_pbm_swath(pbm_stat* pbm,ppa_stat* prn,int maxlines,ppa_sweep_data* sweep_dat
   if ((ppa = malloc ((p_width8+2*shift) * numlines)) == NULL)
     {
       fprintf(stderr,"cutswath(): could not malloc ppa storage\n");
-      free (data);
+      free (data); data=NULL;
       return 0;
     }
 
@@ -292,7 +294,7 @@ cut_pbm_swath(pbm_stat* pbm,ppa_stat* prn,int maxlines,ppa_sweep_data* sweep_dat
   }
 
   /* done with data */
-  free(data);
+  free (data); data=NULL;
 
   /* place 0's in the last 12 columns */
   memset (place, 0, numlines/2 * shift);
diff --git a/converter/pbm/pbmtoppa/pbm.c b/converter/pbm/pbmtoppa/pbm.c
index 5c9798f2..2f8a42b1 100644
--- a/converter/pbm/pbmtoppa/pbm.c
+++ b/converter/pbm/pbmtoppa/pbm.c
@@ -91,6 +91,7 @@ int pbm_readline(pbm_stat* pbm,unsigned char* data)
       pbm->current_line++;
       pbm->unread = 0;
       free (pbm->revdata);
+      pbm->revdata = NULL;
       return 1;
     }
 
diff --git a/converter/pbm/pbmtoppa/pbmtoppa.c b/converter/pbm/pbmtoppa/pbmtoppa.c
index 85a98529..f43c08a8 100644
--- a/converter/pbm/pbmtoppa/pbmtoppa.c
+++ b/converter/pbm/pbmtoppa/pbmtoppa.c
@@ -63,9 +63,14 @@ print_pbm(FILE * const in) {
         ppa_init_page(&printer);
         ppa_load_page(&printer);
 
-        sweeps[0].direction = right_to_left;
+        sweeps[0].direction   = right_to_left;
+        sweeps[0].image_data  = NULL;
+        sweeps[0].nozzle_data = NULL;
         sweeps[0].next=&sweeps[1];
-        sweeps[1].direction = left_to_right;
+
+        sweeps[1].direction   = left_to_right;
+        sweeps[1].image_data  = NULL;
+        sweeps[1].nozzle_data = NULL;
         sweeps[1].next=&sweeps[0];
 
         current_sweep=0;
@@ -88,6 +93,8 @@ print_pbm(FILE * const in) {
                     ppa_print_sweep(&printer, &sweeps[previous_sweep]);
                     free(sweeps[previous_sweep].image_data);
                     free(sweeps[previous_sweep].nozzle_data);
+                    sweeps[previous_sweep].image_data = NULL;
+                    sweeps[previous_sweep].nozzle_data = NULL;
                 }
                 previous_sweep=current_sweep;
                 current_sweep= current_sweep==0 ? 1 : 0;
@@ -106,6 +113,10 @@ print_pbm(FILE * const in) {
         free(sweeps[0].nozzle_data);
         free(sweeps[1].image_data);
         free(sweeps[1].nozzle_data);
+        sweeps[0].image_data = NULL;
+        sweeps[0].nozzle_data = NULL;
+        sweeps[1].image_data = NULL;
+        sweeps[1].nozzle_data = NULL;
 
         ppa_eject_page(&printer);
 
diff --git a/converter/pbm/pbmtoppa/ppa.c b/converter/pbm/pbmtoppa/ppa.c
index 8363d927..aa30d684 100644
--- a/converter/pbm/pbmtoppa/ppa.c
+++ b/converter/pbm/pbmtoppa/ppa.c
@@ -389,7 +389,9 @@ static void __inline__ place_2bytes(int x,unsigned char* y)
 static void __inline__ place_4bytes(int x,unsigned char* y)
 { place_2bytes(x>>16,y); place_2bytes(x,y+2); }
 
-#define do_compress_data (1)
+#define do_compress_data (1)  /* Compress. */
+/* The no-compression case has not been well tested 2015.05.31 */
+
 void ppa_print_sweep(ppa_stat* prn,ppa_sweep_data* data)
 {
   unsigned char* pc, *tpc;
@@ -403,11 +405,9 @@ void ppa_print_sweep(ppa_stat* prn,ppa_sweep_data* data)
   int nozzle_data_size;
   int MF; /* Multiplicative Factor -- quick hack */
 
-  pc=data->image_data;
-
   if(do_compress_data)
   {
-    if(!(pc=malloc((datasize/64+1)*65)))
+    if( !( pc = malloc( datasize * 2 + 1 )) )  /* Worst case + margin */
     {
       fprintf(stderr,"ppa_print_sweep(): could not malloc storage for compressed data\n");
       exit(-1);
@@ -416,12 +416,13 @@ void ppa_print_sweep(ppa_stat* prn,ppa_sweep_data* data)
   }
 
   /* send image data 16k at a time */
-  for(i=0, tpc=pc; i<datasize; tpc+=16384, i+=16384)
+  for(i=0, tpc= do_compress_data ? pc : data->image_data;
+        i<datasize; tpc+=16384, i+=16384)
     vlink_put(prn->fptr, 0, datasize-i > 16384 ? 16384 : datasize-i, tpc);
 
   /* memory leak fix courtesy of John McKown */
   if (do_compress_data)
-    free (pc);
+      free (pc);
 
   /* construct sweep packet */
   switch(prn->version)
diff --git a/converter/pbm/pktopbm.c b/converter/pbm/pktopbm.c
index 32ed4fde..af49e9c7 100644
--- a/converter/pbm/pktopbm.c
+++ b/converter/pbm/pktopbm.c
@@ -214,7 +214,10 @@ main(int argc, char *argv[]) {
 
     if (--argc < 1) pm_usage(usage) ;
 
-    strcpy(pkname, *++argv) ;
+    ++argv;
+    if(strlen(*argv) + 4 > NAMELENGTH)
+        pm_error("pkname is too long");
+    strcpy(pkname, *argv) ;
     pktopbm_add_suffix(pkname, ".pk") ;
 
     car = 0 ;